Refactored Jboss mixin
Moved TARGETURI option to the JBoss mixin. The mixin now includes Msf::Exploit::Remote::HttpClient which provides USERNAME and PASSWORDbug/bundler_fix
parent
088f208c7c
commit
ae2cd63391
|
@ -7,11 +7,16 @@ module Msf
|
||||||
require 'msf/http/jboss/base'
|
require 'msf/http/jboss/base'
|
||||||
require 'msf/http/jboss/bsh'
|
require 'msf/http/jboss/bsh'
|
||||||
|
|
||||||
|
include Msf::Exploit::Remote::HttpClient
|
||||||
include Msf::HTTP::JBoss::Base
|
include Msf::HTTP::JBoss::Base
|
||||||
include Msf::HTTP::JBoss::BSH
|
include Msf::HTTP::JBoss::BSH
|
||||||
|
|
||||||
def initialize(info = {})
|
def initialize(info = {})
|
||||||
super
|
super
|
||||||
|
register_options(
|
||||||
|
[
|
||||||
|
OptString.new('TARGETURI', [ true, 'The URI path of the JMX console', '/jmx-console'])
|
||||||
|
], self.class)
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
|
@ -134,13 +134,13 @@ EOT
|
||||||
if (datastore['VERB']== "POST")
|
if (datastore['VERB']== "POST")
|
||||||
res = send_request_cgi({
|
res = send_request_cgi({
|
||||||
'method' => datastore['VERB'],
|
'method' => datastore['VERB'],
|
||||||
'uri' => normalize_uri(datastore['PATH'], '/HtmlAdaptor'),
|
'uri' => normalize_uri(datastore['TARGETURI'], '/HtmlAdaptor'),
|
||||||
'data' => params
|
'data' => params
|
||||||
})
|
})
|
||||||
else
|
else
|
||||||
res = send_request_cgi({
|
res = send_request_cgi({
|
||||||
'method' => datastore['VERB'],
|
'method' => datastore['VERB'],
|
||||||
'uri' => normalize_uri(datastore['PATH'], '/HtmlAdaptor') + "?#{params}"
|
'uri' => normalize_uri(datastore['TARGETURI'], '/HtmlAdaptor') + "?#{params}"
|
||||||
}, 30)
|
}, 30)
|
||||||
end
|
end
|
||||||
res
|
res
|
||||||
|
|
|
@ -7,7 +7,6 @@ require 'msf/core'
|
||||||
|
|
||||||
class Metasploit3 < Msf::Auxiliary
|
class Metasploit3 < Msf::Auxiliary
|
||||||
|
|
||||||
include Msf::Exploit::Remote::HttpClient
|
|
||||||
include Msf::HTTP::JBoss
|
include Msf::HTTP::JBoss
|
||||||
|
|
||||||
def initialize
|
def initialize
|
||||||
|
@ -38,11 +37,8 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
register_options(
|
register_options(
|
||||||
[
|
[
|
||||||
Opt::RPORT(8080),
|
Opt::RPORT(8080),
|
||||||
OptString.new('USERNAME', [ false, 'The username to authenticate as' ]),
|
|
||||||
OptString.new('PASSWORD', [ false, 'The password for the specified username' ]),
|
|
||||||
OptString.new('APPBASE', [ true, 'Application base name']),
|
OptString.new('APPBASE', [ true, 'Application base name']),
|
||||||
OptString.new('STAGERNAME', [ false, 'Only used if VERB is not POST (default: "stager"', 'stager']),
|
OptString.new('STAGERNAME', [ false, 'Only used if VERB is not POST (default: "stager"', 'stager']),
|
||||||
OptString.new('PATH', [ true, 'The URI path of the JMX console', '/jmx-console' ]),
|
|
||||||
OptString.new('PACKAGE', [ true, 'The package containing the BSHDeployer service', 'auto' ]),
|
OptString.new('PACKAGE', [ true, 'The package containing the BSHDeployer service', 'auto' ]),
|
||||||
OptString.new('WARFILE', [ true, 'The WAR file to deploy']),
|
OptString.new('WARFILE', [ true, 'The WAR file to deploy']),
|
||||||
OptBool.new('DEPLOY', [ true, 'Deploy: true. Undeploy: false', true]),
|
OptBool.new('DEPLOY', [ true, 'Deploy: true. Undeploy: false', true]),
|
||||||
|
|
|
@ -10,7 +10,6 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||||
|
|
||||||
HttpFingerprint = { :pattern => [ /(Jetty|JBoss)/ ] }
|
HttpFingerprint = { :pattern => [ /(Jetty|JBoss)/ ] }
|
||||||
|
|
||||||
include Msf::Exploit::Remote::HttpClient
|
|
||||||
include Msf::HTTP::JBoss
|
include Msf::HTTP::JBoss
|
||||||
|
|
||||||
def initialize(info = {})
|
def initialize(info = {})
|
||||||
|
@ -83,14 +82,10 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||||
register_options(
|
register_options(
|
||||||
[
|
[
|
||||||
Opt::RPORT(8080),
|
Opt::RPORT(8080),
|
||||||
OptString.new('USERNAME', [ false, 'The username to authenticate as' ]),
|
|
||||||
OptString.new('PASSWORD', [ false, 'The password for the specified username' ]),
|
|
||||||
OptString.new('JSP', [ false, 'JSP name to use without .jsp extension (default: random)', nil ]),
|
OptString.new('JSP', [ false, 'JSP name to use without .jsp extension (default: random)', nil ]),
|
||||||
OptString.new('APPBASE', [ false, 'Application base name, (default: random)', nil ]),
|
OptString.new('APPBASE', [ false, 'Application base name, (default: random)', nil ]),
|
||||||
OptString.new('PATH', [ true, 'The URI path of the JMX console', '/jmx-console' ]),
|
|
||||||
OptString.new('PACKAGE', [ true, 'The package containing the BSHDeployer service', 'auto' ]),
|
OptString.new('PACKAGE', [ true, 'The package containing the BSHDeployer service', 'auto' ]),
|
||||||
OptEnum.new('VERB', [true, 'HTTP Method to use (for CVE-2010-0738)', 'POST', ['GET', 'POST', 'HEAD']])
|
OptEnum.new('VERB', [true, 'HTTP Method to use (for CVE-2010-0738)', 'POST', ['GET', 'POST', 'HEAD']])
|
||||||
|
|
||||||
], self.class)
|
], self.class)
|
||||||
end
|
end
|
||||||
|
|
||||||
|
@ -206,7 +201,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||||
end
|
end
|
||||||
|
|
||||||
def query_serverinfo
|
def query_serverinfo
|
||||||
path = normalize_uri(datastore['PATH'], '/HtmlAdaptor?action=inspectMBean&name=jboss.system:type=ServerInfo')
|
path = normalize_uri(datastore['TARGETURI'], '/HtmlAdaptor?action=inspectMBean&name=jboss.system:type=ServerInfo')
|
||||||
res = send_request_raw(
|
res = send_request_raw(
|
||||||
{
|
{
|
||||||
'uri' => path,
|
'uri' => path,
|
||||||
|
|
Loading…
Reference in New Issue