Refactored Jboss mixin
Moved TARGETURI option to the JBoss mixin. The mixin now includes Msf::Exploit::Remote::HttpClient which provides USERNAME and PASSWORDbug/bundler_fix
parent
088f208c7c
commit
ae2cd63391
|
@ -7,11 +7,16 @@ module Msf
|
|||
require 'msf/http/jboss/base'
|
||||
require 'msf/http/jboss/bsh'
|
||||
|
||||
include Msf::Exploit::Remote::HttpClient
|
||||
include Msf::HTTP::JBoss::Base
|
||||
include Msf::HTTP::JBoss::BSH
|
||||
|
||||
def initialize(info = {})
|
||||
def initialize(info = {})
|
||||
super
|
||||
register_options(
|
||||
[
|
||||
OptString.new('TARGETURI', [ true, 'The URI path of the JMX console', '/jmx-console'])
|
||||
], self.class)
|
||||
end
|
||||
end
|
||||
end
|
||||
|
|
|
@ -134,13 +134,13 @@ EOT
|
|||
if (datastore['VERB']== "POST")
|
||||
res = send_request_cgi({
|
||||
'method' => datastore['VERB'],
|
||||
'uri' => normalize_uri(datastore['PATH'], '/HtmlAdaptor'),
|
||||
'uri' => normalize_uri(datastore['TARGETURI'], '/HtmlAdaptor'),
|
||||
'data' => params
|
||||
})
|
||||
else
|
||||
res = send_request_cgi({
|
||||
'method' => datastore['VERB'],
|
||||
'uri' => normalize_uri(datastore['PATH'], '/HtmlAdaptor') + "?#{params}"
|
||||
'uri' => normalize_uri(datastore['TARGETURI'], '/HtmlAdaptor') + "?#{params}"
|
||||
}, 30)
|
||||
end
|
||||
res
|
||||
|
|
|
@ -7,7 +7,6 @@ require 'msf/core'
|
|||
|
||||
class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
include Msf::Exploit::Remote::HttpClient
|
||||
include Msf::HTTP::JBoss
|
||||
|
||||
def initialize
|
||||
|
@ -38,11 +37,8 @@ class Metasploit3 < Msf::Auxiliary
|
|||
register_options(
|
||||
[
|
||||
Opt::RPORT(8080),
|
||||
OptString.new('USERNAME', [ false, 'The username to authenticate as' ]),
|
||||
OptString.new('PASSWORD', [ false, 'The password for the specified username' ]),
|
||||
OptString.new('APPBASE', [ true, 'Application base name']),
|
||||
OptString.new('STAGERNAME', [ false, 'Only used if VERB is not POST (default: "stager"', 'stager']),
|
||||
OptString.new('PATH', [ true, 'The URI path of the JMX console', '/jmx-console' ]),
|
||||
OptString.new('PACKAGE', [ true, 'The package containing the BSHDeployer service', 'auto' ]),
|
||||
OptString.new('WARFILE', [ true, 'The WAR file to deploy']),
|
||||
OptBool.new('DEPLOY', [ true, 'Deploy: true. Undeploy: false', true]),
|
||||
|
|
|
@ -10,7 +10,6 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
|
||||
HttpFingerprint = { :pattern => [ /(Jetty|JBoss)/ ] }
|
||||
|
||||
include Msf::Exploit::Remote::HttpClient
|
||||
include Msf::HTTP::JBoss
|
||||
|
||||
def initialize(info = {})
|
||||
|
@ -83,14 +82,10 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
register_options(
|
||||
[
|
||||
Opt::RPORT(8080),
|
||||
OptString.new('USERNAME', [ false, 'The username to authenticate as' ]),
|
||||
OptString.new('PASSWORD', [ false, 'The password for the specified username' ]),
|
||||
OptString.new('JSP', [ false, 'JSP name to use without .jsp extension (default: random)', nil ]),
|
||||
OptString.new('APPBASE', [ false, 'Application base name, (default: random)', nil ]),
|
||||
OptString.new('PATH', [ true, 'The URI path of the JMX console', '/jmx-console' ]),
|
||||
OptString.new('PACKAGE', [ true, 'The package containing the BSHDeployer service', 'auto' ]),
|
||||
OptEnum.new('VERB', [true, 'HTTP Method to use (for CVE-2010-0738)', 'POST', ['GET', 'POST', 'HEAD']])
|
||||
|
||||
], self.class)
|
||||
end
|
||||
|
||||
|
@ -206,7 +201,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
end
|
||||
|
||||
def query_serverinfo
|
||||
path = normalize_uri(datastore['PATH'], '/HtmlAdaptor?action=inspectMBean&name=jboss.system:type=ServerInfo')
|
||||
path = normalize_uri(datastore['TARGETURI'], '/HtmlAdaptor?action=inspectMBean&name=jboss.system:type=ServerInfo')
|
||||
res = send_request_raw(
|
||||
{
|
||||
'uri' => path,
|
||||
|
|
Loading…
Reference in New Issue