Skip to content

Commit 58c1f6f

Browse files
mdisecmdisec
committed
Merge branch 'master' of https://github.com/rapid7/metasploit-framework into trend_micro_imsva_exec
2 parents c2c352c + 5d08e0b commit 58c1f6f

File tree

21 files changed

+685
-127
lines changed

21 files changed

+685
-127
lines changed

‎COPYING

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
Copyright (C) 2006-2016, Rapid7, Inc.
1+
Copyright (C) 2006-2017, Rapid7, Inc.
22
All rights reserved.
33

44
Redistribution and use in source and binary forms, with or without modification,

‎Gemfile.lock

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
PATH
22
remote: .
33
specs:
4-
metasploit-framework (4.13.15)
4+
metasploit-framework (4.13.16)
55
actionpack (~> 4.2.6)
66
activerecord (~> 4.2.6)
77
activesupport (~> 4.2.6)
@@ -103,7 +103,7 @@ GEM
103103
thor (~> 0.19)
104104
bcrypt (3.1.11)
105105
bit-struct (0.15.0)
106-
builder (3.2.2)
106+
builder (3.2.3)
107107
capybara (2.11.0)
108108
addressable
109109
mime-types (>= 1.16)
@@ -132,7 +132,7 @@ GEM
132132
nokogiri (~> 1.5)
133133
railties (>= 3, < 5.1)
134134
cucumber-wire (0.0.1)
135-
diff-lcs (1.2.5)
135+
diff-lcs (1.3)
136136
docile (1.1.5)
137137
erubis (2.7.0)
138138
factory_girl (4.8.0)
@@ -142,13 +142,13 @@ GEM
142142
railties (>= 3.0.0)
143143
faraday (0.11.0)
144144
multipart-post (>= 1.2, < 3)
145-
ffi (1.9.16)
145+
ffi (1.9.17)
146146
filesize (0.1.1)
147147
fivemat (1.3.2)
148148
gherkin (4.0.0)
149149
i18n (0.7.0)
150-
jsobfu (0.4.1)
151-
rkelly-remix (= 0.0.6)
150+
jsobfu (0.4.2)
151+
rkelly-remix
152152
json (1.8.6)
153153
loofah (2.0.3)
154154
nokogiri (>= 1.5.9)
@@ -234,7 +234,7 @@ GEM
234234
thor (>= 0.18.1, < 2.0)
235235
rake (12.0.0)
236236
rb-readline-r7 (0.5.2.0)
237-
recog (2.1.3)
237+
recog (2.1.4)
238238
nokogiri
239239
redcarpet (3.4.0)
240240
rex-arch (0.1.4)
@@ -257,7 +257,7 @@ GEM
257257
rex-encoder
258258
rex-text
259259
rex-java (0.1.3)
260-
rex-mime (0.1.1)
260+
rex-mime (0.1.3)
261261
rex-text
262262
rex-nop (0.1.0)
263263
rex-arch
@@ -275,14 +275,14 @@ GEM
275275
rex-text
276276
rex-socket (0.1.3)
277277
rex-core
278-
rex-sslscan (0.1.1)
278+
rex-sslscan (0.1.2)
279279
rex-socket
280280
rex-text
281281
rex-struct2 (0.1.0)
282-
rex-text (0.2.10)
282+
rex-text (0.2.11)
283283
rex-zip (0.1.1)
284284
rex-text
285-
rkelly-remix (0.0.6)
285+
rkelly-remix (0.0.7)
286286
robots (0.10.1)
287287
rspec-core (3.5.4)
288288
rspec-support (~> 3.5.0)
@@ -323,10 +323,10 @@ GEM
323323
thread_safe (~> 0.1)
324324
tzinfo-data (1.2016.10)
325325
tzinfo (>= 1.0.0)
326-
windows_error (0.0.2)
326+
windows_error (0.1.0)
327327
xpath (2.0.0)
328328
nokogiri (~> 1.3)
329-
yard (0.9.7)
329+
yard (0.9.8)
330330

331331
PLATFORMS
332332
ruby

‎LICENSE

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ Format: http://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
22
Source: http://www.metasploit.com/
33

44
Files: *
5-
Copyright: 2006-2016, Rapid7, Inc.
5+
Copyright: 2006-2017, Rapid7, Inc.
66
License: BSD-3-clause
77

88
# The Metasploit Framework is provided under the 3-clause BSD license provided

‎data/post/zip/zip.js

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
/*
2+
* Original technique from http://naterice.com/zip-and-unzip-files-using-the-windows-shell-and-vbscript/
3+
*/
4+
5+
function create_zip(dst)
6+
{
7+
var header = "\x50\x4b\x05\x06" +
8+
"\x00\x00\x00\x00\x00\x00\x00\x00\x00" +
9+
"\x00\x00\x00\x00\x00\x00\x00\x00\x00";
10+
11+
/*
12+
* Trick to write a binary file regardless of the system locale
13+
*/
14+
var outw = new ActiveXObject("ADODB.Stream");
15+
outw.Type = 2;
16+
outw.Open();
17+
outw.WriteText(header);
18+
outw.Position = 0;
19+
20+
var outa = new ActiveXObject("ADODB.Stream");
21+
outa.Type = 2;
22+
outa.Charset = "windows-1252";
23+
outa.Open()
24+
25+
outw.CopyTo(outa);
26+
outa.SaveToFile(dst, 2);
27+
28+
outw.Close();
29+
outa.Close();
30+
}
31+
32+
function basename(path)
33+
{
34+
var a = path.split("\\");
35+
var b = a.slice(-1);
36+
return b[0];
37+
}
38+
39+
function fileeq(a, b)
40+
{
41+
return basename(a).toLowerCase() == basename(b).toLowerCase();
42+
}
43+
44+
function zip(src, dst)
45+
{
46+
var shell = new ActiveXObject('Shell.Application');
47+
var fso = new ActiveXObject('Scripting.FileSystemObject');
48+
49+
/*
50+
* Normalize paths, required by the shell commands
51+
*/
52+
src = fso.GetAbsolutePathName(src);
53+
dst = fso.GetAbsolutePathName(dst);
54+
55+
/*
56+
* Create an empty zip file if necessary
57+
*/
58+
if (!fso.FileExists(dst)) {
59+
create_zip(dst);
60+
}
61+
62+
/*
63+
* Check for duplicates
64+
*/
65+
var zipfile = shell.Namespace(dst);
66+
var files = zipfile.items();
67+
var count = files.Count;
68+
for (var i = 0; i < files.Count; i++) {
69+
if (fileeq(files.Item(i).Name, src)) {
70+
return;
71+
}
72+
}
73+
74+
zipfile.CopyHere(src);
75+
76+
/*
77+
* Wait for completion, but data can be stale on network shares, so we
78+
* abort after 5 seconds.
79+
*/
80+
var max_tries = 50;
81+
while (count == zipfile.items().Count) {
82+
WScript.Sleep(100);
83+
if (max_tries-- == 0) {
84+
return;
85+
}
86+
}
87+
}

‎data/post/zip/zip.vbs

Lines changed: 0 additions & 62 deletions
This file was deleted.

‎documentation/modules/auxiliary/admin/http/tomcat_administration.md

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
## Vulnerable Application
2+
3+
The administrator application was removed as of Tomcat 6. Tomcat 5.5.36 is available from [apache](https://archive.apache.org/dist/tomcat/tomcat-5/v5.5.36/). This does not have the `admin` app bundled though, and can be downloaded [here](https://archive.apache.org/dist/tomcat/tomcat-5/v5.5.36/bin/apache-tomcat-5.5.36-admin.zip).
4+
5+
To utilize the `admin` application, a user must have the permission `admin` applied to their account. The following user line will handle all necessary permissions:
6+
7+
```
8+
<user username="tomcat" password="tomcat" roles="admin"/>
9+
```
10+
11+
## Verification Steps
12+
13+
1. Install Tomcat 5.5 or older
14+
2. Install the admin app
15+
3. Start msfconsole
16+
4. Do: ```use auxiliary/admin/http/tomcat_administration```
17+
5. Do: ```set rhosts [ips]```
18+
6. Do: ```set tomcat_user [username]```
19+
7. Do: ```set tomcat_pass [username]```
20+
8. Do: ```set rport [port]```
21+
9. Do: ```run```
22+
10. Find all the Tomcat admin portals
23+
24+
## Options
25+
26+
**rport**
27+
28+
The default is set to `8180`, which is only default on FreeBSD. All other operating systems, and the software itself, default to `8080`.
29+
30+
## Scenarios
31+
32+
Example run against Tomcat 5.5.36 with admin module installed against Windows XP
33+
34+
```
35+
msf > use auxiliary/admin/http/tomcat_administration
36+
msf auxiliary(tomcat_administration) > set rport 8085
37+
rport => 8085
38+
msf auxiliary(tomcat_administration) > set rhosts 192.168.2.108
39+
rhosts => 192.168.2.108
40+
msf auxiliary(tomcat_administration) > set verbose true
41+
verbose => true
42+
msf auxiliary(tomcat_administration) > set tomcat_pass tomcat
43+
tomcat_pass => tomcat
44+
msf auxiliary(tomcat_administration) > set tomcat_user tomcat
45+
tomcat_user => tomcat
46+
msf auxiliary(tomcat_administration) > run
47+
48+
[*] http://192.168.2.108:8085/admin [Apache-Coyote/1.1] [Apache Tomcat/5.5.36] [Tomcat Server Administration] [tomcat/tomcat]
49+
[*] Scanned 1 of 1 hosts (100% complete)
50+
[*] Auxiliary module execution completed
51+
```

0 commit comments

Comments
 (0)