1、提取两个文件
cp /weblogic/Oracle/Middleware/user_projects/domains/base_domain/security/SerializedSystemIni.dat /weblogic/test
cp /weblogic/Oracle/Middleware/user_projects/domains/base_domain/servers/AdminServer/security/boot.properties /weblogic/test
2、执行环境变量
/weblogic/Oracle/Middleware/wlserver_10.3/server/bin/setWLSEnv.sh
export CLASSPATH=/weblogic/Oracle/Middleware/patch_wls1036/profiles/default/sys_manifest_classpath/weblogic_patch.jar:/weblogic/Oracle/Middleware/patch_ocp371/profiles/default/sys_manifest_classpath/weblogic_patch.jar:/usr/java/jdk1.7.0_80/lib/tools.jar:/weblogic/Oracle/Middleware/wlserver_10.3/server/lib/weblogic_sp.jar:/weblogic/Oracle/Middleware/wlserver_10.3/server/lib/weblogic.jar:/weblogic/Oracle/Middleware/modules/features/weblogic.server.modules_10.3.6.0.jar:/weblogic/Oracle/Middleware/wlserver_10.3/server/lib/webservices.jar:/weblogic/Oracle/Middleware/modules/org.apache.ant_1.7.1/lib/ant-all.jar:/weblogic/Oracle/Middleware/modules/net.sf.antcontrib_1.1.0.0_1-0b2/lib/ant-contrib.jar:/weblogic/Oracle/Middleware/patch_wls1036/profiles/default/sys_manifest_classpath/weblogic_patch.jar:/weblogic/Oracle/Middleware/patch_ocp371/profiles/default/sys_manifest_classpath/weblogic_patch.jar:/usr/java/jdk1.7.0_80/lib/tools.jar:/weblogic/Oracle/Middleware/wlserver_10.3/server/lib/weblogic_sp.jar:/weblogic/Oracle/Middleware/wlserver_10.3/server/lib/weblogic.jar:/weblogic/Oracle/Middleware/modules/features/weblogic.server.modules_10.3.6.0.jar:/weblogic/Oracle/Middleware/wlserver_10.3/server/lib/webservices.jar:/weblogic/Oracle/Middleware/modules/org.apache.ant_1.7.1/lib/ant-all.jar:/weblogic/Oracle/Middleware/modules/net.sf.antcontrib_1.1.0.0_1-0b2/lib/ant-contrib.jar:.:/usr/java/jdk1.6.0_45/lib:/usr/java/jdk1.6.0_45/jre/lib
export PATH=/weblogic/Oracle/Middleware/wlserver_10.3/server/bin:/weblogic/Oracle/Middleware/modules/org.apache.ant_1.7.1/bin:/usr/java/jdk1.7.0_80/jre/bin:/usr/java/jdk1.7.0_80/bin:/weblogic/Oracle/Middleware/wlserver_10.3/server/bin:/weblogic/Oracle/Middleware/modules/org.apache.ant_1.7.1/bin:/usr/java/jdk1.7.0_80/jre/bin:/usr/java/jdk1.7.0_80/bin:/usr/java/jdk1.6.0_45/bin:/usr/java/jdk1.6.0_45/jre/bin:/usr/lib64/qt-3.3/bin:/usr/local/bin:/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/sbin:/home/weblogic/bin
3、编写Decrypt.java破解代码
cd /weblogic/test
vi Decrypt.java
import weblogic.security.internal.*; import weblogic.security.internal.encryption.*;
import java.io.PrintStream;
public class Decrypt { static EncryptionService es = null; static ClearOrEncryptedService ces = null;
public static void main(String[] args) { String s = null;
if (args.length == 0) { s = ServerAuthenticate.promptValue("Password: ", false); } else if (args.length == 1) { s = args[0]; } else { System.err.println("Usage: java Decrypt [ password ]"); }
es = SerializedSystemIni.getExistingEncryptionService();
if (es == null) { System.err.println("Unable to initialize encryption service");
return; }
ces = new ClearOrEncryptedService(es);
if (s != null) { System.out.println("\nDecrypted Password is:" + ces.decrypt(s)); } } } |
4、编译Decrypt.java
javac Decrypt.java
5、破解密码
（1）
cat boot.properties
password={AES}dhmf9DV4WO3AL87A3SEdeVpDoitg6n21HlLbrka1+Ck\=
username={AES}uOWGoXmpA0isbA68WC6vSNp6atbSZKlR4XQypbcoCUo\=
（2）
java Decrypt {AES}dhmf9DV4WO3AL87A3SEdeVpDoitg6n21HlLbrka1+Ck\=
==================》得到破解结果