CVE-2025-61882-Oracle-E-Business-Suite-Pre-Auth-RCE-Exploit — Oracle E-Business Suite（版本 12.2.3 - 12.2.14）中存在一个严重的预认证远程代码执行（RCE）漏洞，攻击者可通过恶意 HTTP 请求完全控制易受攻击的服务器——该漏洞现已在野外被积极利用。 | Kitploit

CVE-2025-61882-Oracle-E-Business-Suite-Pre-Auth-RCE-Exploit — Oracle E-Business Suite（版本 12.2.3 - 12.2.14）中存在一个严重的预认证远程代码执行（RCE）漏洞，攻击者可通过恶意 HTTP 请求完全控制易受攻击的服务器——该漏洞现已在野外被积极利用。 | Kitploit

查看 detections/Description.md 获取上下文和 IOC。✅
将 Splunk .spl 查询放入您的 Splunk 环境（或导入为已保存的搜索/告警）。
将 KQL 查询粘贴到 Kibana / Elastic 检测规则中。
将 ebs_safe_hunt.py 复制到仅对归档或脱敏日志具有读取权限的主机，然后运行：
```
python3 ebs_safe_hunt.py /path/to/access.log
```
查看标记的 malicious_ips、servlet_posts、shell_stager 和 malicious_hash 输出，并根据需要升级处理。🕵️‍♂️

index=web_logs OR index=proxy_logs
| where clientip IN ("200.107.207.26","185.181.60.11") OR dest_ip IN ("200.107.207.26","185.181.60.11")
| stats count by clientip, dest_ip, uri, method, useragent, _time
| sort - count

index=web_logs sourcetype=access_combined
| where (uri LIKE "%UiServlet%" OR uri LIKE "%/OA_HTML/%") AND method="POST"
| where NOT cidrmatch("10.0.0.0/8", clientip)  // 根据您的内网范围调整
| stats count by clientip, uri, useragent, _time
| sort - count

index=endpoint_events sourcetype=os_process
| where process_cmdline LIKE "%/bin/bash -i%/dev/tcp/%" OR process_cmdline LIKE "%/dev/tcp//%"
| table _time host user process_name process_cmdline parent_process

#!/usr/bin/env python3
"""
ebs_safe_hunt.py — CVE-2025-61882 指标的安全日志解析器。

用法：
    python3 ebs_safe_hunt.py /path/to/access.log

说明：
 - 解析 Apache/Nginx combined 日志行。
 - 标记 UiServlet/OA_HTML POST 请求、Oracle 公告中的恶意 IP、
   shell 暂存器模式以及观察到的 SHA256 哈希。
 - 安全：无网络 / 不执行利用代码。
"""

import sys
import re
from collections import Counter, defaultdict

# 常见 combined 日志格式的正则表达式
LOG_PATTERN = re.compile(
    r'(?P<ip>\S+) \S+ \S+ \[(?P<time>.*?)\] "(?P<method>\S+) (?P<uri>\S+) \S+" (?P<status>\d{3}) (?P<size>\S+) "(?P<ref>[^"]*)" "(?P<ua>[^"]*)"'
)

# Oracle 提供的 IOC
MALICIOUS_IPS = {"200.107.207.26", "185.181.60.11"}
MALICIOUS_HASHES = {
    "76b6d36e04e367a2334c445b51e1ecce97e4c614e88dfb4f72b104ca0f31235d",
    "aa0d3859d6633b62bccfb69017d33a8979a3be1f3f0a5a4bf6960d6c73d41121",
    "6fd538e4a8e3493dda6f9fcdc96e814bdd14f3e2ef8aa46f0143bff34b882c1b",
}
SHELL_PATTERN = "/bin/bash -i"  # 我们搜索此子字符串（反向 Shell 风格）
SUSPICIOUS_PATHS = ["UiServlet", "/OA_HTML/"]

# 可选：扫描器常用的可疑用户代理列表
SUSPICIOUS_UAS = ["curl", "wget", "python-requests", "nikto", "sqlmap", "masscan", "Nmap"]

def analyze_log(path):
    ip_counts = Counter()
    uri_counts = Counter()
    ua_counts = Counter()
    suspicious = defaultdict(list)

    with open(path, "r", errors="replace") as fh:
        for line_no, line in enumerate(fh, 1):
            m = LOG_PATTERN.search(line)
            if not m:
                # 可选：仍检查非结构化行中的哈希或 shell 模式
                if any(h in line for h in MALICIOUS_HASHES):
                    suspicious["malicious_hash_lines"].append((line_no, line.strip()))
                if SHELL_PATTERN in line or "/dev/tcp/" in line:
                    suspicious["shell_pattern_lines"].append((line_no, line.strip()))
                continue

            ip = m.group("ip")
            method = m.group("method")
            uri = m.group("uri")
            ua = m.group("ua")
            size = m.group("size")

            ip_counts[ip] += 1
            uri_counts[uri] += 1
            ua_counts[ua] += 1

            # 1) 恶意 IP（Oracle）
            if ip in MALICIOUS_IPS:
                suspicious["malicious_ips"].append((line_no, ip, method, uri, ua))

            # 2) 对可疑 EBS 路径的 POST 请求
            if method.upper() == "POST" and any(p in uri for p in SUSPICIOUS_PATHS):
                suspicious["servlet_posts"].append((line_no, ip, uri, ua))

            # 3) 可疑用户代理（扫描器）
            if any(k.lower() in ua.lower() for k in SUSPICIOUS_UAS):
                suspicious["suspicious_ua"].append((line_no, ip, uri, ua))

            # 4) 超大响应（可能的窃取）— 根据您的环境调整阈值
            try:
                if size != "-" and int(size) > 5_000_000:  # >5MB
                    suspicious["large_responses"].append((line_no, ip, uri, size))
            except ValueError:
                pass

            # 5) 行中的 shell 暂存器模式或 /dev/tcp 模式
            if SHELL_PATTERN in line or "/dev/tcp/" in line:
                suspicious["shell_stager"].append((line_no, ip, uri, line.strip()))

            # 6) 日志中存在的已知恶意文件哈希（如果可用）
            for h in MALICIOUS_HASHES:
                if h in line:
                    suspicious["malicious_hash"].append((line_no, ip, uri, h))

    return {
        "ip_counts": ip_counts,
        "uri_counts": uri_counts,
        "ua_counts": ua_counts,
        "suspicious": suspicious
    }

def pretty_report(r, top=10):
    print("\n=== EBS 狩猎报告 ===\n")
    print("Top 源 IP：")
    for ip, c in r["ip_counts"].most_common(top):
        print(f"  {ip}: {c}")
    print("\nTop URI：")
    for uri, c in r["uri_counts"].most_common(top):
        print(f"  {uri}: {c}")
    print("\nTop 用户代理：")
    for ua, c in r["ua_counts"].most_common(top):
        print(f"  {ua}: {c}")

    print("\n可疑发现：")
    if not r["suspicious"]:
        print("  未发现。")
        return

    for k, items in r["suspicious"].items():
        print(f"\n-- {k} ({len(items)} 个匹配) --")
        for item in items[:100]:
            print("  " + " | ".join(map(str, item)))

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print("用法：python3 ebs_safe_hunt.py /path/to/access.log")
        sys.exit(1)
    path = sys.argv[1]
    result = analyze_log(path)
    pretty_report(result)