exploit-weblogic

name	exploit-weblogic
description	Oracle WebLogic T3/IIOP deserialization RCE exploit (CVE-2023-21839, CVE-2020-14882). Targets Oracle WebLogic Server admin consoles and T3 listener ports.
metadata	{"openclaw":{"emoji":"💥","requires":{"bins":["python3","java"],"env":[]},"primaryEnv":null}}

exploit-weblogic

Exploits Oracle WebLogic Server deserialization vulnerabilities via the T3 and IIOP protocols for unauthenticated remote code execution.

Target Framework

Oracle WebLogic Server 10.x, 12.x, 14.x — CVE-2023-21839 (IIOP/T3 JNDI injection) and CVE-2020-14882 (admin console auth bypass + RCE).

Usage

Provide target (WebLogic base URL or T3 endpoint, e.g. t3://host:7001). The skill fingerprints the version and selects the appropriate exploit chain automatically.

Parameters

Param	Type	Required	Description
target	string	yes	WebLogic URL or T3 endpoint
cve	string	no	Force a specific CVE (e.g. CVE-2023-21839)
cmd	string	no	OS command to execute (default: id)
timeout	int	no	Timeout in seconds (default: 60)

Notes

T3 port is typically 7001 or 7002. Admin console is on port 7001 HTTP/HTTPS. Use nmap to confirm open WebLogic ports before exploitation.