[nas010]

One of the companies says Gmail.com?!

Anyone checked the list??

[0neSh0t]

Nice one!

Which exploit did you use?

[xploiter]

One of the companies says Gmail.com?!

Anyone checked the list??

Yup, seems like bluffing. They might have something, but claim to have much more than what they really have

[Brother14]

i've sent you a pm

sent PM. let me know if u can talk

i answers all PMs, please send your offers and i will check. i waiting for all offers

Great Job!
I know some companies in the list that using OCI just in the last one year.

thanks , but oracle denied this breach )

Nice job )) are you on session or qtox?

PM

Nice job. Have oracle contact you?

we talk 2weeks, but after fix,  denied our conversations )

PM'd let's talk. TOX is better

[MoistMaker]

bro is either a retard and has old shitty data or actually knows what he's doing

ill be here with my popcorn waiting to find out

[Cyberkong2114]

Hello,

Oracle traditional servers were hacked (domains : login.(region-name).oraclecloud.com )

Around 6 million user customers’ data from SSO and LDAP was stolen.

JKS files, passwords, key files, and enterprise manager JPS keys were also taken.

The SSO passwords are encrypted, they can be decrypted with the available files. also LDAP  hashed password can be cracked. (I couldn’t do it, but if 

someone can tell me how to decrypt them, i can give them some of the data as a gift.)

I’ll list the domains of all the companies in this leak. Companies can pay a specific amount to remove their employees’ information from the list before it’s sold.

i can also trade for 0-day exploits.  send me a private message (PM).

oracle can send me a message through the company's official email to My Email with 72H ( we talk before )

PM for Offer

Sample LDAP > https://anonfile.io/f/sgRKh9HJ

Company list > https://anonfile.io/f/KUJuSgIX
Sample DataBase > https://anonfile.io/f/1N4UXKtv

[align=left]# Matt Wallace, users, 11987096172814988, cloud.oracle.com[/align] dn: cn=Matt Wallace,cn=users,orclMTTenantGuid=11987096172814988,dc=cloud,dc=or acle,dc=com orclmtuid: efkd-test.matt_wallace@hitchiner.com tenantadmin: cn=TenantAdminGroup,cn=Groups,orclMTTenantGuid=11987096172814988, dc=cloud,dc=oracle,dc=com userwriteprivilegeuc: cn=orclUserWritePrivilegeGroup,cn=SystemIDGroups,cn=Grou ps,orclMTTenantGuid=11987096172814988,dc=cloud,dc=oracle,dc=com userreadprivilegeuc: cn=orclUserReadPrivilegeGroup,cn=SystemIDGroups,cn=Groups ,orclMTTenantGuid=11987096172814988,dc=cloud,dc=oracle,dc=com userwriteprefsprivilegeuc: cn=orclUserWritePrefsPrivilegeGroup,cn=SystemIDGrou ps,cn=Groups,orclMTTenantGuid=11987096172814988,dc=cloud,dc=oracle,dc=com orclmttenantuname: efkd-test orclmttenantguid: 11987096172814988 orclmttenantstate: ENABLED authpassword;oid: {SASL/MD5}UyfTnsZlxsfJ6Gyfo1sJIw== authpassword;oid: {SASL/MD5-DN}jX6mxVjXALq1Px4a0xOWWA== authpassword;oid: {SASL/MD5-U}V+XK5sQjGdO1E7RZNYDCfw== userpassword:: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx = objectclass: orclIDXPerson objectclass: oblixPersonPwdPolicy objectclass: oblixOrgPerson objectclass: OIMPersonPwdPolicy objectclass: inetorgperson objectclass: top objectclass: organizationalPerson objectclass: person oblogintrycount: 0 displayname: Matt Wallace cn: Matt Wallace employeetype: OTHER uid: matt_wallace@hitchiner.com obpasswordchangeflag: true mail: matt_wallace@hitchiner.com sn: Wallace obpasswordexpirydate: 2018-05-24T00:00:00Z [align=left]givenname: Matt[/align]

[align=left]USR_KEY ACT_KEY USR_LAST_NAME USR_FIRST_NAME USR_MIDDLE_NAME USR_DISPLAY_NAME USR_MANAGER USR_TYPE USR_LOCATION USR_FSS USR_TODO USR_PASSWORD USR_DISABLED USR_PWD_CANT_CHANGE USR_PWD_MUST_CHANGE USR_PWD_NEVER_EXPIRES USR_UPDATE_AD USR_CREATED USR_STATUS USR_EMP_TYPE USR_LOGIN USR_DISABLED_BY_PARENT USR_PWD_EXPIRE_DATE USR_PWD_WARN_DATE USR_MANAGER_KEY USR_POLICY_UPDATE USR_PWD_WARNED USR_PWD_EXPIRED USR_START_DATE USR_END_DATE USR_PROVISIONING_DATE USR_DEPROVISIONING_DATE USR_PROVISIONED_DATE USR_DEPROVISIONED_DATE USR_EMAIL USR_LOCKED USR_LOGIN_ATTEMPTS_CTR USR_PWD_RESET_ATTEMPTS_CTR USR_CHANGE_PWD_AT_NEXT_LOGON USR_PWD_MIN_AGE_DATE USR_DATA_LEVEL USR_CREATE USR_CREATEBY USR_UPDATE USR_UPDATEBY USR_NOTE USR_TIMEZONE USR_LOCALE USR_LOCKED_ON USR_MANUALLY_LOCKED USR_AUTOMATICALLY_DELETE_ON USR_FULL_NAME USR_COUNTRY USR_DEPT_NO USR_DESCRIPTION USR_COMMON_NAME USR_EMP_NO USR_FAX USR_GEN_QUALIFIER USR_HIRE_DATE USR_HOME_PHONE USR_LOCALITY_NAME USR_MOBILE USR_PAGER USR_HOME_POSTAL_ADDRESS USR_POSTAL_ADDRESS USR_POSTAL_CODE USR_PO_BOX USR_STATE USR_STREET USR_TELEPHONE_NUMBER USR_TITLE USR_INITIALS USR_PWD_GENERATED USR_LDAP_ORGANIZATION USR_LDAP_ORGANIZATION_UNIT USR_LDAP_GUID USR_LDAP_DN USR_ROWVER USR_ACCESSIBILITY_MODE USR_COLOR_CONTRAST USR_FONT_SIZE USR_NUMBER_FORMAT USR_CURRENCY USR_DATE_FORMAT USR_TIME_FORMAT USR_EMBEDDED_HELP USR_LANGUAGE USR_TERRITORY USR_NAME_PREFERRED_LANG USR_UDF_TENANT_GUID USR_UDF_TENANT_NAME USR_UDF_NONMT_LOGIN USR_UDF_EXTERNAL_USER_TYPE USR_UDF_FA_USER_ID USR_UDF_FA_PERSON_ID USR_UDF_FA_PARTY_ID USR_CN_GENERATED USR_SUMMARY_RISK USR_HAS_HIGH_RISK_ROLE USR_HAS_HIGH_RISK_RESOURCE USR_HAS_HIGH_RISK_ENTITLEMENT USR_HAS_HIGH_RISK_PROV_METH USR_HAS_HIGH_RISK_OPEN_SOD USR_HAS_HIGH_RISK_LAST_CERT USR_ROLE_SUMMARY_RISK USR_ACCOUNT_SUMMARY_RISK USR_ENTITLEMENT_SUMMARY_RISK USR_RISK_UPDATE_DATE USR_JOB_CODE USR_OFFICE_NAME IS_USR_FEDERATED [/align]

[align=left]'5023117 '1 'valakonda 'canary 'null 'tascanary_in_grp@oracle.com 'null 'End-User Administrator 'null 'null 'null ' '0 'null 'null 'null 'null '2022-11-03 16:18:33.0 'Active 'Full-Time 'CANARY791204852.TASCANARY_IN_GRP@ORACLE.COM 'null 'null 'null 'null 'null 'null 'null 'null 'null 'null 'null '2022-11-03 16:18:33.0 'null 'tascanary_in_grp@oracle.com '0 '0 '0 '1 'null 'null '2022-11-03 16:18:33.0 '4 '2022-11-03 16:18:33.0 '4 'null 'null 'null 'null 'null 'null 'null 'null 'null 'Identity Domain Administrator 'tascanary_in_grp@oracle.com 'null 'null 'null 'null 'null 'null 'null 'null 'null 'null 'null 'null 'null 'null 'null 'null 'null 'null 'null 'null 'E9F2FE7F3770CEFDE050C10A19944D4E 'cn=tascanary_in_grp@oracle.com,cn=users,orclMTTenantGuid=57371814553534184,dc=cloud,dc=oracle,dc=com '0000000000000000 'null 'null 'null 'null 'null 'null 'null 'null 'null 'null 'null '57371814553534184 'canary791204852 'tascanary_in_grp@oracle.com 'null 'null 'null 'null '0 'null 'null 'null 'null 'null 'null 'null 'null 'null 'null 'null 'null 'null 'null[/align]

Hi, i'm interested on the information refer to Buenaventura. Do you have an email to contact?

[linkjr]

One of the companies says Gmail.com?!

Anyone checked the list??

They are SSO user, it means that a company using OIC has users using gmail.com email account as username (could be the one just above gmail row in the company list, or 2-3 lines above)

[coolman128]

Woah Crazy Bro ~

[fredfuchs]

MD5 hashed passwords though? In this day and age? Suspicious

[GlobalCitizen4488]

This is canary environment (test with no real data)