WLT3Serial

WLT3Serial Native Java-based deserialization exploit for WebLogic T3 and T3S listeners as outlined HERE. Requires third-party dependencies ysoserial and wlthint3client. Advantages/Disadvantages compared to JavaUnserializeExploits weblogic.py and loubia Advantages: Handles T3/T3S communication...

Oracle Weblogic Server Deserialization RCE - MarshalledObject

An unauthenticated attacker with network access to the Oracle Weblogic Server T3 interface can send a serialized object weblogic.corba.utils.MarshalledObject to the interface to execute code on vulnerable hosts. Module Options msf use exploit/multi/misc/weblogic/deserializemarshalledobject msf...

CVE-2003-1221: Undefined Security Weakness

BEA WebLogic Express and Server 7.0 through 8.1 SP 1, under certain circumstances when a request to use T3 over SSL t3s is made to the insecure T3 port, may use a non-SSL connection for the communication, which could allow attackers to sniff sessions...