⭕ Emulating and Exploiting Oracle WebLogic Server for PCap Analysis (CVE-2023-21839)
ID: 2ca807b7-0c7e-53ff-bc25-6f918925bb4e
STIX ID: report--2ca807b7-0c7e-53ff-bc25-6f918925bb4e
Feed Name: GreyNoise Labs
Threat Score
This report documents a practical test and packet-level analysis of CVE-2023-21839 against Oracle WebLogic Server: it describes target and attacker VM setup, how to run a Go PoC and JNDI-Exploit-Kit to achieve remote command execution (demonstrated by spawning calc), and provides a PCAP showing a distinctive ForeignOpaqueReference request over GIOP that can be used to detect exploitation attempts.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.