rapid7/metasploit-framework — pull request #749 by h0ng10 (2012-09-03 18:55:56+00:00)
Title: Exploit: JBoss Deployfilerepository over JMXInvokerServlet

Short description:
This module can be used to execute a payload on JBoss servers that have an exposed
"JMXInvokerServlet". By invoking the methods provided by jboss.admin:DeploymentFileRepository
a stager is deployed which is then used to upload the selected payload to the target.

The DeploymentFileRepository methods are only available on Jboss 4.x and 5.x. which is still
commonly used.

The JMXInvokerServlet is often ignored when the JBoss server is hardened. Therefore this
exploit can be used for targets that have a secured/password protected JMX-Console.

JBoss uses his own serialization protocol that differs from the normal JAVA protocol.
To communicate with the target, a couple of preserialized requests is used. Most people
believe that the protocol changes from version to version however as far as I can tell this
is only the case for major JBoss releases.

As long as the uploaded file doesn't exeed a certain size limit, the serialization doesn't modify it.
Therefore the code of the stager jsp can be changed inside the module.

This module was tested with the following JBoss versions:
JBoss-4.0.5.GA (Ubuntu 11.04/ Windows 2003)
JBoss-4.2.1.GA (Ubuntu 11.04/ Windows 2003)
JBoss-4.2.3.GA (Ubuntu 11.04/ Windows 2003)
JBoss-5.0.1.GA (Ubuntu 11.04/ Windows 2003)
JBoss-5.1.0.GA (Ubuntu 11.04/ Windows 2003)