liferay-ga4-rce-research

Liferay CE 7.0.3 GA4 — 취약점 연구 RAPTOR Loop-Hunt Liferay Portal CE 7.0.3 GA4git 태그 7.0.3-ga4, 커밋 b2d7cc68a에 대해 RAPTOR loop-hunt 방법론으로 수행된 보안 감사: 결정적 정찰 → 25개의 격리된 생성 에이전트가 원시 소스 읽기 → 22개의 독립 판정 에이전트가 원시 소스로부터 반박 → 9개의 라이브 검증기가 Docker의 실제 GA4 인스턴스 공격. 핵심 소식: root 권한의 인증 없는 RCECVE-2020-7961 계열가 엔드투엔드...

Liferay-CE-Portal-Java-Deserialization

Liferay-CE-Portal-Java-Deserialization 이 저장소에는 Liferay CE Portal의 원격 코드 실행 취약점에 대한 PoC가 포함되어 있습니다! 페이로드 이미 페이로드를 저장소에 공유했습니다. 무차별 대입brute-force 방법으로 올바른 구문을 찾아야 합니다. 제가 공유한 페이로드는 시간 기반 개념 증명sleep 10을 위한 것입니다. 애플리케이션이 항상 명령을 출력하지는 않을 수 있습니다. 그렇기 때문에 PoC를 수행할 때 시간 기반 페이로드를 시도해야 합니다. 개념 증명 POST...

CVE-2011-1571

CVE-2011-1571 요약 Apache Tomcat을 사용할 때 Liferay Portal Community EditionCE 5.x 및 6.0.6 GA 이전 6.x의 XSL Content portlet에서 명시되지 않은 취약점이 발견되었으며, 원격 공격자가 알려지지 않은 벡터를 통해 임의의 명령을 실행할 수 있습니다. CVE 상세 : https://www.cvedetails.com/cve/CVE-2011-1571/ PoC :...

Liferay CE 6.0.2 Java Deserialization

Liferay CE 6.0.2 remote code execution via unsafe deserialization Recent assessments: theguly at March 02, 2020 5:11pm UTC reported: on 29th of january 2020 this github1 repo came up, with some newsfeed, speakin about a RCE via deserialization on Liferay 6.0.2 i’m aware that liferay is widely use...

Liferay CE Portal 6.0.2 - Remote Command Execution

Liferay CE Portal 6.0.2 - Remote Command Execution Exploit Title: Liferay CE Portal 6.0.2 - Remote Command Execution Google Dork: N/A Date: 2020-01-29 Exploit Author: Berk Dusunur Vendor Homepage: https://www.liferay.com/ Software Link:...

Liferay CE Portal 6.0.2 Remote Command Execution

Exploit Title: Liferay CE Portal 6.0.2 - Remote Command Execution Google Dork: N/A Date: 2020-01-29 Exploit Author: Berk Dusunur Vendor Homepage: https://www.liferay.com/ Software Link: https://sourceforge.net/projects/lportal/files/Liferay%20Portal/6.0.2/...

Liferay CE Portal 6.0.2 - Remote Command Execution

Exploit Title: Liferay CE Portal 6.0.2 - Remote Command Execution Google Dork: N/A Date: 2020-01-29 Exploit Author: Berk Dusunur Vendor Homepage: https://www.liferay.com/ Software Link: https://sourceforge.net/projects/lportal/files/Liferay%20Portal/6.0.2/...

Liferay CE Portal < 7.1.2 ga3 - Remote Command Execution (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Liferay CE Portal Tomcat %q This module uses the Liferay CE Portal Groovy script console to execute OS commands. The Groovy...

Liferay CE Portal < 7.1.2 ga3 - Remote Command Execution Exploit #RCE

Exploit for multiple platform in category web applications This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Liferay CE Portal Tomcat %q This module uses the Liferay CE Portal...

Liferay CE Portal 7.1.2 ga3 - Remote Command Execution (Metasploit)

Liferay CE Portal 7.1.2 ga3 - Remote Command Execution Metasploit This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Liferay CE Portal Tomcat %q This module uses the Liferay CE...

Liferay CE Portal Groovy-Console Remote Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Liferay CE Portal Tomcat %q This module uses the Liferay CE Portal Groovy script console to execute OS commands. The Groovy...

Liferay CE 6.2 CE GA6 - Persistent Cross-Site Scripting

Liferay CE 6.2 CE GA6 - Persistent Cross-Site Scripting CVE-2016-3670 Stored Cross Site Scripting in Liferay CE 1. Vulnerability Properties Title: Stored Cross-Site Scripting Liferay CE CVE ID: CVE-2016-3670 CVSSv3 Base Score: 4.6 AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N Vendor: Liferay Inc Products:...