-
大小: 7KB文件類型: .zip金幣: 2下載: 0 次發布日期: 2021-06-10
- 語言: Java
- 標簽: Weblogic??WLS??CVE-2017-102??
資源簡介
Weblogic wls-wsat組件反序列化漏洞(CVE-2017-10271)利用腳本。
命令執行并回顯
直接上傳shell
在linux下weblogic 10.3.6.0測試OK
使用方法及參數
python weblogic_wls_wsat_exp.py -t 172.16.80.131:7001
usage: weblogic_wls_wsat_exp.py [-h] -t TARGET [-c CMD] [-o OUTPUT] [-s SHELL]
optional arguments:
-h, --help show this help message and exit
-t TARGET, --target TARGET
weblogic ip and port(eg -> 172.16.80.131:7001)
-c CMD, --cmd CMD command to execute,default is "id"
-o OUTPUT, --output OUTPUT
output file name,default is output.txt
-s SHELL, --shell SHELL
local jsp file name to upload,and set -o xxx.jsp

代碼片段和文件信息
#!/usr/bin/env?python
#coding:utf-8
import?re
import?time
import?socket
import?requests
import?sys
headers?=?{‘User-Agent‘:‘Mozilla/4.0?(compatible;?MSIE?8.0;?Windows?NT?5.1;?Trident/4.0)‘}
timeout?=?5
‘‘‘
check?weblogic?by?404
‘‘‘
def?check_weblogic(hostport):
????url?=?‘http://{}:{}/conso1e‘.format(hostport)
????try:
????????r?=?requests.get(urlheaders?=?headers?timeout?=timeout)
????????#guess?by?headers:
????????result1msg1?=?check_weblogic_by_header(r.headers)
????????#check?by?t3:
????????if?r.status_code?==?404?and?‘From?RFC?2068‘?in?r.text:
????????????result2msg2?=?check_weblogic_by_t3(hostport)
????????#set?the?result?and?version:
????????if?result2:
????????????result?=?result2
????????????msg?=?msg2
????????else:
????????????result?=?result1
????????????msg?=?msg1?if?result1?else?msg2
????????return?resultmsg
????except?requests.exceptions.Connectionerror:
????????return?(False‘Connectionerror‘)
????except?:
????????#raise
????????return?(False‘request?weblogic?fail‘)
‘‘‘
get?weblogic?version?by?t3
modifide?by?weblogic-t3-info.nse?of?nmap?script
‘‘‘
def?check_weblogic_by_t3(hostport):
????sock?=?socket.socket(socket.AF_INET?socket.SOCK_STREAM)
????sock.settimeout(timeout)
????try:
????????sock.connect((host?port))
????????#?Send?headers
????????headers?=?‘t3?11.1.2\nAS:2048\nHL:19\n\n‘
????????#?print?‘sending?Hello‘
????????sock.sendall(headers)
????????data?=?‘‘
????????#receive?data?and?check?version:
????????try:
????????????while?True:
????????????????data?+=?sock.recv(1024).strip()
????????????????#print?data
????????????????if?not?data.startswith(‘HELO‘):
????????????????????return?(False?‘check?version?fail‘)
????????????????m?=?re.findall(r‘HELO:(\d+\.\d+\.\d+\.\d+)\.‘data)
????????????????if?m:
????????????????????return?(Truem[0])
????????????????time.sleep(0.1)
????????except?socket.timeout:
????????????return?(False‘weblogic?unknown?version‘)?
????except?Exception?e:
????????#raise
????????return?(False?‘check?version?fail‘)
????finally:
????????sock.close()
def?check_weblogic_by_header(headers):
????statusmsg?=?False‘may?be?not?weblogic‘
????if?‘X-Powered-By‘?in?headers:
????????m?=?re.findall(r‘Servlet/(.+)\s+JSP/(.+)‘headers[‘X-Powered-By‘])
????????if?m?:
????????????ServletJSP?=?m[0]
????????????if?Servlet?==?‘2.4‘?and?JSP?==?‘2.0‘:
????????????????status?=?True
????????????????msg?=?‘weblogic?9.x‘
????????????elif?Servlet?==?‘2.5‘?and?JSP?==?‘2.1‘:
????????????????status?=?True
????????????????msg?=?‘weblogic?10.x‘
????????????elif?Servlet?==?‘3.0‘?and?JSP?==?‘2.2‘:
????????????????status?=?True
????????????????msg?=?‘weblogicc?12.x‘
????return?statusmsg
def?main():
????if?len(sys.argv)?!=?3:
????????print?‘usage:{}??‘.format(sys.argv[0])
????????exit()
???
????resultmsg?=?check_weblogic(sys.argv[1]int(sys.argv[2]))
????print?‘{}‘.format(msg)
????????
if?__name__?==?‘__main__‘:
????main()
?屬性????????????大小?????日期????時間???名稱
-----------?---------??----------?-----??----
?????文件?????????886??2018-01-11?11:47??weblogic_wls_wsat_rce-master\README.md
?????文件????????1145??2018-01-11?11:47??weblogic_wls_wsat_rce-master\exec.jsp
?????文件????????2912??2018-01-11?11:47??weblogic_wls_wsat_rce-master\weblogic_check_version.py
?????文件????????6626??2018-01-11?11:47??weblogic_wls_wsat_rce-master\weblogic_wls_wsat_exp.py
?????文件????????4531??2018-01-11?11:47??weblogic_wls_wsat_rce-master\weblogic_wls_wsat_exp_win.py
?????目錄???????????0??2018-09-12?17:56??weblogic_wls_wsat_rce-master\
- 上一篇:練習--java實現的打字游戲
- 下一篇:Javaweb全套流行框架整理視頻
評論
共有 條評論