rapid7/metasploit-framework — pull request #3716 by wchen-r7 (2014-08-27 22:36:39+00:00)
Title: Glassfish LoginScanner update

This is an update on the Glassfish login module. Mainly it covers:

- New auth support for Glassfish 4
- Uses LoginScanner
- Can automatically switch from HTTP to HTTPS
- Updated information about the "authentication bypass"
- Other minor fixes

Tested targets during the update (Windows 2003, Windows 7, and Ubuntu):

* GlassFish Server Open Source Edition 4.0
* Oracle GlassFish Server 3.1
* Sun GlassFish Enterprise Server v2.1.1

Yes, it is a little annoying they sort of have different names.

## Verification steps for the latest version ##

**Setting up Glassfish:**

- [ ] Windows is easiest to set up, so get a Windows VM up and ready. Windows 2003 SP2 or Win 7 should be fine.
- [ ] Download and install JDK8: http://www.oracle.com/technetwork/java/javase/downloads/jdk8-downloads-2133151.html
- [ ] Download Glassfish 4: http://download.java.net/glassfish/4.0/release/glassfish-4.0.zip
- [ ] Extract glassfish-4.0.zip
- [ ] In command prompt, go to directory glassfish4\bin\
- [ ] Run ```asadmin```, which is the admin console.
- [ ] Enter ```start-domain domain1```
- [ ] Make sure that there's a port listening at 4848

If you prefer to set up your own domain (but you don't really have to), in asadmin, do this:

1. ```create-domain --adminport=4848 domain2```
2. You will be asked to set the username and password
3. ```start-domain domain2``` to start the domain.

To shut down a domain, here's how:

```stop-domain domain1```

**Test the module with Secure Admin off**

By default, Secure Admin is off, so you cannot login remotely. Let's test this and make sure the module is aware of this condition:

- [ ] Start msfconsole
- [ ] ```use auxiliary/scanner/http/glassfish_login```
- [ ] Set the appropriate options (rhosts, username, and password)
- [ ] ```Run```
- [ ] Make sure you see the message: "Secure Admin must be enabled to access the DAS remotely."

**Test the module with Secure Admin on**

- [ ] On the Glassfish box, open a browser, and then go to: http://localhost:4848
- [ ] Look at the menu on the left, those are the "Common Tasks". You should see an item that says "server (Admin Server)", click on that.
- [ ] You should see a button that says "Enable Secure Admin", click on that. If your Glassfish does not have a password, it will ask you to set that first before enabling Secure Admin.
- [ ] On the attack's box, use the browser to verify you can login remotely
- [ ] Run the glassfish_login module with the correct username/password, you should see a successful login attempt message
- [ ] Run the glassfish_login module with a bad password, you should NOT see the same successful login message

## Verification on an older version of Glassfish ##

If you want to verify on an older version, you can download them here:
https://glassfish.java.net/download-archive.html

Note that there's only 3.1.2.2 and 2.1.1. Version 3 ships with Java and is easier to install. Version 2 involves more manual work.

Since 2.1.1 involves more manual work, if you need the installation doc, you can get it here:
https://glassfish.java.net/downloads/v2.1.1-final.html