rapid7/metasploit-framework — pull request #2996 by mcantoni (2014-02-15 16:52:51+00:00)
Title: Module to query Jboss status servlet to collect sensitive information

Name:
Jboss Status Servlet Info Gathering

Description:
This module queries the Jboss status servlet to collect sensitive
information: URL paths, GET parameters and the clients IP address.
This module has been tested against Jboss 4.0., 4.2.2, 4.2.3.

Note:
Useful during a penetration test. Code and description are free to be modified.

msftidy.rb: OK
Dork	google: intitle:"Tomcat Status" "Total memory" (5.630 results)

Install Jboss:

wget http://sourceforge.net/projects/jboss/files/JBoss/JBoss-4.2.3.GA/jboss-4.2.3.GA.zip/download
unzip jboss-4.2.3.GA.zip
./run.sh -Djboss.bind.address= -Djboss.bind.address.management=

Demo (this it's only a fake example):

msf auxiliary(jboss_status) > show options

Module options (auxiliary/gather/jboss_status):

Name Current Setting Required Description
---- --------------- -------- -----------
DELAY 5 no Delay in seconds between requests
PATH /status yes The Jboss status servlet URI path
Proxies no Use a proxy chain
REQCOUNT 3 no Number of HTTP requests
RHOSTS 1.2.3.4 yes The target address range or CIDR identifier
RPORT 8080 yes The target port
THREADS 1 yes The number of concurrent threads
VHOST no HTTP server virtual host

msf auxiliary(jboss_status) > set RHOSTS 1.2.3.4
RHOSTS => 1.2.3.4
msf auxiliary(jboss_status) > set REQCOUNT 3
REQCOUNT => 3
msf auxiliary(jboss_status) > set DELAY 5
DELAY => 5
msf auxiliary(jboss_status) > run

[*] 1.2.3.4:8080 1/3 requests...
[*] 1.2.3.4:8080 sleeping for 5 seconds...
[*] 1.2.3.4:8080 2/3 requests...
[*] 1.2.3.4:8080 sleeping for 5 seconds...
[*] 1.2.3.4:8080 3/3 requests...
[*] 1.2.3.4:8080 sleeping for 5 seconds...
[+] 1.2.3.4:8080 JBoss application server!

[+] CLIENTS IP ADDRESSES:
[+] 4.3.2.1

[+] SERVER (VHOST) IP ADDRESSES:
[+] 1.2.3.4

[+] PATH REQUESTS:
[+] GET /status HTTP/1.1
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed