rapid7/metasploit-framework — pull request #2931 by Mekanismen (2014-01-30 13:58:32+00:00)
Title: added module for Oracle Forms and Reports

I had a couple of hours over and I figured I'd metasploitfy my original ruby one.

That being said, theres stuff to be done plus testing is hard because I don't have any of the older Oracle Fusion Middleware versions. So if someone or some people wants to help out testing or send me older versions, feel free, mattias@gotroot.eu Vulnerable versions are primarily 11.1 but also 9 and 10 if unpatched.

The code itself as mentioned has some stuff that has to be fixed.
+send_request_cgi and raw, i can't get it to grab the full get response (showmap and showenv reponses are huge) so i had to resort to using open-uri to produce this. Any help with this would be great, i'm probably missing something obvious.
+payload can be changed to a embed a meterpreter in a .jsp, easily fixed.
+overall code cleanup and testing of for example the local server when not using an external url to deliver the payload.

I have tested it on Linux version 11.1 but i don't have that possibility anymore and would as mentioned either need help to test or if someone could hand me some copies.

Eitherway it 'works' but needs polish and testing.