Fingerprints Web Manager 5.1 but no deployment option?

[anthonynena]

Identified a couple web managers (v5.1) that had default credentials.
When attempting to deploy, it says "No valid fingerprints to deploy".

I was able to deploy a WAR file manually through the web interface, so it should be possible to add a deployer to include in clusterd.

Is this a known issue, or am I doing something wrong?

I would be glad to help, by running my manual deployment through burp and providing you the HTTP traffic. Let me know.

Command and output below:

~/tools/clusterd# ./clusterd.py -i 127.0.0.1 -p 443 --ssl -a jboss -v5.1 --deploy ./src/lib/resources/cmd.war --usr-auth admin:admin

            clusterd/0.4 - clustered attack toolkit
                    [Supporting 7 platforms]

[2015-04-10 12:13PM] Started at 2015-04-10 12:13PM
[2015-04-10 12:13PM] Servers' OS hinted at windows
[2015-04-10 12:13PM] Fingerprinting host '127.0.0.1'
[2015-04-10 12:13PM] Server hinted at 'jboss'
[2015-04-10 12:13PM] Checking jboss version 5.1 JBoss Web Manager...
[2015-04-10 12:13PM] Checking jboss version 5.1 JBoss JMX Console...
[2015-04-10 12:13PM] Checking jboss version 5.1 JBoss Web Console...
[2015-04-10 12:13PM] Checking jboss version Any JBoss EJB Invoker Servlet...
[2015-04-10 12:13PM] Checking jboss version Any JBoss HTTP Headers (Unreliable)...
[2015-04-10 12:13PM] Checking jboss version Any JBoss JMX Invoker Servlet...
[2015-04-10 12:13PM] Checking jboss version Any JBoss RMI Interface...
[2015-04-10 12:13PM] Checking jboss version Any JBoss Status Page...
[2015-04-10 12:13PM] Matched 2 fingerprints for service jboss
[2015-04-10 12:13PM] JBoss Web Manager (version 5.1)
[2015-04-10 12:13PM] JBoss HTTP Headers (Unreliable) (version 5.0)
[2015-04-10 12:13PM] Fingerprinting completed.
[2015-04-10 12:13PM] No valid fingerprints were found to deploy.
[2015-04-10 12:13PM] Finished at 2015-04-10 12:13PM

[hatRiot]

Hey @anthonynena

Thanks for reporting this. The issue is that the JBoss Web Manager is different than the Web Console, and the deployment vector here is JBoss Seam 2. A recent metasploit module was released for exploiting this, but I somehow managed to implement every deployment vector under the sun except for this.

I'll be working on getting this implemented over the weekend, and will keep this open until then.

Thanks again!

[anthonynena]

Glad to help and that's awesome that you plan to add this deployment method so quickly.
If you get it done within the next few days, I can help test.

[hatRiot]

Travel killed my productivity on this, but I've got a working deployer for this finally. Will commit to dev tonight.

[hatRiot]

Committed. It appears that the Metasploit version of this doesn't work very well with 5.1. This is due to the way in which the admin console is actually deployed (in a cached temp directory).

This module should stabilize the exploit for 5.1 by instead writing to the ROOT deployment, then accessible from :8080/PAYLOAD.jsp. I've included support for the --invoke flag here as well.