File tree Expand file tree Collapse file tree 1 file changed +5
-9
lines changed
modules/exploits/multi/http Expand file tree Collapse file tree 1 file changed +5
-9
lines changed Original file line number Diff line number Diff line change 1
1
#
2
- # This module requires Metasploit: http//metasploit.com/download
2
+ # This module requires Metasploit: http: //metasploit.com/download
3
3
# Current source: https://github.com/rapid7/metasploit-framework
4
4
##
5
5
@@ -22,19 +22,15 @@ def initialize(info = {})
22
22
sanitize inputs to some JBoss Expression Language expressions. As a
23
23
result, attackers can gain remote code execution through the
24
24
application server. This module leverages RCE to upload and execute
25
- a meterpreter payload.
25
+ a given payload.
26
26
27
- Versions of the JBoss AS admin-console are known to be vulnerable to
28
- this exploit, without requiring authentication. Tested against
29
- JBoss AS 5 and 6, running on Linux with JDKs 6 and 7.
27
+ Versions of the JBoss application server (AS) admin-console are
28
+ known to be vulnerable to this exploit, without requiring authentication.
29
+ Tested against JBoss AS 5 and 6, running on Linux with JDKs 6 and 7.
30
30
31
31
This module provides a more efficient method of exploitation - it
32
32
does not loop to find desired Java classes and methods.
33
33
34
- NOTE: the check for upload success is not 100% accurate.
35
- NOTE 2: The module uploads the meterpreter JAR and a JSP to launch
36
- it.
37
-
38
34
} ,
39
35
'Author' => [ 'vulp1n3 <vulp1n3[at]gmail.com>' ] ,
40
36
'References' =>
You can’t perform that action at this time.
0 commit comments