Dungsocool/CVE-2017-10271

GitHubRepository PoCWriteup

PoC files

10 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A detailed technical writeup analyzing CVE-2017-10271, a WebLogic XMLDecoder deserialization vulnerability. It describes system analysis, vulnerability mechanism, manual payload construction, and post-exploitation steps, but contains no executable exploit or scanner code.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence is a single README.md file containing a detailed educational writeup for exploiting CVE-2017-10271. It describes vulnerability analysis, manual payload construction, and post-exploitation steps. No concealed executable behavior, deceptive payloads, or operator-directed harm targeting the reader is present. The content is a standard proof-of-concept documentation.

ClassificationWriteup
Model confidence100%
AuthenticationNot required
Languagesmarkdown
Target softwareOracle WebLogic Server
Attack typesdeserializationremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a Markdown document providing a step-by-step technical analysis, explanation of the vulnerability, and manual exploitation methodology. It contains no executable code, scripts, or automated scanning logic. The analysis_routing classification is NO_POC_CODE_IDENTIFIED, and the content is purely descriptive.

README.md:1-291

Requirements

  • Target running Oracle WebLogic Server 10.3.6.0 with wls-wsat component enabledREADME.md:9-13
  • Network access to the WebLogic server on port 7001README.md:10

Observed behavior

  • Describes sending a crafted SOAP XML payload to /wls-wsat/CoordinatorPortType to achieve remote code execution via XMLDecoder deserializationREADME.md:159-191
  • Describes bypassing blind RCE by writing command output to a web-accessible directory and retrieving it via HTTPREADME.md:116-133
  • Describes post-exploitation activities including reading /etc/shadow and verifying root privilegesREADME.md:207-256
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Target Endpoint
http://192.168.3.137:7001/wls-wsat/CoordinatorPortTypeThe documented exploit target endpoint for CVE-2017-10271.README.md:53
Exploit Payload
XMLDecoder deserialization payload using java.lang.ProcessBuilderThe core exploit mechanism described in the writeup.README.md:159-183
Post Exploitation Action
Reading /etc/shadow via command execution and writing to web rootDemonstrates post-exploitation data exfiltration technique.README.md:218-243
Review boundaries

What the analysis did not establish

  • Only the README.md text file was included; 9 non-text media files (images) were omitted, which may contain additional visual evidence not analyzed.
  • The artifact is a writeup describing exploitation steps; no executable code is present to confirm the described behavior.
  • Only the README.md file was provided as text evidence; 9 non-text media files (images) were omitted from analysis. The repository may contain other files not included in this packet.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1