[Update: I added the server part delivering the payload] This weekend, Oracle published a surprise security bulletin announcing an exploited vulnerability in Oracle E-Business Suite. As part of the announcement, which also included a patch, Oracle published IoC observed as part of the incident response [1]. One script I found interesting is what Oracle calls "exp.py" [2]. Here is a quick analysis of the HTTP requests sent by the script. I only ran it against a simple Python web server, not an actual Oracle E-Business Suite install. The script takes two parameters: The URL of the target and the IP/port of a config server. The first request sent by the script: GET /OA_HTML/runforms.jsp HTTP/HTTP/1.1 Host: [target host]:8000 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)…