log4j2-rce

Обход FilteredObjectInputStream в Log4j RCE без аутентификации на любом Java-сервисе, который десериализует LogEvent через FilteredObjectInputStream от Log4j. Учётные данные не требуются. Сообщено как GitHub issue 4255 24 августа 2026 года. Что делает Log4j поставляет FilteredObjectInputStream FO...

log4j-4255

log4j2 4255 — обход белого списка FilteredObjectInputStream через java.rmi.MarshalledObject Автономная лаборатория в контейнерах, воспроизводящая проблему Apache log4j24255 целиком на официальных артефактах Log4j 2.26.1 на JDK 17 , с положительными контролями, защищённым оракулом и проверенной...

Oracle Weblogic Server Deserialization MarshalledObject Remote Code Execution Exploit

An unauthenticated attacker with network access to the Oracle Weblogic Server T3 interface can send a serialized object weblogic.corba.utils.MarshalledObject to the interface to execute code on vulnerable hosts. This module requires Metasploit: https://metasploit.com/download Current source:...

Oracle Weblogic Server Deserialization RCE - MarshalledObject

An unauthenticated attacker with network access to the Oracle Weblogic Server T3 interface can send a serialized object weblogic.corba.utils.MarshalledObject to the interface to execute code on vulnerable hosts. Module Options msf use exploit/multi/misc/weblogic/deserializemarshalledobject msf...

Java RMIConnectionImpl Deserialization Privilege Escalation Exploit

No description provided by source. $Id: javarmiconnectionimpl.rb 10490 2010-09-27 00:09:17Z egypt $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and...

Java - RMIConnectionImpl Deserialization Privilege Escalation (Metasploit)

$Id: javarmiconnectionimpl.rb 10490 2010-09-27 00:09:17Z egypt $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Java RMIConnectionImpl Deserialization Privilege Escalation Exploit

$Id: javarmiconnectionimpl.rb 10257 2010-09-08 15:23:04Z egypt $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Java RMIConnectionImpl Deserialization Privilege Escalation

This module exploits a vulnerability in the Java Runtime Environment that allows to deserialize a MarshalledObject containing a custom classloader under a privileged context. The vulnerability affects version 6 prior to update 19 and version 5 prior to update 23. Module Options msf use...