CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!
CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!
Path: blob/master/documentation/modules/exploit/linux/smtp/apache_james_exec.md
Views: 1904
Vulnerable Application
This module exploits a vulnerability that exists due to a lack of input validation when creating a user in Apache James 2.3.2. By creating a user with a directory traversal payload as the username, commands can be written to a given directory/file. Instructions for installing the vulnerable application for testing can be found here: https://www.exploit-db.com/docs/english/40123-exploiting-apache-james-server-2.3.2.pdf
Verification Steps
1. Start msfconsole
2. DO: Load module exploit/linux/smtp/apache_james_exec
3. DO: Set the remote and local options: rhosts, lhosts, lport
4. DO: Set the preferred payload
5. DO: Run the check method to determine vulnerability
6. DO: Run the exploit
7. The payload will connect to the listener if the exploit is successful
Options
USERNAME: The administrator username for Apache James 2.3.2 remote administration tool. By default this is 'root'.
PASSWORD: The administrator password for Apache James 2.3.2 remote administration tool. By default this is 'root'.
ADMINPORT: The port for Apache James 2.3.2 remote administration tool. By default this is '4555'.
RHOSTS: The IP address of the vulnerable server.
RPORT: The port number of the SMTP service.
POP3PORT The port for the POP3 Apache James Service. By default this '110'.
Scenarios
If using Cron exploitation method: This method allows for automatic execution of the payload with no user interaction required and gives the attacker root privileges. It will also attempt to automatically cleanup the malicious user and the mail objects.
1. Load the module:
2. Set remote and local options:
3. Set payload:
4. Check version and run exploit:
If using Bash Completion: This method may be preferable if targeting a linux operating system such as some versions of Ubuntu that fails to run the cron method for exploitation. This exploitation method will leave an Apache James mail object artifact in the /etc/bash_completion.d directory and the malicious user account.
1. Load the module:
2. Set remote and local options:
3. Set payload:
4. Check version and run exploit:
5. Set up and run listener (Can be done before running exploit):