OAMBuster

OAMBuster 针对 Oracle OAM 的多线程 Padding Oracle 攻击（CVE-2018-2879） 作者 Red Timmy Marco Ortisi, Stefan Broeder, Ahmad Mahfouz 描述 此多线程漏洞利用工具的开发目的是大幅提高攻击速度，相比单线程版本。 如需了解该攻击的技术细节，请参阅 SEC Consult 的这篇博客文章： https://sec-consult.com/en/blog/2018/05/oracle-access-managers-identity-crisis/ 前两个阶段将快速验证网站是否易受此攻击影响。 ...

Oracle-OAM-Padding-Oracle-CVE-2018-2879-Exploit

Oracle-OAM-Padding-Oracle-CVE-2018-2879-Exploit はじめに このエクスプロイトは、Oracle OAM 11.1.2.3.0 に対するペネトレーションテスト中に開発されました。これは、sec-consult による技術解説に基づいて開発されています。 https://www.sec-consult.com/en/blog/2018/05/oracle-access-managers-identity-crisis/ 要件 このエクスプロイトは python-paddingoracle に依存しています。ここからダウンロードできます。...

oracle-oam-authentication-bypas-exploit

Oracle Access Manager OAM 身份验证绕过利用工具 介绍 利用Oracle Access Manager OAM 填充预言机漏洞（CVE-2018-2879），通过有效用户名绕过身份验证并登录任何受OAM保护的Web应用。 此利用工具基于SEC Consult发现的OAM填充预言机漏洞，并在OAM v12.2.1.3.0上进行了测试。 https://www.sec-consult.com/en/blog/2018/05/oracle-access-managers-identity-crisis/ 依赖 pip install urllib3...

U.S. Dept Of Defense: [HTAF4-213] [Pre-submission] CVE-2018-2879 (padding oracle attack in the Oracle Access Manager) at https://█████████

Description We were able to identify CVE-2018-2879 in Oracle Access Manager, used on the https://██████ Link to the CVE: https://nvd.nist.gov/vuln/detail/CVE-2018-2879 This vulnerability is rated critical, and may allow unauthenticated attacker with network access via HTTP to compromise Oracle...

Oracle Access Manager Multiple Vulnerabilities (Apr 2018 CPU)

The version of Oracle Access Manager installed on the remote host is affected by multiple vulnerabilities. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid109733; scriptversion"1.8";...

CVE-2018-2879

The CVE-2018-2879 issue affects Oracle Access Manager (part of Oracle Fusion Middleware) specifically the Authentication Engine in versions 11.1.2.3.0 and 12.2.1.3.0. The root cause is a vulnerability that enables unauthenticated attackers with network access over HTTP to compromise Oracle Access...