what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Showing 1 - 1 of 1

Files from Quynh Le

WebLogic Server Deserialization Remote Code Execution

Posted Jun 4, 2020

Authored by Shelby Pace, Y4er, Quynh Le | Site metasploit.com

This Metasploit module exploits a Java object deserialization vulnerability in multiple versions of WebLogic. Unauthenticated remote code execution can be achieved by sending a serialized BadAttributeValueExpException object over the T3 protocol to vulnerable versions of WebLogic. Leveraging an ExtractorComparator enables the ability to trigger method.invoke(), which will execute arbitrary code.

tags | exploit, java, remote, arbitrary, code execution, protocol

advisories | CVE-2020-2883

SHA-256 | d85d76c6388cafa88aef4ce4d17b77d3a4f2d6383ddcb075ea187fa645df106e

Download | Favorite | View