ÖÐÎÄ
½»Á÷»ú
Ô°ÇøÍø½»Á÷»ú
Êý¾ÝÖÐÐÄÓëÔÆÅÌËã½»Á÷»ú
ÐÐÒµ¾«Ñ¡½»Á÷ϵÁÐ
¹¤Òµ½»Á÷»ú
Åä¼þ
ËùÓÐÊÖÒÕ½â¾ö¼Æ»®
·ÓÉÆ÷
»ã¾Û·ÓÉÆ÷
ÐÐÒµ¾«Ñ¡Â·ÓÉÆ÷ϵÁÐ
ËùÓÐÊÖÒÕ½â¾ö¼Æ»®
ÎÞÏß
·Å×°ÐÍÎÞÏß½ÓÈëµã
Ç½ÃæÐÍÎÞÏß½ÓÈëµã
ÖÇ·ÖÎÞÏß½ÓÈëµã
ÊÒÍâÎÞÏß½ÓÈëµã
³¡¾°»¯ÎÞÏß
ÎÞÏß¿ØÖÆÆ÷
ÐÐÒµ¾«Ñ¡ÎÞÏßϵÁÐ
ÎÞÏß¹ÜÀíÓëÓ¦ÓÃ
ÔÆ×ÀÃæ
ÔÆÖÕ¶ËϵÁÐ
ÔÆÖ÷»úϵÁÐ
ÔÆ×ÀÃæÈí¼þϵÁÐ
Åä¼þϵÁÐ
·þÎñ²úÆ·
Çå¾²
´óÊý¾ÝÇ徲ƽ̨
ÏÂÒ»´ú·À»ðǽ
Çå¾²Íø¹Ø
¼ì²â¹ÜÀíÇå¾²
ËùÓÐÊÖÒÕ½â¾ö¼Æ»®
Èí¼þ
Éí·Ý¹ÜÀí
·þÎñ²úÆ·
»ù´¡Î¬»¤·þÎñ
ÔËά¹ÜÀí·þÎñ
Çå¾²·þÎñ
±¸¼þÓëÀ©ÈÝ·þÎñ
ÅàѵÓëÈÏÖ¤·þÎñ
¿ËÈÕ£¬97¹ú¼ÊÍøÂçCERTÇå¾²Ó¦¼±ÏìÓ¦ÍŶӹØ×¢µ½Oracle¹Ù·½Ðû²¼ÁË2021Äê1ÔÂÒªº¦²¹¶¡¸üÐÂͨ¸æ£¬¸Ã²¹¶¡ÖÐÐÞ²¹Á˰üÀ¨ CVE-2021-2109 Weblogic ServerÔ¶³Ì´úÂëÖ´ÐÐÎó²îÔÚÄڵĶà¸ö¸ßΣÑÏÖØÎó²î¡£ÔÚCVE-2021-2109Îó²îÖУ¬¹¥»÷Õ߿ɽṹ¶ñÒâÇëÇó£¬Ôì³ÉJNDI×¢Èë¡¢Ö´ÐÐí§Òâ´úÂ룬´Ó¶ø¿ØÖÆ·þÎñÆ÷¡£
Õë¶ÔÒÔÉÏÎó²î£¬97¹ú¼ÊÇå¾²Äܹ»¾ÙÐÐÎó²îɨÃèÓë¼ì²â£¬²¢×öÇå¾²·À»¤¡£
Îó²î¸´ÏÖ
ÇéÐΣºWebLogic10.3.6.0.0
»á¼û¿ØÖÆÌ¨½çÃæ»á¼û
http://192.168.102:49163/console¼´¿É¿´µ½Ò³Ãæ
µÇ¼֮ºó½øÈ룺
Æô¶¯LDAP:
POC¾ç±¾:
Æô¶¯POC£¬²¢·¢ËÍ£º
ÊÜÓ°Ïìϵͳ
Oracle WebLogic Server 14.1.1.0.0
Oracle WebLogic Server 12.2.1.4.0
Oracle WebLogic Server 12.2.1.3.0
Oracle WebLogic Server 12.1.3.0.0
Oracle WebLogic Server 10.3.6.0.0
¹Ù·½²¹¶¡
OracleÒѾΪ´ËÐû²¼ÁËÒ»¸öÇ徲ͨ¸æ£¨2021-01-19£©ÒÔ¼°ÏìÓ¦²¹¶¡:
2021-01-19£ºOracle Critical Patch Update Advisory -January 2021
Á´½Ó£ºhttps://www.oracle.com/security-alerts/cpujan2021.html
97¹ú¼ÊÍøÂçÇå¾²ÆÀ¹ÀÓë¼ì²â¡¢·À»¤²úÆ·
²úÆ· |
˵Ã÷ |
RG-WALLϵÁÐÏÂÒ»´ú ·À»ðǽ
|
ÏÂÒ»´ú·À»ðǽÍŽá·À²¡¶¾ÒÔ¼°ÍþвÇ鱨¼ì²â¡£ÔÚÇå¾²ÄÜÁ¦ÉÏ£¬²»µ«Ö§³ÖNAT¡¢ACL¡¢DDoS·ÀÓùµÈ¹Å°åÇå¾²¹¦Ð§£¬Ò²Ö§³Ö¸»ºñµÄÓ¦Óü¶Çå¾²¹¦Ð§£¬°üÀ¨²¡¶¾²éɱ¡¢ÈëÇÖ¼ì²â¡¢APP¼ì²â¡¢Îļþ¹ýÂË¡¢¶ñÒâURL¹ýÂ˵ȡ£Ìṩ¶àά¶ÈµÄÓ¦Óòã¼à¿ØÓëÆÊÎö£¬×ÊÖúÓû§ÕÆÎÕΣº¦£¬¾«×¼Ô¤¾¯¡£ |
RG-IDPϵÁÐÈëÇÖ¼ì²â ·ÀÓùϵͳ |
97¹ú¼ÊÍøÂçÍÆ³öµÄ½«Éî¶ÈÄÚÈݼì²â¡¢Çå¾²·À»¤¡¢ÉÏÍøÐÐΪ¹ÜÀíµÈÊÖÒÕÍŽáµÄÈëÇÖ¼ì²â·ÀÓùϵͳװ±¸¡£Í¨¹ý¶ÔÍøÂçÖÐÉî²ã¹¥»÷ÐÐΪ¾ÙÐÐ׼ȷµÄÆÊÎöÅжϣ¬×Ô¶¯ÓÐÓõı£»¤ÍøÂçÇå¾²¡£ÅäºÏʵʱ¸üеÄÈëÇÖ¹¥»÷ÌØÕ÷¿â£¬¿É¼ì²â·À»¤3500ÖÖÒÔÉϵÄÍøÂç¹¥»÷ÐÐΪ£¬°üÀ¨DoS/DDoS¡¢²¡¶¾¡¢È䳿¡¢½©Ê¬ÍøÂ硢ľÂí¡¢¿ÉÒÉ´úÂ롢̽²âÓëɨÃèµÈÖÖÖÖÍøÂçÍþв¡£ |
RG-ScanϵÁÐÎó²îÆÀ¹Àϵͳ |
RG-Scanͨ¹ý¶ÔϵͳÎó²î¡¢·þÎñºóÃÅ¡¢ÍøÒ³¹ÒÂí¡¢SQL×¢ÈëÎó²îÒÔ¼°¿çÕ¾¾ç±¾µÈ¹¥»÷ÊֶζàÄêµÄÑо¿»ýÀÛ£¬×ܽá³öÁËÖÇÄÜÖ÷»ú·þÎñ·¢Ã÷¡¢ÖÇÄÜ»¯ÅÀ³æºÍSQL×¢Èë״̬¼ì²âµÈÊÖÒÕ£¬¿ÉÒÔͨ¹ýÖÇÄܱéÀú¹æÔò¿âºÍ¶àÖÖɨÃèÑ¡Ïî×éºÏµÄÊֶΣ¬ÉîÈë׼ȷµÄ¼ì²â³öϵͳºÍÍøÕ¾Öб£´æµÄÎó²îºÍÈõµã¡£ |
RG-WG WEBGuardÓ¦Óñ£»¤ÏµÍ³ |
97¹ú¼ÊRG-WG WebGuardÓ¦Óñ£»¤ÏµÍ³£¬Í¨¹ý¶ÔÊÕÖ§Web·þÎñÆ÷µÄHTTP/HTTPSÁ÷Á¿Ïà¹ØÄÚÈݵÄʵʱÆÊÎö¼ì²â¡¢¹ýÂË£¬À´×¼È·Åжϲ¢×èÖ¹ÖÖÖÖWebÓ¦ÓÃÈëÇÖÐÐΪ£¬×è¶Ï¶ÔWeb·þÎñÆ÷µÄ¶ñÒâ»á¼ûÓë²»·¨²Ù×÷¡£ |
ÆäÖУ¬WEBGuardÓ¦Óñ£»¤ÏµÍ³ÉèÖÃÕ½ÂÔ£º
°ì·¨1£ºµÇ¼WG WEB¹ÜÀí½çÃæ
°ì·¨2£ºÔÚ“»á¼û¿ØÖÆ-URLºÚÃûµ¥”Ìí¼ÓÈçÏÂÕ½ÂÔ
Ô´IP |
0.0.0.0 |
WebÖ÷»ú |
¿Õ |
URL |
/console/consolejndi.portal |
°ì·¨3£º¼ì²éÉèÖÃЧ¹û
Çå¾²½¨Òé
1. ½ûÓÃT3ÐÒ飺
ÈôÊÇÄú²»ÒÀÀµT3ÐÒé¾ÙÐÐJVMͨѶ£¬¿Éͨ¹ýÔÝʱ×è¶ÏT3ÐÒ黺½â´ËÎó²î´øÀ´µÄÓ°Ïì
½øÈëWeblogic¿ØÖÆÌ¨£¬ÔÚbase_domainÉèÖÃÒ³ÃæÖУ¬½øÈë“Çå¾²”Ñ¡Ïî¿¨Ò³Ãæ£¬µã»÷“ɸѡÆ÷”£¬ÉèÖÃɸѡÆ÷¡£
ÔÚÅþÁ¬É¸Ñ¡Æ÷ÖÐÊäÈ룺weblogic.security.net.ConnectionFilterImpl£¬ÔÚÅþÁ¬É¸Ñ¡Æ÷¹æÔò¿òÖÐÊäÈ룺* * 7001 deny t3 t3s¡£
2. եȡÆôÓÃIIOP£º
Éϰ¶Weblogic¿ØÖÆÌ¨£¬ÕÒµ½ÆôÓÃIIOPÑ¡Ï×÷·Ï¹´Ñ¡£¬ÖØÆôÉúЧ¡£
3. ÔÝʱ¹Ø±Õºǫ́/console/console.portal¶ÔÍâ»á¼û
ÍŶÓÏÈÈÝ
97¹ú¼ÊÍøÂçCERTÇå¾²Ó¦¼±ÏìÓ¦ÍŶӣ¬¸ú×Ù×îл¥ÁªÍøÍþвÊÂÎñ£¬Õë¶Ô×îÐÂÇå¾²Îó²î£¬APT¹¥»÷ÒÔ¼°½©Ê¬ÍøÂç¼Ò×å×öʵʱ¸ú×ÙºÍÆÊÎö;Ϊ²úÆ·¡¢¿Í»§Ìṩʵʱ¡¢ÓÐÓõÄÇå¾²·À»¤Õ½ÂÔÓë½â¾ö¼Æ»®¡£
97¹ú¼Ê“ÍøÂç+Çå¾²”Ö÷ÕŽ«ÍøÂç×°±¸µÄÇå¾²ÄÜÁ¦³ä·ÖÑéÕ¹£¬ÍøÂç×°±¸¡¢Çå¾²×°±¸ÓëÇ徲ƽ̨ÖÇÄÜÁª¶¯£¬Àë±ðÇå¾²¹Âµº£¬×é³ÉÕûÍøÁª¶¯µÄÇå¾²°ü¹Üϵͳ£¬ÊµÏÖ·À»¤¡¢Çå¾²Õ¹Íû¡¢ÆÊÎöºÍÏìÓ¦µÈÇå¾²ÎÊÌâ×Ô¶¯»¯È«Á÷³Ì±Õ»·¡£
ÈçÄúÐèÒª97¹ú¼ÊÇå¾²£¬ÇëÁôÏÂÄúµÄÁªÏµ·½·¨