Oracle WebLogic Server T3 Deserialization RCE

This repository contains a single Metasploit module: 'weblogic_deserialize_rawobject.rb', which exploits a Java deserialization vulnerability (CVE-2015-4852) in Oracle WebLogic Server. The exploit targets the T3 protocol interface (default TCP port 7001) and allows unauthenticated remote code execution by sending a crafted serialized Java object. The module supports multiple platforms (Unix, Windows, Solaris) and leverages Metasploit's payload system to deliver various command execution or reverse shell payloads. The exploit is weaponized, as it is part of the Metasploit framework and allows for easy payload customization. The only fingerprintable endpoint is the T3 TCP port (typically 7001) on the target WebLogic server. The code is well-structured, with clear separation of handshake, request building, and payload delivery functions, and is intended for use by penetration testers to demonstrate or leverage this critical vulnerability.

This repository provides a Python-based exploit for CVE-2015-4852, a critical Java deserialization vulnerability affecting several enterprise applications (Websphere, JBoss, OpenNMS, Symantec Endpoint Protection Manager). The main script, 'serialator.py', allows the user to select the target application, specify the target host and port, and supply an arbitrary command to execute on the target. The exploit works by sending a malicious serialized Java object (payload) to the target application over HTTP, exploiting the deserialization flaw to achieve remote code execution. The script supports both exploitation (arbitrary command execution) and detection (by triggering a ping from the target to an attacker-controlled host). The included 'ICMPListener.py' script can be used to listen for incoming ICMP echo requests, which helps verify successful exploitation in detection mode. The repository is structured with a main exploit script, a listener script for detection, and a README providing usage instructions and background. No hardcoded network endpoints are present except for the default listener IP (0.0.0.0) in the ICMP listener. The exploit is operational and can be used for both vulnerability verification and actual exploitation, depending on the supplied command.