Home / Java / Miscellaneous

Apache Dubbo Hessian2 CVE-2021-43297 demo

Apache Dubbo Hessian2异常处理时的反序列化（CVE-2021-43297） 将两个项目分别导入两个idea 先运行org.apache.dubbo.samples.basic.BasicProvider#main启动服务端 再运行org.apache.dubbo.samples.
Information
Category: Java / Miscellaneous
Watchers: 1
Star: 7
Fork: 3
Last update: Jan 18, 2022
Resource links
https://github.com/longofo/Apache-Dubbo-Hessian2-CVE-2021-43297

Apache Dubbo Hessian2异常处理时的反序列化（CVE-2021-43297）

  1. 将两个项目分别导入两个idea

  2. 先运行org.apache.dubbo.samples.basic.BasicProvider#main启动服务端

  3. 再运行org.apache.dubbo.samples.basic.BasicConsumer#main启动客户攻击端

效果：

https://paper.seebug.org/1814/

Contents

    thubbo Dubbo Plugin for Apache JMeter, It is a plug-in developed for testing Dubbo in Jmeter.
    alibaba hessian2-codec is a C++ library from Alibaba for hessian2 codec.
    apache Node.js native Apache Dubbo client on hessian
    apache php for Apache Dubbo
    herwonowr ProxyLogon Full Exploit Chain PoC (CVE-2021–26855, CVE-2021–26857, CVE-2021–26858, CVE-2021–27065)
    apache Apache Dubbo is a high-performance, java based, open source RPC framework.
    apache Apache Dubbo is a high-performance, java based, open source RPC framework.
    Yang0615777 Alibaba-Nacos-Unauthorized/ApacheDruid-RCE_CVE-2021-25646/MS-Exchange-SSRF-CVE-2021-26885/Oracle-WebLogic-CVE-2021-2109_RCE/RG-CNVD-2021-14536/RJ-SSL-VPN-UltraVires/Redis-Unauthorized-RCE/TDOA-V11.7-GetOnlineCookie/VMware-vCenter-GetAnyFile/yongyou-GRP-U8-XXE/Oracle-WebLogic-CVE-2020-14883/Oracle-WebLogic-CVE-2020-14882/Apache-Solr-GetAnyFile/F5-BIG-IP-CVE-2021-22986/Sonicwall-SSL-VPN-RCE/GitLab-Graphql-CNVD-2021-14193
    rabidwh0re vRealize RCE + Privesc (CVE-2021-21975, CVE-2021-21983, CVE-0DAY-?????)
    newrelic-experimental Per CVE-2021-44228 and CVE-2021-45046, Apache log4j2 versions < 2.16.0 (except 2.12.2) are vulnerable to remote code execution and potential data exfiltration.
    apache Apache Dubbo Erlang Implementation.
    0-x-2-2 Abuse Log4J CVE-2021-44228 to patch CVE-2021-44228 in vulnerable Minecraft game sessions to prevent exploitation in the session :)
    giterlizzi Nmap Log4Shell NSE script for discovery Apache Log4j RCE (CVE-2021-44228)
    Ridter Exploiting CVE-2021-42278 and CVE-2021-42287 to impersonate DA from standard domain user
    DXC-StrikeForce Burp Active Scan extension to identify Log4j vulnerabilities CVE-2021-44228 and CVE-2021-45046
    im-hanzou Apache (Linux) CVE-2021-41773/2021-42013 Mass Vulnerability Checker
    apache Mirror of Apache Bahir
    Vulnmachines CVE-2021-41773 Path Traversal vulnerability in Apache 2.4.49.
    MrCl0wnLab Tool check: CVE-2021-41773, CVE-2021-42013, CVE-2020-17519
    cert-lv Detect webshells dropped on Microsoft Exchange servers exploited through "proxylogon" group of vulnerabilites (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065)
    p0wershe11 ProxyLogon(CVE-2021-26855+CVE-2021-27065) Exchange Server RCE(SSRF->GetWebShell)
    Share this repo

    Related Repos


    Miscellaneous
    12
    A public, stripped down workspace of the Project Unity mod, a mega-collaboration Mindustry...
    AvantTeam Project Unity A work-in-progress mega-collaboration Mindustry mod, created by the Avant Team. As the repository description says, this is not a fully
     
    Miscellaneous
    4
    FeatherMC - Pedaret
    PersianDevs FeatherMC FeatherMC Yek Forke NachoSpigot e, Ke Ba Optimize Khoob Baraye Server Haye Mini Game Va PvP Sakhte Shode, Ke Ba Remove Kardan Bug Ha Va Feat
     
    Miscellaneous
    470
    Java library and command-line application for converting Scikit-Learn pipelines to PMML
    jpmml JPMML-SkLearn Java library and command-line application for converting Scikit-Learn pipelines to PMML. Table of Contents Features Overview Supported p
     
    Miscellaneous
    198
    Rails-like inflection library for Clojure and ClojureScript
    r0man Inflections Rails-like inflection library for Clojure and ClojureScript. Usage (use 'inflections.core) (plural "word") ;=> "words" (plural "virus")
     
    Miscellaneous
    733
    Data visualizations in Clojure and ClojureScript using Vega and Vega-lite
    metasoarous Great and powerful scientific documents & data visualizations Overview Oz is a data visualization and scientific document processing library for Cloju
     
    Miscellaneous
    7
    Apache Dubbo Hessian2 CVE-2021-43297 demo
    longofo Apache Dubbo Hessian2异常处理时的反序列化（CVE-2021-43297） 将两个项目分别导入两个idea 先运行org.apache.dubbo.samples.basic.BasicProvider#main启动服务端 再运行org.apache.dubbo.samples.
     
    Miscellaneous
    6
    A public bot for Discord servers 🥶
    zellzik Public sample bot for Discord servers 😎 Bot is written in Java 16, currently there is only verification in the bot, but if someone knows at least the
     
    Miscellaneous
    5
    Hexagon decompiler for Ghidra
    toshipiazza Ghidra hexagon plugin WIP Hexagon decompiler plugin for ghidra Pcode is more or less autogenerated, essentially copying and adapting from binja-hexago
     
    Miscellaneous
    4
    Log4J 2.0 beta9 without JNDI lookup functionality
    IntentStore Log4J-Patched Log4J 2.0 beta9 without JNDI lookup functionality How does the Log4J exploit work? A server sends the user a specially crafted packet wh
     
    Miscellaneous
    3
    A bukkit server plugin make player can use shulker box dupe item
    jiyun233 ShulkerDupe a bukkit server plugin make player can use shulker box dupe item Configuration
     
    Miscellaneous
    3
    Minecraft Open to Internet
    MvRens Minecraft Open to Internet This useful little utility I wrote back in 2012 should still work! It is written in Delphi, XE2 I believe. It seems to use
     
    Miscellaneous
    3
    A 1.18.1 minecraft Utility Client
    Sxmurai saturn-client A 1.18.1 minecraft Utility Client Licensing This project is under the GNU v3.0 licensing. If you use any code from this project you must
     
    Miscellaneous
    3
    Ghidra Plugin for Texas Instrument CC 8051 SOC's especially CC1110 and CC2510
    atc1441 Texas Instruments CCxxxx Ghidra CPU Plugin Ghidra Plugin for Texas Instrument CC 8051 core SOC's especially CC1110 and CC2510 This helps to name the d
     
    Miscellaneous
    4
    A general purpose programming language
    omnit3a Jenny A general purpose programming language I'm making Jenny out of interest, and mainly just because I want to see how far I can get with making my
     
    Miscellaneous
    303
    Hierarchical Temporal Memory implementation in Java - an official Community-Driven Java po...
    numenta htm.java Official Java™ version of... Hierarchical Temporal Memory (HTM) Community-supported & ported from the Numenta Platform for Intelligent Comput