Unauthenticated RCE in Oracle WebLogic Server via T3 (WLS Core Components)

This repository contains a Python exploit for Oracle WebLogic Server targeting CVE-2018-2893, a remote code execution vulnerability. The main file, 'weblogic.py', is a standalone exploit script that connects to a specified WebLogic server over TCP, crafts and sends a serialized Java payload exploiting the T3 protocol, and triggers a reverse shell connection back to the attacker's machine. The attacker must provide the target's host and port, as well as their own host and port for the reverse shell. The README provides usage instructions and references to similar exploits. The exploit is operational, providing a working reverse shell if the target is vulnerable. No detection or scanning functionality is present; the script is designed for direct exploitation. The repository also contains a README and a Draw.io diagram file, but only 'weblogic.py' contains exploit code.

This repository provides an operational exploit for CVE-2018-2893, a critical remote code execution vulnerability in Oracle WebLogic Server. The main exploit script, 'weblogic.py', is a Python script that connects to a specified WebLogic server over the T3 protocol (default port 7001) and sends a crafted serialized Java payload to exploit the vulnerability. The payload is typically a Java serialized object (such as a CommonsCollections gadget) that, when deserialized by the vulnerable server, results in arbitrary code execution—commonly a reverse shell. The script requires three arguments: the target host, port, and the path to the payload file. The README provides usage instructions, references, and notes about the need for an accessible RMI server for reverse shell functionality. The repository also includes a simple 'push.sh' script for git operations. No hardcoded IP addresses or domains are present except for the example T3 endpoint. The exploit is not part of a framework and is a standalone operational exploit targeting unpatched Oracle WebLogic servers.

This repository provides an exploit for CVE-2018-2893, a critical Java deserialization vulnerability in Oracle WebLogic Server. The exploit consists of a Python script (weblogic.py) and instructions in the README.md. The attack requires generating a malicious serialized Java object using ysoserial-cve-2018-2893.jar (not included in the repo), which is then delivered to the target WebLogic server over the T3 protocol (typically port 7001) using the Python script. The script crafts a custom T3 protocol header and sends the payload, potentially resulting in remote code execution on the server. The README provides step-by-step usage, including payload generation and exploit execution. The repository is operational and can be used to exploit vulnerable WebLogic instances, provided the attacker can connect to the target's T3 port and generate the appropriate payload.