The Full Daytona Package -- By Kingcope

vendor:

N/A

by:

Kingcope

7.5

CVSS

HIGH

Authentication Bypass

287

CWE

Product Name: N/A

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows, Linux, Mac

2011

The Full Daytona Package — By Kingcope

The Full Daytona Package is a collection of three JBoss Application Server remote exploits with authentication bypass, ported from Metasploit and beefed up with two scanners: PNSCAN with SSL support and SYNSCAN modded. The remote exploits are best used with daytona_bsh.pl, while the SSL support is provided for the remote exploits with daytona_bsh_ssl.pl, daytona_deployfile_ssl.pl, and daytona_maindeploy_ssl.pl. The SYNSCAN is modded for scanning JBoss (X-Powered-By TAG) on port 8080 only, while the original Parallel Network Scanner (PNSCAN) is modded to support SSL. Usage: ./pnscan -r JBoss -w “HEAD / HTTP/1.0” 10.10.0.0/16 443.

Mitigation:

Ensure that authentication is properly implemented and enforced for all JBoss Application Server components.

Source

Exploit-DB raw data:

THE FULL DAYTONA PACKAGE -- BY KINGCOPE, YEAR 2011
THREE JBOSS APPLICATION SERVER REMOTE EXPLOITS WITH AUTHEN BYPASS
PORTED FROM METASPLOIT AND BEEFED UP WITH TWO SCANNERS:
*PNSCAN W/ SSL SUPPORT
*SYNSCAN MODDED

FILES:
      * daytona_bsh.pl, daytona_deployfile.pl, daytona_maindeploy.pl
        THE REMOTE EXPLOITS, BEST OF USE IS daytona_bsh.pl

      * daytona_bsh_ssl.pl, daytona_deployfile_ssl.pl, daytona_maindeploy_ssl.pl
        SSL SUPPORT FOR THE REMOTE EXPLOITS

      * synscan-modded.tar
        THE SYNSCAN IS MODDED FOR SCANNING JBOSS (X-Powered-By TAG) ON PORT 8080 ONLY.

      * pnscan-1.11.tar.gz
        ORIGINAL PARALLEL NETWORK SCANNER (NO CREDITS HERE)

      * pnscan-1.11-ssl.tar
        PARALLEL NETWORK SCANNER MODDED TO SUPPORT SSL
        USAGE: ./pnscan -r JBoss -w "HEAD / HTTP/1.0" 10.10.0.0/16 443

CHEERS,
KINGCOPE

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17977.tar.bz2 (DAYTONA_FULL.tar.bz2)