luffin/cve-2017-10271CVE-2017-10271 POC
WebLogic wls-wsat component deserialization vulnerability (CVE-2017-10271) detection script
$ python CVE-2017-10271 url
You also need to register an account on ceye.io, and fill in the Identifier and API Token provided by it in the following part of the code:
Detect whether WebLogic under Windows and Linux environments has the remote command execution vulnerability CVE-2017-10271
Currently only tested on Linux environments
Tested valid on both Windows and Linux environments
Using the DNS log feature provided by ceye.io and its API query function, by sending a ping command, make the server ping the domain provided by ceye.io, and use its query interface to check whether the record of this ping is received, to determine whether the command was executed successfully.
The pinged domain here is composed of a random 6-character alphanumeric string (uppercase and lowercase) combined with the domain provided by ceye.io, such as 4xF7hY.xxxxxx.ceye.io. The 4xF7hY part is randomly generated for each request, which not only facilitates subsequent API queries as a unique identifier, but also ensures the uniqueness and accuracy of vulnerability detection.
This code is modified based on the overall architecture of @Lucifer1993's weblogic_xmldecoder_exec.py script, with the windows_payload coming from @1337g's CVE-2017-10271.