Skip to content

Commit 1e6d895

Browse files
author
Tod Beardsley
committed
Description fixes on rapid7#4784, jboss exploit
Also, needed to run through msftidy. [See rapid7#4784]
1 parent e4d3888 commit 1e6d895

File tree

1 file changed

+5
-9
lines changed

1 file changed

+5
-9
lines changed

modules/exploits/multi/http/jboss_seam_upload_exec.rb

Lines changed: 5 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
#
2-
# This module requires Metasploit: http//metasploit.com/download
2+
# This module requires Metasploit: http://metasploit.com/download
33
# Current source: https://github.com/rapid7/metasploit-framework
44
##
55

@@ -22,19 +22,15 @@ def initialize(info = {})
2222
sanitize inputs to some JBoss Expression Language expressions. As a
2323
result, attackers can gain remote code execution through the
2424
application server. This module leverages RCE to upload and execute
25-
a meterpreter payload.
25+
a given payload.
2626
27-
Versions of the JBoss AS admin-console are known to be vulnerable to
28-
this exploit, without requiring authentication. Tested against
29-
JBoss AS 5 and 6, running on Linux with JDKs 6 and 7.
27+
Versions of the JBoss application server (AS) admin-console are
28+
known to be vulnerable to this exploit, without requiring authentication.
29+
Tested against JBoss AS 5 and 6, running on Linux with JDKs 6 and 7.
3030
3131
This module provides a more efficient method of exploitation - it
3232
does not loop to find desired Java classes and methods.
3333
34-
NOTE: the check for upload success is not 100% accurate.
35-
NOTE 2: The module uploads the meterpreter JAR and a JSP to launch
36-
it.
37-
3834
},
3935
'Author' => [ 'vulp1n3 <vulp1n3[at]gmail.com>' ],
4036
'References' =>

0 commit comments

Comments
 (0)