Refactored Jboss mixin

Moved TARGETURI option to the JBoss mixin. The mixin now includes
Msf::Exploit::Remote::HttpClient which provides USERNAME and PASSWORD
bug/bundler_fix
us3r777 2014-07-21 23:41:58 +02:00
parent 088f208c7c
commit ae2cd63391
4 changed files with 9 additions and 13 deletions

View File

@ -7,11 +7,16 @@ module Msf
require 'msf/http/jboss/base' require 'msf/http/jboss/base'
require 'msf/http/jboss/bsh' require 'msf/http/jboss/bsh'
include Msf::Exploit::Remote::HttpClient
include Msf::HTTP::JBoss::Base include Msf::HTTP::JBoss::Base
include Msf::HTTP::JBoss::BSH include Msf::HTTP::JBoss::BSH
def initialize(info = {}) def initialize(info = {})
super super
register_options(
[
OptString.new('TARGETURI', [ true, 'The URI path of the JMX console', '/jmx-console'])
], self.class)
end end
end end
end end

View File

@ -134,13 +134,13 @@ EOT
if (datastore['VERB']== "POST") if (datastore['VERB']== "POST")
res = send_request_cgi({ res = send_request_cgi({
'method' => datastore['VERB'], 'method' => datastore['VERB'],
'uri' => normalize_uri(datastore['PATH'], '/HtmlAdaptor'), 'uri' => normalize_uri(datastore['TARGETURI'], '/HtmlAdaptor'),
'data' => params 'data' => params
}) })
else else
res = send_request_cgi({ res = send_request_cgi({
'method' => datastore['VERB'], 'method' => datastore['VERB'],
'uri' => normalize_uri(datastore['PATH'], '/HtmlAdaptor') + "?#{params}" 'uri' => normalize_uri(datastore['TARGETURI'], '/HtmlAdaptor') + "?#{params}"
}, 30) }, 30)
end end
res res

View File

@ -7,7 +7,6 @@ require 'msf/core'
class Metasploit3 < Msf::Auxiliary class Metasploit3 < Msf::Auxiliary
include Msf::Exploit::Remote::HttpClient
include Msf::HTTP::JBoss include Msf::HTTP::JBoss
def initialize def initialize
@ -38,11 +37,8 @@ class Metasploit3 < Msf::Auxiliary
register_options( register_options(
[ [
Opt::RPORT(8080), Opt::RPORT(8080),
OptString.new('USERNAME', [ false, 'The username to authenticate as' ]),
OptString.new('PASSWORD', [ false, 'The password for the specified username' ]),
OptString.new('APPBASE', [ true, 'Application base name']), OptString.new('APPBASE', [ true, 'Application base name']),
OptString.new('STAGERNAME', [ false, 'Only used if VERB is not POST (default: "stager"', 'stager']), OptString.new('STAGERNAME', [ false, 'Only used if VERB is not POST (default: "stager"', 'stager']),
OptString.new('PATH', [ true, 'The URI path of the JMX console', '/jmx-console' ]),
OptString.new('PACKAGE', [ true, 'The package containing the BSHDeployer service', 'auto' ]), OptString.new('PACKAGE', [ true, 'The package containing the BSHDeployer service', 'auto' ]),
OptString.new('WARFILE', [ true, 'The WAR file to deploy']), OptString.new('WARFILE', [ true, 'The WAR file to deploy']),
OptBool.new('DEPLOY', [ true, 'Deploy: true. Undeploy: false', true]), OptBool.new('DEPLOY', [ true, 'Deploy: true. Undeploy: false', true]),

View File

@ -10,7 +10,6 @@ class Metasploit3 < Msf::Exploit::Remote
HttpFingerprint = { :pattern => [ /(Jetty|JBoss)/ ] } HttpFingerprint = { :pattern => [ /(Jetty|JBoss)/ ] }
include Msf::Exploit::Remote::HttpClient
include Msf::HTTP::JBoss include Msf::HTTP::JBoss
def initialize(info = {}) def initialize(info = {})
@ -83,14 +82,10 @@ class Metasploit3 < Msf::Exploit::Remote
register_options( register_options(
[ [
Opt::RPORT(8080), Opt::RPORT(8080),
OptString.new('USERNAME', [ false, 'The username to authenticate as' ]),
OptString.new('PASSWORD', [ false, 'The password for the specified username' ]),
OptString.new('JSP', [ false, 'JSP name to use without .jsp extension (default: random)', nil ]), OptString.new('JSP', [ false, 'JSP name to use without .jsp extension (default: random)', nil ]),
OptString.new('APPBASE', [ false, 'Application base name, (default: random)', nil ]), OptString.new('APPBASE', [ false, 'Application base name, (default: random)', nil ]),
OptString.new('PATH', [ true, 'The URI path of the JMX console', '/jmx-console' ]),
OptString.new('PACKAGE', [ true, 'The package containing the BSHDeployer service', 'auto' ]), OptString.new('PACKAGE', [ true, 'The package containing the BSHDeployer service', 'auto' ]),
OptEnum.new('VERB', [true, 'HTTP Method to use (for CVE-2010-0738)', 'POST', ['GET', 'POST', 'HEAD']]) OptEnum.new('VERB', [true, 'HTTP Method to use (for CVE-2010-0738)', 'POST', ['GET', 'POST', 'HEAD']])
], self.class) ], self.class)
end end
@ -206,7 +201,7 @@ class Metasploit3 < Msf::Exploit::Remote
end end
def query_serverinfo def query_serverinfo
path = normalize_uri(datastore['PATH'], '/HtmlAdaptor?action=inspectMBean&name=jboss.system:type=ServerInfo') path = normalize_uri(datastore['TARGETURI'], '/HtmlAdaptor?action=inspectMBean&name=jboss.system:type=ServerInfo')
res = send_request_raw( res = send_request_raw(
{ {
'uri' => path, 'uri' => path,