Sploitus

Exploit for Missing Authentication for Critical Function in Oracle Weblogic Server

gitee Β· 2020-10-05

Exploit Code

MARKDOWN10 lines
## https://sploitus.com/exploit?id=DB0E2647-A141-557F-982B-4CA2BC1439C8
PoC exploit for CVE-2017-10271, an unauthenticated Weblogic RCE. 

The target product/service is Weblogic, and the vulnerability class/vector is RCE (Remote Code Execution). The probable entry point is the CoordinatorPortType SOAP endpoint. Notable dependencies/tooling include the `requests` library and the `java.beans.XMLDecoder` class. The execution context is a SOAP request with a specially crafted payload. The run method is not specified in the provided code. 

The expected impact of this exploit is Remote Code Execution. Observable network artifacts/IO include the SOAP request and the response from the vulnerable Weblogic server. 

The exploit is implemented in the `exploit.py` and `payloads.py` files, which generate a SOAP request with a specially crafted payload. The `scanner.sh` and `weblogic.py` files are used to scan for vulnerable Weblogic servers and execute the exploit. 

Preconditions for the exploit include the presence of the vulnerable Weblogic server and the ability to send a SOAP request to the CoordinatorPortType endpoint.