CVE-2018-3245

CVE-2018-3245 第一步 java -jar ysoserial-cve-2018-3245.jar root@kitploit: 用法: java -jar ysoserial-cve-2018-3245.jar payload 'command' 可用的payload类型: Payload 作者 依赖项 ------- ------- ------------ CVE201828931 @mbechler CVE201828932 @mbechler CVE201828933 @mbechler CVE20183245 @mbechler JRMPClient...

Tomcat-CVE_2025_24813

Tomcat CVE-2025-24813 沙盒 漏洞利用源自 https://github.com/absholi7ly/POC-CVE-2025-24813/blob/main/README.md（对我无效） 内容 1. ROOT.war 是一个最小的应用，包含一个 servlet，其中包括 apache-common-3.1 并生成一个会话 2. ysoserial.jar 取自原始 ysoserial 仓库（https://github.com/frohoff/ysoserial） 3. Dockerfile 用于构建一个易受攻击的安装 4. CVE202524813.py...

CVE-2021-26295

CVE-2021-26295-POC 利用DNSlog进行CVE-2021-26295的漏洞验证。 使用 poc: 将目标放于 target.txt 后运行python poc.py即可。（Jdk环境需12，否则ysoserial不能正常生成payload） exp: python exp.py https://baidu.com 然后进入命令执行界面（无回显） 仅供学习交流，请勿用于其他用途。...

CVE-2021-26295--

CVE-2021-26295-- CVE-2021-26295-POC 利用DNSlog进行CVE-2021-26295的漏洞验证。 使用 poc：将目标放于target.txt后运行python poc.py即可。（Jdk环境需12，否则ysoserial无法正常生成有效载荷） exp：python exp.py https://baidu.com然后进入命令执行界面（无回显）...

CVE-2026-25551

Seagull Software BarTender 2021 R1 through 12.0.1 contains an insecure deserialization vulnerability that allows low-privileged local users to escalate privileges. The DataServiceSingleton .NET Remoting endpoint is bound to localhost on TCP port 7375 via BtSystem.Service.exe, limiting the attack...

CVE-2026-25551

Seagull Software BarTender 2021 R1 through 12.0.1 contains an insecure deserialization vulnerability that allows low-privileged local users to escalate privileges. The DataServiceSingleton .NET Remoting endpoint is bound to localhost on TCP port 7375 via BtSystem.Service.exe, limiting the attack...

Exploit for Deserialization of Untrusted Data in Apache Tomcat

Tomcat CVE-2025-24813 playground ===============================...

Exploit for Deserialization of Untrusted Data in Apache Tapestry

CVE-2021-27850 Exploit Overview CVE-2021-27850 is a...

Exploit for Deserialization of Untrusted Data in Apache Tapestry

CVE-2021-27850 Exploit Overview CVE-2021-27850 is a...

Exploit for Deserialization of Untrusted Data in Redhat Data_Grid

This is a collection of Java deserialization exploits, specifically targeting various Java applications. The exploits are designed to bypass Java's deserialization security features and execute arbitrary code on the target system. The exploits are implemented in Python and use the ysoserial libra...

Exploit for CVE-2020-2551

sgysoserial Description clone ysoserial Modifications and enhancements fix | Exploit - Payload | 说明 | | :---------------------------------------- | -------------------------------------------------: | | ysoserial.exploit.IIOPRegistryExploit | Weblogic CVE-2020-2551 利用, 修改 wlfullclient.jar | |...

Exploit for Deserialization of Untrusted Data in Oracle Weblogic_Server

CVE-2018-2628 Weblogic GetShell.py is a Python script that exploits the Oracle Weblogic Server deserialization vulnerability. The script generates a payload using ysoserial and sends it to the target server. The payload is a serialized Java object that, when deserialized, executes arbitrary code...

Oracle WebLogic Server 10.3.6.0 - Java Deserialization Exploit

Exploit for java platform in category remote exploits Exploit Title: Oracle WebLogic Server Java Deserialization Remote Code Execution Date: 27/09/2017 Exploit Author: SlidingWindow , Twitter: @kapilkhot Vulnerability Author: FoxGloveSecurity Vendor Homepage:...