CVEs-PoC/2017/CVE-2017-3248.md

### [CVE-2017-3248](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3248)
![](https://img.shields.io/static/v1?label=Product&message=WebLogic%20Server&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=10.3.6.0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=12.1.3.0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=12.2.1.0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=12.2.1.1%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CVSS%3A3.0%2FAV%3AN%2FAC%3AL%2FPR%3AN%2FUI%3AN%2FS%3AU%2FC%3AH%2FI%3AH%2FA%3AH&color=brightgreen)

### Description

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0 and 12.2.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS v3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).

### POC

#### Reference
- http://packetstormsecurity.com/files/152357/Oracle-Weblogic-Server-Deserialization-RMI-UnicastRef-Remote-Code-Execution.html
- http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html
- https://www.exploit-db.com/exploits/44998/
- https://www.tenable.com/security/research/tra-2017-07
- https://www.vicarius.io/vsociety/posts/cve-2017-3248-detect-centos-weblogic-rce
- https://www.vicarius.io/vsociety/posts/cve-2017-3248-mitigate-centos-weblogic-rce

#### Github
- https://github.com/0xn0ne/weblogicScanner
- https://github.com/20142995/pocsuite3
- https://github.com/20142995/sectool
- https://github.com/ARPSyndicate/cvemon
- https://github.com/AdeliaNitzsche/Java-Deserialization-Cheat-Sheet
- https://github.com/BabyTeam1024/CVE-2017-3248
- https://github.com/BrittanyKuhn/javascript-tutorial
- https://github.com/Bywalks/WeblogicScan
- https://github.com/CVEDB/PoC-List
- https://github.com/CVEDB/awesome-cve-repo
- https://github.com/CVEDB/top
- https://github.com/GhostTroops/TOP
- https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet
- https://github.com/Hatcat123/my_stars
- https://github.com/JERRY123S/all-poc
- https://github.com/JasonLOU/WeblogicScan-master
- https://github.com/KimJun1010/WeblogicTool
- https://github.com/MacAsure/WL_Scan_GO
- https://github.com/PalindromeLabs/Java-Deserialization-CVEs
- https://github.com/ParrotSec-CN/ParrotSecCN_Community_QQbot
- https://github.com/QChiLan/weblogic
- https://github.com/QChiLan/weblogicscanner
- https://github.com/S3cur3Th1sSh1t/My-starred-Repositories
- https://github.com/SexyBeast233/SecBooks
- https://github.com/ShyTangerine/WL_Scan_GO
- https://github.com/Weik1/Artillery
- https://github.com/ZTK-009/RedTeamer
- https://github.com/aiici/weblogicAllinone
- https://github.com/angeloqmartin/Vulnerability-Assessment
- https://github.com/awake1t/Awesome-hacking-tools
- https://github.com/awsassets/weblogic_exploit
- https://github.com/cross2to/betaseclab_tools
- https://github.com/cyberanand1337x/bug-bounty-2022
- https://github.com/djytmdj/Tool_Summary
- https://github.com/dr0op/WeblogicScan
- https://github.com/fengjixuchui/RedTeamer
- https://github.com/followboy1999/weblogic-deserialization
- https://github.com/forhub2021/weblogicScanner
- https://github.com/hanc00l/some_pocsuite
- https://github.com/hanc00l/weblogic_unserialize_exploit
- https://github.com/hktalent/TOP
- https://github.com/hmoytx/weblogicscan
- https://github.com/huan-cdm/secure_tools_link
- https://github.com/ianxtianxt/CVE-2017-3248
- https://github.com/iceberg-N/WL_Scan_GO
- https://github.com/jbmihoub/all-poc
- https://github.com/klausware/Java-Deserialization-Cheat-Sheet
- https://github.com/koutto/jok3r-pocs
- https://github.com/langu-xyz/JavaVulnMap
- https://github.com/lanmaovp-dev/shexiangshi-cm-YVJsF2HuAHndPiLB
- https://github.com/lnick2023/nicenice
- https://github.com/mishmashclone/GrrrDog-Java-Deserialization-Cheat-Sheet
- https://github.com/n0-traces/cve_monitor
- https://github.com/nihaohello/N-MiddlewareScan
- https://github.com/oneplus-x/jok3r
- https://github.com/onewinner/VulToolsKit
- https://github.com/password520/RedTeamer
- https://github.com/qazbnm456/awesome-cve-poc
- https://github.com/qi4L/WeblogicScan-go
- https://github.com/qi4L/WeblogicScan.go
- https://github.com/quentinhardy/scriptsAndExploits
- https://github.com/rabbitmask/WeblogicScan
- https://github.com/rabbitmask/WeblogicScanLot
- https://github.com/rabbitmask/WeblogicScanServer
- https://github.com/rockmelodies/rocComExpRce
- https://github.com/rudinyu/KB
- https://github.com/safe6Sec/WeblogicVuln
- https://github.com/sp4zcmd/WeblogicExploit-GUI
- https://github.com/superfish9/pt
- https://github.com/syadg123/WeblogicScan
- https://github.com/tdy218/ysoserial-cve-2018-2628
- https://github.com/theguly/stars
- https://github.com/trganda/starrlist
- https://github.com/weeka10/-hktalent-TOP
- https://github.com/whoadmin/pocs
- https://github.com/wr0x00/Lizard
- https://github.com/wr0x00/Lsploit
- https://github.com/wukong-bin/weblogiscan
- https://github.com/xbl3/awesome-cve-poc_qazbnm456
- https://github.com/zema1/oracle-vuln-crawler
- https://github.com/zzwlpx/weblogic