1、提取两个文件

cp /weblogic/Oracle/Middleware/user_projects/domains/base_domain/security/SerializedSystemIni.dat  /weblogic/test

cp  /weblogic/Oracle/Middleware/user_projects/domains/base_domain/servers/AdminServer/security/boot.properties           /weblogic/test

2、执行环境变量

/weblogic/Oracle/Middleware/wlserver_10.3/server/bin/setWLSEnv.sh

export CLASSPATH=/weblogic/Oracle/Middleware/patch_wls1036/profiles/default/sys_manifest_classpath/weblogic_patch.jar:/weblogic/Oracle/Middleware/patch_ocp371/profiles/default/sys_manifest_classpath/weblogic_patch.jar:/usr/java/jdk1.7.0_80/lib/tools.jar:/weblogic/Oracle/Middleware/wlserver_10.3/server/lib/weblogic_sp.jar:/weblogic/Oracle/Middleware/wlserver_10.3/server/lib/weblogic.jar:/weblogic/Oracle/Middleware/modules/features/weblogic.server.modules_10.3.6.0.jar:/weblogic/Oracle/Middleware/wlserver_10.3/server/lib/webservices.jar:/weblogic/Oracle/Middleware/modules/org.apache.ant_1.7.1/lib/ant-all.jar:/weblogic/Oracle/Middleware/modules/net.sf.antcontrib_1.1.0.0_1-0b2/lib/ant-contrib.jar:/weblogic/Oracle/Middleware/patch_wls1036/profiles/default/sys_manifest_classpath/weblogic_patch.jar:/weblogic/Oracle/Middleware/patch_ocp371/profiles/default/sys_manifest_classpath/weblogic_patch.jar:/usr/java/jdk1.7.0_80/lib/tools.jar:/weblogic/Oracle/Middleware/wlserver_10.3/server/lib/weblogic_sp.jar:/weblogic/Oracle/Middleware/wlserver_10.3/server/lib/weblogic.jar:/weblogic/Oracle/Middleware/modules/features/weblogic.server.modules_10.3.6.0.jar:/weblogic/Oracle/Middleware/wlserver_10.3/server/lib/webservices.jar:/weblogic/Oracle/Middleware/modules/org.apache.ant_1.7.1/lib/ant-all.jar:/weblogic/Oracle/Middleware/modules/net.sf.antcontrib_1.1.0.0_1-0b2/lib/ant-contrib.jar:.:/usr/java/jdk1.6.0_45/lib:/usr/java/jdk1.6.0_45/jre/lib

export PATH=/weblogic/Oracle/Middleware/wlserver_10.3/server/bin:/weblogic/Oracle/Middleware/modules/org.apache.ant_1.7.1/bin:/usr/java/jdk1.7.0_80/jre/bin:/usr/java/jdk1.7.0_80/bin:/weblogic/Oracle/Middleware/wlserver_10.3/server/bin:/weblogic/Oracle/Middleware/modules/org.apache.ant_1.7.1/bin:/usr/java/jdk1.7.0_80/jre/bin:/usr/java/jdk1.7.0_80/bin:/usr/java/jdk1.6.0_45/bin:/usr/java/jdk1.6.0_45/jre/bin:/usr/lib64/qt-3.3/bin:/usr/local/bin:/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/sbin:/home/weblogic/bin

3、编写Decrypt.java破解代码

cd /weblogic/test
vi Decrypt.java

import weblogic.security.internal.*;
import weblogic.security.internal.encryption.*;
import java.io.PrintStream;
public class Decrypt {
static EncryptionService es = null;
static ClearOrEncryptedService ces = null;
public static void main(String[] args) {
String s = null;
if (args.length == 0) {
s = ServerAuthenticate.promptValue("Password: ", false);
} else if (args.length == 1) {
s = args[0];
} else {
System.err.println("Usage: java Decrypt [ password ]");
}
es = SerializedSystemIni.getExistingEncryptionService();
if (es == null) {
System.err.println("Unable to initialize encryption service");
return;

}
ces = new ClearOrEncryptedService(es);
if (s != null) {
System.out.println("\nDecrypted Password is:" + ces.decrypt(s));

}

}

}

4、编译Decrypt.java

javac Decrypt.java

5、破解密码

（1）

cat boot.properties

password==={AES}dhmf9DV4WO3AL87A3SEdeVpDoitg6n21HlLbrka1+Ck===

username={AES}uOWGoXmpA0isbA68WC6vSNp6atbSZKlR4XQypbcoCUo=

（2）

java Decrypt {AES}dhmf9DV4WO3AL87A3SEdeVpDoitg6n21HlLbrka1+Ck=

运行结束：Decrypted Password is: weblogic123