164 matches found
Oracle-WebLogic-CVE-2017-10271
Oracle-WebLogic-CVE-2017-10271 WebLogic wls-wsat RCE CVE-2017-10271 漏洞描述 早期，黑客利用WebLogic WLS 组件漏洞对企业服务器发起大范围远程攻击，有大量企业的服务器被攻陷，且被攻击企业数量呈现明显上升趋势，需要引起高度重视。其中，CVE-2017-3506是一个利用Oracle WebLogic中WLS 组件的远程代码执行漏洞，属于没有公开细节的野外利用漏洞，大量企业尚未及时安装补丁。官方在 2017 年 4 月份就发布了该漏洞的补丁。 CVE-2017-3506补丁说明： root@kitploit:...
CVE-2022-45047
CVE-2022-45047 POC,EXP,chatGPT为我生成 代码 root@kitploit: import requests targeturl = "http://127.0.0.1:7001" CVE-2022-45047 def exploitweblogic: headers = "Content-Type": "text/xml", "User-Agent": "Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:93.0 Gecko/20100101 Firefox/93.0", "Accept-Encoding": "gzip...
CVE-2019-0604
一、解说k8gege的cve-2019-0604-exp.py k8gege的脚本 https://github.com/k8gege/CVE-2019-0604 老实说k8gege的py脚本有点花哨，一大堆的16进制字符串，分成 payload1,2,3, 好坏呀 python脚本远程post的payload,反序列化之后是一个xml数据体 root@kitploit: cmd /c echo ^%@ Page Language="Jscript" %^^%var pwd="tom";var uastr=Request.UserAgent;if uastr.Substring0,...
SSP-Assignment-3-RCEYouLater
CVE-2023-46604: Apache ActiveMQ RCE 概念実証 課題: SSP Assignment 3 チーム: RCE You Later メンバー: Banica Horia Alexandru, Comarlau Vlad-Constantin このリポジトリを使用してPoCを実行する様子のビデオリンク: https://www.youtube.com/watch?v=vum4qTF4ygU 🚨 概要 このリポジトリには、CVE-2023-46604 に対する完全に機能する概念実証 PoC が含まれています。 この脆弱性により、攻撃者は脆弱なApache...
struts-s2-052-deserialization-rce-lab
Apache Struts S2-052 XML 反序列化远程代码执行 本仓库演示了如何利用恶意 XML 反序列化来攻击 Apache Struts S2-052（CVE-2017-9805） 。 该漏洞利用程序是在完成 INE eWPTX 实践靶场 – Struts XML 反序列化 RCE 实验 时开发的。 漏洞概述 Apache Struts REST 插件使用 XStream 对 XML 请求进行反序列化。 当应用程序处理带有以下内容的 XML 时： Content-Type: application/xml 攻击者可以提供一个恶意的序列化对象图，从而通过以下方式触发任意命令的执...
S2-052
CVE-2017-9805 （S2-052）リバースシェル Exploit 影響バージョン root@kitploit: Struts 2.1.2 - Struts 2.3.33, Struts 2.5 - Struts 2.5.12 Poc root@kitploit: Content-Type: application/xml 0 false 0 calc false java.lang.ProcessBuilder start foo foo false 0 0 false false 0 jdk.nashorn...
CVE-2019-2725
CVE-2019-2725 WebLogic通用利用工具 - CVE-2017-3506 / CVE-2017-10271 / CVE-2019-2725 / CVE-2019-2729 载荷构建器与利用 信息/帮助 root@kitploit: $ python3 weblogicexploit.py -h ======================================================================== | WebLogic Universal Exploit | | CVE-2017-3506 / CVE-2017-10271 /...
CVE-2021-42237
CVE-2021-42237 这是针对 CVE-2021-42237 的漏洞利用/PoC，来源于：Assetnote 报告 免责声明：我与 Assetnote 没有任何关联。此内容仅供教育目的使用。 请确保替换下方 PoC 中的 CMD-COMMAND-HERE 以及 Host： root@kitploit: POST /sitecore/shell/ClientBin/Reporting/Report.ashx HTTP/1.1 Host: sitecore.local Accept-Encoding: gzip, deflate Accept: / Accept-Language: ...
CVE-2025-59287
CVE-2025-59287 WSUS CVE-2025-59287 – XML 反序列化 RCE（反向 Shell） 一个针对 WSUS CVE-2025-59287 的聚焦 PoC，通过 XML 反序列化实现 Windows 反向 Shell。此脚本仅支持反向 Shell 载荷（无 calc 回退）。 目标：安装了 WSUS 角色的 Windows Server 技术：SOAP + ObjectDataProvider 反序列化 结果：cmd.exe 启动 PowerShell 反向 Shell 连接到你的监听器 免责声明 仅限在实验室环境中进行授权测试。你有责任遵守所有适用法律。 ...
BIT-JENKINS-2026-84646
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML...
CVE-2026-84646
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML...
CVE-2026-84646
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML...
CVE-2026-84646
Jenkins (versions 2.579 and earlier, LTS 2.568.2 and earlier) is affected by a lack of type restriction in XML deserialization , allowing an attacker with Overall/Read permission to create user objects by submitting crafted XML. The root cause is that user objects can appear as nested field value...
EUVD-2026-70112
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML...
PT-2026-84769
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML...
RHCOS 4 : OpenShift Container Platform 4.6.17 (RHSA-2021:0423)
The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:0423 advisory. - ant: insecure temporary file vulnerability CVE-2020-1945 - ant: insecure temporary file CVE-2020-11979 - jenkins: Arbitrary file...
RHCOS 4 : OpenShift Container Platform 4.5.33 (RHSA-2021:0429)
The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0429 advisory. - ant: insecure temporary file vulnerability CVE-2020-1945 - ant: insecure temporary file CVE-2020-11979 - jenkins: Arbitrary file...
Exploit for Deserialization of Untrusted Data in Apache Struts
Apache Struts S2-052 XML Deserialization RCE This repository...
Bosch Rexroth IndraWorks UA.TestClient XML File Parsing Deserialization Of Untrusted Data Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bosch Rexroth IndraWorks. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsi...
Bosch Rexroth IndraWorks OPC.TestClient XML File Parsing Deserialization Of Untrusted Data Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bosch Rexroth IndraWorks. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsi...