I am doing a pentest for a client and, via Qualys, we have discovered a CVE-2018-2894 vulnerability. We are using it now as part of the pentest and try to exploit it. I've followed this proof of concept video that seems pretty simple:
And everything works fine (can change working directory, upload to keystore, etc.), but when I go to the link where the shell is supposed to be (/ ws_utc / css / config / keystore /https://security.stackexchange.com/q/205173_[filename].jsp) he throws a 404.
Go to ws_utc / css / config / keystore is the same, only ws_utc / css seems to not show a 404.
What am I doing wrong?
The home directory was already set to "/ test_apps / config / domains / test / tmp / WSTestPageWorkDir" by the client.
Definition of the basic working directory on
"servers / AdminServer / tmp / _WL_internal / com.oracle.webservices.wls.ws-testclient-app-wls / 4mcj4y / war / css"
(absolute vs. relative path that is referenced in some other pages) does not actually work, says the directory is not writable