Giter VIP home page Giter VIP logo

cve-2017-10271's Introduction

CVE-2017-10271

Weblogic wls-wsat组件反序列化漏洞(CVE-2017-10271)检测脚本

用法

$ python CVE-2017-10271 url

另外需要注册一个ceye.io的账号，将其提供的Identifier及API Token填入代码的如下部分：

mmp

功能

检测Windows及Linux环境下Weblogic是否存在CVE-2017-10271的远程命令执行漏洞

目前仅在Linux环境下测试过

Windows及Linux环境下均测试有效

检测原理

使用ceye.io提供的DNS log功能以及其接口查询功能，通过发送ping命令，让服务器pingceye.io提供的域名，并使用其查询接口查询是否收到这次ping的记录，来判断命令是否执行成功。

这里ping的域名采用随机6位大小写字母组成的字符串+ceye.io提供的域名组合而成，如4xF7hY.xxxxxx.ceye.io的形式，其中的4xF7hY在每次请求时随机生成，这样既方便在之后接口查询时可作为唯一特征值方便查询，也能确保漏洞检测的唯一性与准确性。

其他

此代码根据@Lucifer1993的weblogic_xmldecoder_exec.py脚本整体架构基础上修改的，其中的windows_payload来自@1337g的CVE-2017-10271

cve-2017-10271's People

Contributors

luffin avatar

Stargazers

avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar

Watchers

avatar avatar avatar avatar

Forkers

cartonsta comahax jooeji bhassani soulmarus mem3nt0 ahaya1985 christofersimbar icysun sebretooth cc06 n1f2c3 0x0kasaku omiter mr18xiaobai

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.