[rose87168]

Hello,

Oracle traditional servers were hacked (domains : login.(region-name).oraclecloud.com )

Around 6 million user customers’ data from SSO and LDAP was stolen.

JKS files, passwords, key files, and enterprise manager JPS keys were also taken.

I’ll list the domains of all the companies in this leak. Companies can pay a specific amount to remove their employees’ information from the list before it’s sold.

oracle can send me a message through the company's official email to My Email with 72H ( we talk before )

Thread now have VERIFIED tag by Admin

2025 fresh sample

PoC access to client dashboard

[/url]

not any test env as you see :

https://www.cloudsek.com/blog/part-2-validating-the-breach-oracle-cloud-denied-cloudseks-follow-up-analysis

New archive Proof of access :

https://web.archive.org/web/20250301161225/login.us2.oraclecloud.com/oamfed/x.txt?mail

Oracle is being sued in Texas:
[url=https://storage.courtlistener.com/recap/gov.uscourts.txwd.1172831612/gov.uscourts.txwd.1172831612.1.0.pdf]https://storage.courtlistener.com/recap/...12.1.0.pdf

1- only send offers. ( add price in title )
2- decryption is not crack service !

Sample LDAP > https://anonfile.io/f/sgRKh9HJ

Company list > https://anonfile.io/f/KUJuSgIX
Sample DataBase > https://anonfile.io/f/1N4UXKtv

[align=left]# Matt Wallace, users, 11987096172814988, cloud.oracle.com[/align] dn: cn=Matt Wallace,cn=users,orclMTTenantGuid=11987096172814988,dc=cloud,dc=or acle,dc=com orclmtuid: efkd-test.matt_wallace@hitchiner.com tenantadmin: cn=TenantAdminGroup,cn=Groups,orclMTTenantGuid=11987096172814988, dc=cloud,dc=oracle,dc=com userwriteprivilegeuc: cn=orclUserWritePrivilegeGroup,cn=SystemIDGroups,cn=Grou ps,orclMTTenantGuid=11987096172814988,dc=cloud,dc=oracle,dc=com userreadprivilegeuc: cn=orclUserReadPrivilegeGroup,cn=SystemIDGroups,cn=Groups ,orclMTTenantGuid=11987096172814988,dc=cloud,dc=oracle,dc=com userwriteprefsprivilegeuc: cn=orclUserWritePrefsPrivilegeGroup,cn=SystemIDGrou ps,cn=Groups,orclMTTenantGuid=11987096172814988,dc=cloud,dc=oracle,dc=com orclmttenantuname: efkd-test orclmttenantguid: 11987096172814988 orclmttenantstate: ENABLED authpassword;oid: {SASL/MD5}UyfTnsZlxsfJ6Gyfo1sJIw== authpassword;oid: {SASL/MD5-DN}jX6mxVjXALq1Px4a0xOWWA== authpassword;oid: {SASL/MD5-U}V+XK5sQjGdO1E7RZNYDCfw== userpassword:: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx = objectclass: orclIDXPerson objectclass: oblixPersonPwdPolicy objectclass: oblixOrgPerson objectclass: OIMPersonPwdPolicy objectclass: inetorgperson objectclass: top objectclass: organizationalPerson objectclass: person oblogintrycount: 0 displayname: Matt Wallace cn: Matt Wallace employeetype: OTHER uid: matt_wallace@hitchiner.com obpasswordchangeflag: true mail: matt_wallace@hitchiner.com sn: Wallace obpasswordexpirydate: 2018-05-24T00:00:00Z [align=left]givenname: Matt[/align]

[align=left]USR_KEY ACT_KEY USR_LAST_NAME USR_FIRST_NAME USR_MIDDLE_NAME USR_DISPLAY_NAME USR_MANAGER USR_TYPE USR_LOCATION USR_FSS USR_TODO USR_PASSWORD USR_DISABLED USR_PWD_CANT_CHANGE USR_PWD_MUST_CHANGE USR_PWD_NEVER_EXPIRES USR_UPDATE_AD USR_CREATED USR_STATUS USR_EMP_TYPE USR_LOGIN USR_DISABLED_BY_PARENT USR_PWD_EXPIRE_DATE USR_PWD_WARN_DATE USR_MANAGER_KEY USR_POLICY_UPDATE USR_PWD_WARNED USR_PWD_EXPIRED USR_START_DATE USR_END_DATE USR_PROVISIONING_DATE USR_DEPROVISIONING_DATE USR_PROVISIONED_DATE USR_DEPROVISIONED_DATE USR_EMAIL USR_LOCKED USR_LOGIN_ATTEMPTS_CTR USR_PWD_RESET_ATTEMPTS_CTR USR_CHANGE_PWD_AT_NEXT_LOGON USR_PWD_MIN_AGE_DATE USR_DATA_LEVEL USR_CREATE USR_CREATEBY USR_UPDATE USR_UPDATEBY USR_NOTE USR_TIMEZONE USR_LOCALE USR_LOCKED_ON USR_MANUALLY_LOCKED USR_AUTOMATICALLY_DELETE_ON USR_FULL_NAME USR_COUNTRY USR_DEPT_NO USR_DESCRIPTION USR_COMMON_NAME USR_EMP_NO USR_FAX USR_GEN_QUALIFIER USR_HIRE_DATE USR_HOME_PHONE USR_LOCALITY_NAME USR_MOBILE USR_PAGER USR_HOME_POSTAL_ADDRESS USR_POSTAL_ADDRESS USR_POSTAL_CODE USR_PO_BOX USR_STATE USR_STREET USR_TELEPHONE_NUMBER USR_TITLE USR_INITIALS USR_PWD_GENERATED USR_LDAP_ORGANIZATION USR_LDAP_ORGANIZATION_UNIT USR_LDAP_GUID USR_LDAP_DN USR_ROWVER USR_ACCESSIBILITY_MODE USR_COLOR_CONTRAST USR_FONT_SIZE USR_NUMBER_FORMAT USR_CURRENCY USR_DATE_FORMAT USR_TIME_FORMAT USR_EMBEDDED_HELP USR_LANGUAGE USR_TERRITORY USR_NAME_PREFERRED_LANG USR_UDF_TENANT_GUID USR_UDF_TENANT_NAME USR_UDF_NONMT_LOGIN USR_UDF_EXTERNAL_USER_TYPE USR_UDF_FA_USER_ID USR_UDF_FA_PERSON_ID USR_UDF_FA_PARTY_ID USR_CN_GENERATED USR_SUMMARY_RISK USR_HAS_HIGH_RISK_ROLE USR_HAS_HIGH_RISK_RESOURCE USR_HAS_HIGH_RISK_ENTITLEMENT USR_HAS_HIGH_RISK_PROV_METH USR_HAS_HIGH_RISK_OPEN_SOD USR_HAS_HIGH_RISK_LAST_CERT USR_ROLE_SUMMARY_RISK USR_ACCOUNT_SUMMARY_RISK USR_ENTITLEMENT_SUMMARY_RISK USR_RISK_UPDATE_DATE USR_JOB_CODE USR_OFFICE_NAME IS_USR_FEDERATED [/align]

[align=left]'5023117 '1 'valakonda 'canary 'null 'tascanary_in_grp@oracle.com 'null 'End-User Administrator 'null 'null 'null ' '0 'null 'null 'null 'null '2022-11-03 16:18:33.0 'Active 'Full-Time 'CANARY791204852.TASCANARY_IN_GRP@ORACLE.COM 'null 'null 'null 'null 'null 'null 'null 'null 'null 'null 'null '2022-11-03 16:18:33.0 'null 'tascanary_in_grp@oracle.com '0 '0 '0 '1 'null 'null '2022-11-03 16:18:33.0 '4 '2022-11-03 16:18:33.0 '4 'null 'null 'null 'null 'null 'null 'null 'null 'null 'Identity Domain Administrator 'tascanary_in_grp@oracle.com 'null 'null 'null 'null 'null 'null 'null 'null 'null 'null 'null 'null 'null 'null 'null 'null 'null 'null 'null 'null 'E9F2FE7F3770CEFDE050C10A19944D4E 'cn=tascanary_in_grp@oracle.com,cn=users,orclMTTenantGuid=57371814553534184,dc=cloud,dc=oracle,dc=com '0000000000000000 'null 'null 'null 'null 'null 'null 'null 'null 'null 'null 'null '57371814553534184 'canary791204852 'tascanary_in_grp@oracle.com 'null 'null 'null 'null '0 'null 'null 'null 'null 'null 'null 'null 'null 'null 'null 'null 'null 'null 'null[/align]

Dashboard access by this user :

# torsten.rattmann@dmh-global.com, users, 36535837604958458, cloud.oracle.com dn: cn=torsten.rattmann@dmh-global.com,cn=users,orclMTTenantGuid=3653583760495 8458,dc=cloud,dc=oracle,dc=com orclmtuid: denon37162.torsten.rattmann@dmh-global.com tenantadmin: cn=TenantAdminGroup,cn=Groups,orclMTTenantGuid=36535837604958458, dc=cloud,dc=oracle,dc=com userwriteprivilegeuc: cn=orclUserWritePrivilegeGroup,cn=SystemIDGroups,cn=Grou ps,orclMTTenantGuid=36535837604958458,dc=cloud,dc=oracle,dc=com userreadprivilegeuc: cn=orclUserReadPrivilegeGroup,cn=SystemIDGroups,cn=Groups ,orclMTTenantGuid=36535837604958458,dc=cloud,dc=oracle,dc=com userwriteprefsprivilegeuc: cn=orclUserWritePrefsPrivilegeGroup,cn=SystemIDGrou ps,cn=Groups,orclMTTenantGuid=36535837604958458,dc=cloud,dc=oracle,dc=com orclmttenantuname: denon37162 orclmttenantguid: 36535837604958458 orclmttenantstate: ENABLED authpassword;oid: {SASL/MD5}Dr6HzPy[REDUCT]aws9lc1k+w== authpassword;oid: {SASL/MD5-DN}60[REDUCT]xQjOOXdC0qew== authpassword;oid: {SASL/MD5-U}u+ZS5K[REDUCT]Ssl1ntYzqQ== oblockouttime: 1452773061 userpassword:: e1NTSEF9UEwrWXpKRmx[REDUCT]FFWi9NT2picTV3T[REDUCT]xRFFpQ1BST1E9PQ== orclpassword: {x- orcldbpwd}1.0:8E4B6D20546AAEAB orclsamaccountname: denon37162.torsten.rattmann@dmh-global.com givenname: Torsten obpasswordexpirydate: 2024-05-08T00:00:00Z sn: Rattmann displayname: torsten.rattmann@dmh-global.com mail: torsten.rattmann@dmh-global.com obpasswordchangeflag: false uid: torsten.rattmann@dmh-global.com obuseraccountcontrol: activated cn: torsten.rattmann@dmh-global.com description: Identity Domain Administrator objectclass: orclIDXPerson objectclass: orclUser objectclass: orclUserV2 objectclass: oblixPersonPwdPolicy objectclass: oblixOrgPerson objectclass: OIMPersonPwdPolicy objectclass: inetorgperson objectclass: top objectclass: organizationalPerson objectclass: person oblogintrycount: 0

[chpudding]

Woah Crazy stuff!

[rose87168]

The number of my messages has increased, wait, I will reply to everyone. ( 20msg per day limits )

[0xbulla]

As per rules, you have to post price here on the thread. Anyways PMing you also

[Brother14]

post TG or TOX or something if you are a new user with limited messages..

[pathofexile]

was it weblogic flaw? nice ill trade help with ldap crack for more info on the exploit if you like! ♥

[jimmykrt80]

Are all companies that have data in the sample? I'm interested in this data, great work!

[mizael23]

amazing bro congrats

[L7wok]

that's a good leak! how much?

[tester27]

I would like assist help in cracking