Oracle WebLogic Server could allow a remote malicious user to execute arbitrary code on the system, caused by improper deserialization. By sending a specially-crafted HTTP request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
| Vendor | Product | Versions |
|---|---|---|
| Oracle | Weblogic Server | 10.3.6.0.0, 12.1.3.0.0 |
CVE-2019-2725 CVE-2019-2725(CNVD-C-2019-48814、WebLogic wls9-async) 命令回显 1036 1213 ResultBaseExecjava 用于测试defineClass，将把恶意类从base64还原出来，执行代码，主要是比较方便（可用可不用）。 JDK7u21java 会生成weblogic-2019-2725_1213命令执行txt中的xml，请使用jdk6编译。 CVE-2019-2725py 检测命令是否会
CVE-2019-2725-pocsuite CVE-2019-2725 The exploit script Reference pocsuite
cve-2019-2725 References: Tenable - wwwtenablecom/blog/oracle-weblogic-affected-by-unauthenticated-remote-code-execution-vulnerability-cve-2019-2725 Exploit Database - wwwexploit-dbcom/exploits/46780 PaloAlto - unit42paloaltonetworkscom/muhstik-botnet-exploits-the-latest-weblogic-vulnerability-for-cryptomining-and-ddos-attacks/ SISSDEN - si
CVE-2019-2725 weblogic命令回显+webshell上传 免责声明:本工具仅供安全测试学习用途,禁止非法使用 weblogic命令回显+webshell上传 脚本简介： 本脚本是基于weblogic 1036和1213版本进行测试，并用python3编写。 1036使用的jdk7u21的payload 1213使用的orgslf4jextEventData类二次反序列化 py依赖的第三方库 req
CVE-2019-2725 from secquanorg first launch
CVE-2019-2725
CVE-2019-2725 bypass tips coded in python3,payloadhere that payload only work in jdk6 exp usage: usage:exppy 127001:8080 whoami poc after edit the iptxt,programe will check the ip in iptxt,testing if the vulnerability exist or not :
POC-EXP 本脚本针对CVE-2019-2725weblogic 反序列化RCE漏洞，使用前请修改VPS监听地址，并在运行时提交特定的URL即可完成测试 测试地址为：192168209134:49163/_async/AsyncResponseService 修改payload参数中的监听地址和端口后： #python CVE-2019-2725py 运行后输入ip:端口号/_async/AsyncResponseService
cve-2019-2725 References: Tenable - wwwtenablecom/blog/oracle-weblogic-affected-by-unauthenticated-remote-code-execution-vulnerability-cve-2019-2725 Exploit Database - wwwexploit-dbcom/exploits/46780 PaloAlto - unit42paloaltonetworkscom/muhstik-botnet-exploits-the-latest-weblogic-vulnerability-for-cryptomining-and-ddos-attacks/ SISSDEN - si
CVE-2019-2725 WebLogic Insecure Deserialization - CVE-2019-2725 payload builder & exploit
python3运行 1检测目标放在iptxt文件下，格式:192168118:7001 2直接运行脚本，存在漏洞的结果保存在oktxt文件中
CVE-2019-2725 weblogic命令回显+webshell上传 免责声明:本工具仅供安全测试学习用途,禁止非法使用 weblogic命令回显+webshell上传 脚本简介： 本脚本是基于weblogic 1036和1213版本进行测试，并用python3编写。 1036使用的jdk7u21的payload 1213使用的orgslf4jextEventData类二次反序列化 py依赖的第三方库 req
CNTA-2019-0014-CVE-2019-2725 免责声明:本工具仅供安全测试学习用途,禁止非法使用 Usage:python3 weblogic_rcepy [url] [command] [is echo?] [win or linux] 具体分析请转：icematchawin/?p=1174
CNVD-C-2019-48814、CVE-2019-2725 Weblogic _async remote command execution exp The main code is based on js implementation Linux Payload uses Jason, Windows Payload is modified 10271, javalangRuntime is executed Environmental needs All versions of Windows Usage cve2019-2725_weblogic_rcebat 192168315:7001 "cat /etc/passwd" Vulnerability informat
SECTOOLS 1个人安全工具开发学习，语言不限 2主要为图形化工具 -QAQ- 1weblogic cve-2019-2725漏洞检测 2s2_045测试 3zoomeye查询,不消耗api ## 4一键子域名查询，subdomain 5源代码泄漏批量检测
weblogic CVE-2019-2725 CVE-2019-2729 POC 执行命令并回显 usage: 单个目标 python3 weblogic_get_webshellpy url 批量目标，将批量url放入url_listtxt python3 weblogic_get_webshellpy all
CNVD-C-2019-48814 WebLogic wls9-async反序列化远程命令执行漏洞 回显poc for weblogic Patch update: wwworaclecom/technetwork/security-advisory/alert-cve-2019-2725-5466295html 漏洞复现： 101020166:7001/_async/AsyncResponseService curl -i 101020166:7001/_async/faviconico CNVD-C-2019-48814 Video python CNVD-C-2019-48814py -u
sectoolset -- Github安全相关工具集合 主要内容： 0x00 漏洞利用实战练习&CTF安全竞赛 0x01 安全扫描器 0x02 安全防守 0x03 渗透测试 0x04 漏洞库及利用工具（POC，EXP) 0x05 二进制及代码分析工具 0x06 威胁情报&蜜罐 0x07 安全文档资料 0x11 所有内容 乌云镜像 乌云镜像 乌云镜像,河*蟹 近期
weblogic_test A utility to test Oracle WebLogic issues including CVE-2017-10217, CVE-2019-2725, and CVE-2019-2725 (bypass) Todo: Add CVE-2018-2628 usage: wlg_testpy 127001:7001
CNVD-C-2019-48814 work on linux and windows(CVE-2019-2725) WebLogic wls9-async反序列化远程命令执行漏漏洞 说明 It's does't work when weblogic patched for cve-2017-10271 10360 12130 基于jas502n的脚本修改而成 使用 python async_command_favicon_allpy 127001:7001 漏洞复现 1 Windows Server 2012 servers/AdminServer/tmp/_
CNVD-C-2019-48814和CNNVD-201904-961 感谢t00ls-ximcx0101提供脚本 CNVD-C-2019-48814 POC Summary 相关链接如下: 清水川崎大佬的简书: wwwjianshucom/p/c4982a845f55 安全祖师爷转发: dwzcn/2GQvbUae 由于环境的一些因素路径会存在变化: 默认上传路径为: servers/AdminServer/tmp/_WL_internal/bea_wls9_async_response/8tpkys/war
CNVD-C-2019-48814和CNNVD-201904-961 感谢t00ls-ximcx0101提供脚本 CNVD-C-2019-48814 POC Summary 相关链接如下: 清水川崎大佬的简书: wwwjianshucom/p/c4982a845f55 安全祖师爷转发: dwzcn/2GQvbUae 由于环境的一些因素路径会存在变化: 默认上传路径为: servers/AdminServer/tmp/_WL_internal/bea_wls9_async_response/8tpkys/war
some_pocsuite 本项目是用于企业内部进行漏洞排查与验证的的pocsuite验证POC代码（Pocsuite是知道创宇安全团队的开源漏洞测试框架）；参考了网上的开源代码并进行了修改。 插件代码编写 使用Pocsuite 漏洞测试框架，插件编写请参考 Pocsuite 项目插件编写要求；陆续扩充中 PoC 编写规范及要求
Awesome Web Security Curated list of Web Security materials and resources Needless to say, most websites suffer from various types of bugs which may eventually lead to vulnerabilities Why would this happen so often? There can be many factors involved including misconfiguration, shortage of engineers' security skills, etc To combat this, here is a curated list of We
weblogic_httppy--CVE-2014-4210,CVE-2017-3506,CVE-2017-10271,CVE-2019-2725 weblogic_t3py--CVE-2016-0638,CVE-2016-3510,CVE-2017-3248,CVE-2018-2628,CVE-2018-2893
软件作者：Tide_RabbitMask 免责声明：Pia!(ｏ ‵-′)ノ”(ノ﹏<。) 本工具仅用于安全测试，请勿用于非法使用，要乖哦~ V22简介： 提供weblogic批量检测功能，收录几乎全部weblogic历史漏洞。 【没有遇到过weblogic批量检测工具的小朋友举起你的爪爪！】 PS： 综上:V2*系列不是V1*
软件作者：Tide_RabbitMask 免责声明：Pia!(ｏ ‵-′)ノ”(ノ﹏<。) 本工具仅用于安全测试，请勿用于非法使用，要乖哦~ V22简介： 提供weblogic批量检测功能，收录几乎全部weblogic历史漏洞。 【没有遇到过weblogic批量检测工具的小朋友举起你的爪爪！】 PS： 综上:V2*系列不是V1*
WeblogicScan Weblogic一键漏洞检测工具，V13 软件作者：Tide_RabbitMask 免责声明：Pia!(ｏ ‵-′)ノ”(ノ﹏<。) 本工具仅用于安全测试，请勿用于非法使用，要乖哦~ V 13功能介绍： 提供一键poc检测，收录几乎全部weblogic历史漏洞。 详情如下： #控制台路径泄露 Console #SSR
WeblogicScan Weblogic一键漏洞检测工具，V13 软件作者：Tide_RabbitMask 免责声明：Pia!(ｏ ‵-′)ノ”(ノ﹏<。) 本工具仅用于安全测试，请勿用于非法使用，要乖哦~ V 13功能介绍： 提供一键poc检测，收录几乎全部weblogic历史漏洞。 详情如下： #控制台路径泄露 Console #SSR
WeblogicScan Weblogic一键漏洞检测工具，V13 软件作者：Tide_RabbitMask 免责声明：Pia!(ｏ ‵-′)ノ”(ノ﹏<。) 本工具仅用于安全测试，请勿用于非法使用，要乖哦~ V 13功能介绍： 提供一键poc检测，收录几乎全部weblogic历史漏洞。 详情如下： #控制台路径泄露 Console #SSR
WeblogicScan 增强版WeblogicScan 从rabbitmask大佬的WeblogicScan V12 版本修改而来。 修改前源项目地址：githubcom/rabbitmask/WeblogicScan DEFF 支持Python3 修复漏洞检测误报，漏洞检测结果更精确 添加CVE-2019-2729, CVE-2019-2618漏洞检测 插件化漏洞扫描组件 添加彩色打印 INSTALL pip3 install -r requirementstxt
Awesome Stars A curated list of my GitHub stars! Generated by starred Contents ASP Arduino Assembly AutoHotkey AutoIt Batchfile C C# C++ CSS CoffeeScript Dockerfile Emacs Lisp Erlang Game Maker Language Go HTML Haskell Java JavaScript Jupyter Notebook KiCad Kotlin Logos Lua M Makefile Markdown Mask Max Nginx Objective-C Objective-C++ Others PHP PLpgSQL Pascal Perl PostScri
项目简介 信息收集、攻击尝试获得权限、持久性控制、权限提升、网络信息收集、横向移动、数据分析（在这个基础上再做持久化控制）、擦痕迹。 address | introduce | -|-|- 名字 | 介绍 | 安全相关资源列表 arxivorg 康奈尔大学（Cornell University）开放文档 githubcom/sindresorhus/awesome
Java-Deserialization-Cheat-Sheet A cheat sheet for pentesters and researchers about deserialization vulnerabilities in various Java (JVM) serialization libraries Please, use #javadeser hash tag for tweets Table of content Java Native Serialization (binary) Overview Main talks & presentations & docs Payload generators Exploits Detect Vulnerable apps (without
项目简介 信息收集、攻击尝试获得权限、持久性控制、权限提升、网络信息收集、横向移动、数据分析（在这个基础上再做持久化控制）、擦痕迹。 安全相关资源列表 arxivorg 康奈尔大学（Cornell University）开放文档 githubcom/sindresorhus/awesome awesome系列 wwwowasporgcn/owasp-pr
The Panda threat group, best known for launching the widespread and successful 2018 “MassMiner” cryptomining malware campaign, has continued to use malware to mine cryptocurrency in more recent attacks. A fresh analysis of the group reveals Panda has adopted a newly-updated infrastructure, payloads and targeting.
While considered unsophisticated, researchers warn that the threat group has a wide reach and has attacked organizations in banking, healthcare, transportation and IT services...
Emergency security fix emitted for remote code exec hole exploited in the wild
Oracle has issued an emergency critical update to address a remote code execution vulnerability in its WebLogic Server component for Fusion Middleware – a flaw miscreants are exploiting in the wild to hijack systems.
The programming blunder, designated CVE-2019-2729, is present in WebLogic Server versions 10.3.6.0.0, 12.1.3.0.0, and 12.2.1.3.0. The vulnerability itself is caused by a deserialization bug in the XMLDecoder for WebLogic Server Web Services.
When exploited, a remote at...
Oracle said that a critical remote code execution flaw in its WebLogic Server is being actively exploited in the wild.
The remote code execution flaw (CVE-2019-2729) impacts a number of versions of Oracle’s WebLogic Server, used for building and deploying enterprise applications. The vulnerability has a CVSS score of 9.8 out of 10. Part of its seriousness is because it is remotely exploitable without authentication.
“Due to the severity of this vulnerability, Oracle strongly reco...
Oracle on Tuesday announced a patch for a remote code execution vulnerability affecting specific versions of the WebLogic Server. The bug bypasses a previously fixed flaw and researchers say it is actively used in attacks.
The issue is now tracked CVE-2019-2729 and it is deserialization via XMLDecoder in Oracle WebLogic Server Web Services. This is the same as CVE-2019-2725, patched in April, leveraged in past attacks to deliver Sodinokibi ransomware and cryptocurrency miners. It is also ...
The GandCrab ransomware group is shutting down, according to posts on the Dark Web.
Researchers David Montenegro and Damian spotted the announcements over the weekend.
Noting that “all good things come to an end,” GandCrab’s operators in a posting on the exploit[.]in underground market claim the malware has raked in nearly $2 billion since the ransomware launched in January of last year. That encompasses ransomware-as-a-service (RaaS) earnings as well as $150 million for...
Malicious activity exploiting the recently disclosed Oracle WebLogic critical deserialization vulnerability (CVE-2019-2725) is surging. Even though there’s a patch, tens of thousands of vulnerable machines represent an irresistible target for hackers, according to Unit 42 researchers at Palo Alto Networks – especially since the bug is “trivial” to exploit.
Oracle WebLogic Server is a popular application server used in building and deploying enterprise Java EE applications. Oracle r...
UPDATE
A variant of the Muhstik botnet has been uncovered in the wild, exploiting a recently-disclosed, dangerous vulnerability in Oracle WebLogic servers.
The newfound samples of Muhstik are targeting the recently-patched CVE-2019-2725 in WebLogic servers, and then launching distributed-denial-of-service (DDoS) and cryptojacking attacks with the aim of making money for the attacker behind the botnet, researchers said.
“From the timeline, we can see that the developer of Muhs...
Big Red rushes out software patch as ransomware scumbags move in
IT admins overseeing Oracle's WebLogic Server installations need to get patching immediately: miscreants are exploiting what was a zero-day vulnerability in the software to pump ransomware into networks.
The Cisco Talos security team said one its customers discovered it had been infected via the bug on April 25, though the exploit is believed to have been kicking around the web since April 17. The programming blunder at the heart of the matter is a deserialization vulnerability that can be...
A recently-disclosed critical vulnerability in Oracle WebLogic is being actively exploited in a slew of attacks, which are distributing a never-before-seen ransomware variant.
The recently-patched flaw exists in Oracle’s WebLogic server, used for building and deploying enterprise applications. The deserialization vulnerability (CVE-2019-2725) is being exploited to spread what researchers with Cisco Talos in a Tuesday analysis dubbed the “Sodinokibi” ransomware.
“This is th...
Attackers are exploiting a recently disclosed WebLogic vulnerability to install a new ransomware called Sodinokibi. As this vulnerability is trivial to exploit, it is important that server admins install the patch immediately in order to prevent infections or unauthorized access.
Earlier this month, a deserialization vulnerability (CVE-2019-2725) was discovered in Oracle WebLogic Server that allows attackers to gain full access to the server in order to install malware or use it as a l...
Vulmon