metasploit-framework/lib/msf/http/jboss/base.rb

142 lines
3.8 KiB
Ruby
Raw Normal View History

# -*- coding: binary -*-
2014-08-22 19:18:13 +00:00
module Msf::HTTP::JBoss::Base
2014-08-22 19:18:13 +00:00
# Deploys a WAR through HTTP uri invoke
#
# @param opts [Hash] Hash containing {Exploit::Remote::HttpClient#send_request_cgi} options
2014-09-29 21:59:12 +00:00
# @param num_attempts [Integer] The number of attempts
2014-08-22 19:18:13 +00:00
# @return [Rex::Proto::Http::Response, nil] The {Rex::Proto::Http::Response} response if exists, nil otherwise
2014-08-01 19:28:26 +00:00
def deploy(opts = {}, num_attempts = 5)
uri = opts['uri']
if uri.blank?
return nil
end
# JBoss might need some time for the deployment. Try 5 times at most and
# wait 5 seconds inbetween tries
num_attempts.times do |attempt|
2014-08-01 19:28:26 +00:00
res = send_request_cgi(opts, 5)
msg = nil
2014-08-01 19:28:26 +00:00
if res.nil?
msg = "Execution failed on #{uri} [No Response]"
2014-08-01 19:28:26 +00:00
elsif res.code == 200
vprint_status("Successfully called '#{uri}'")
return res
2014-08-22 20:11:27 +00:00
else
msg = "http request failed to #{uri} [#{res.code}]"
end
2014-08-01 19:28:26 +00:00
if attempt < num_attempts - 1
msg << ", retrying in 5 seconds..."
vprint_status(msg)
Rex.sleep(5)
else
print_error(msg)
return res
end
end
end
2014-08-01 19:28:26 +00:00
2014-08-22 19:18:13 +00:00
# Provides the HTTP verb used
#
# @return [String] The HTTP verb in use
2014-08-01 19:28:26 +00:00
def http_verb
datastore['VERB']
end
# Try to auto detect the target architecture and platform
#
2015-04-02 11:14:25 +00:00
# @param [Array] available_targets The available targets
# @return [Msf::Module::Target, nil] java_targets The detected target or nil
def auto_target(available_targets)
2014-12-07 03:47:55 +00:00
if http_verb == 'HEAD'
print_status("Sorry, automatic target detection doesn't work with HEAD requests")
else
print_status("Attempting to automatically select a target...")
res = query_serverinfo
2014-12-07 03:47:55 +00:00
plat = detect_platform(res)
unless plat
print_warning('Unable to detect platform!')
return nil
end
2014-12-07 03:47:55 +00:00
arch = detect_architecture(res)
unless arch
print_warning('Unable to detect architecture!')
return nil
end
# see if we have a match
2014-12-07 03:47:55 +00:00
available_targets.each { |t| return t if t['Platform'] == plat && t['Arch'] == arch }
end
# no matching target found, use Java as fallback
java_targets = available_targets.select {|t| t.name =~ /^Java/ }
2014-12-07 03:47:55 +00:00
java_targets[0]
end
# Query the server information from HtmlAdaptor
#
# @return [Rex::Proto::Http::Response, nil] The {Rex::Proto::Http::Response} response or nil
def query_serverinfo
path = normalize_uri(target_uri.path.to_s, 'HtmlAdaptor')
res = send_request_cgi(
{
'uri' => path,
'method' => http_verb,
2014-09-29 21:59:12 +00:00
'vars_get' =>
{
'action' => 'inspectMBean',
'name' => 'jboss.system:type=ServerInfo'
}
})
unless res && res.code == 200
print_error("Failed: Error requesting #{path}")
return nil
end
res
end
# Try to autodetect the target platform
#
2014-12-07 03:47:55 +00:00
# @param res [Rex::Proto::Http::Response] the http response where fingerprint platform from
# @return [String, nil] The target platform or nil
def detect_platform(res)
if res && res.body =~ /<td.*?OSName.*?(Linux|FreeBSD|Windows).*?<\/td>/m
os = $1
if (os =~ /Linux/i)
return 'linux'
elsif (os =~ /FreeBSD/i)
return 'linux'
elsif (os =~ /Windows/i)
return 'win'
end
end
nil
end
# Try to autodetect the target architecture
#
2014-12-07 03:47:55 +00:00
# @param res [Rex::Proto::Http::Response] the http response where fingerprint architecture from
# @return [String, nil] The target architecture or nil
def detect_architecture(res)
if res && res.body =~ /<td.*?OSArch.*?(x86|i386|i686|x86_64|amd64).*?<\/td>/m
arch = $1
2014-12-07 03:47:55 +00:00
if arch =~ /(x86|i386|i686)/i
return ARCH_X86
2014-12-07 03:47:55 +00:00
elsif arch =~ /(x86_64|amd64)/i
return ARCH_X86
end
end
nil
end
end