Module to query Jboss status servlet to collect sensitive information #2996

Merged
merged 4 commits into from Mar 28, 2014

Conversation

Projects
None yet
4 participants
@mcantoni
Contributor

mcantoni commented Feb 15, 2014

Name:
Jboss Status Servlet Info Gathering

Description:
This module queries the Jboss status servlet to collect sensitive
information: URL paths, GET parameters and the clients IP address.
This module has been tested against Jboss 4.0., 4.2.2, 4.2.3.

Note:
Useful during a penetration test. Code and description are free to be modified.

msftidy.rb: OK
Dork google: intitle:"Tomcat Status" "Total memory" (5.630 results)

Install Jboss:

wget http://sourceforge.net/projects/jboss/files/JBoss/JBoss-4.2.3.GA/jboss-4.2.3.GA.zip/download
unzip jboss-4.2.3.GA.zip
./run.sh -Djboss.bind.address= -Djboss.bind.address.management=

Demo (this it's only a fake example):

msf auxiliary(jboss_status) > show options

Module options (auxiliary/gather/jboss_status):

Name Current Setting Required Description


DELAY 5 no Delay in seconds between requests
PATH /status yes The Jboss status servlet URI path
Proxies no Use a proxy chain
REQCOUNT 3 no Number of HTTP requests
RHOSTS 1.2.3.4 yes The target address range or CIDR identifier
RPORT 8080 yes The target port
THREADS 1 yes The number of concurrent threads
VHOST no HTTP server virtual host

msf auxiliary(jboss_status) > set RHOSTS 1.2.3.4
RHOSTS => 1.2.3.4
msf auxiliary(jboss_status) > set REQCOUNT 3
REQCOUNT => 3
msf auxiliary(jboss_status) > set DELAY 5
DELAY => 5
msf auxiliary(jboss_status) > run

[] 1.2.3.4:8080 1/3 requests...
[
] 1.2.3.4:8080 sleeping for 5 seconds...
[] 1.2.3.4:8080 2/3 requests...
[
] 1.2.3.4:8080 sleeping for 5 seconds...
[] 1.2.3.4:8080 3/3 requests...
[
] 1.2.3.4:8080 sleeping for 5 seconds...
[+] 1.2.3.4:8080 JBoss application server!

[+] CLIENTS IP ADDRESSES:
[+] 4.3.2.1

[+] SERVER (VHOST) IP ADDRESSES:
[+] 1.2.3.4

[+] PATH REQUESTS:
[+] GET /status HTTP/1.1
[] Scanned 1 of 1 hosts (100% complete)
[
] Auxiliary module execution completed

@zeroSteiner

This comment has been minimized.

Show comment Hide comment
@zeroSteiner

zeroSteiner Feb 15, 2014

Contributor

This PR includes two modules, modules/auxiliary/gather/jboss_status.rb and modules/auxiliary/scanner/snmp/snmp_enum_hp_laserjet.rb Not sure if you meant to submit both as the description only mentions the JBoss module. If you meant to submit both, it would speed things along if they were broken into two separate pull requests so they can be tested individually.

Contributor

zeroSteiner commented Feb 15, 2014

This PR includes two modules, modules/auxiliary/gather/jboss_status.rb and modules/auxiliary/scanner/snmp/snmp_enum_hp_laserjet.rb Not sure if you meant to submit both as the description only mentions the JBoss module. If you meant to submit both, it would speed things along if they were broken into two separate pull requests so they can be tested individually.

@mcantoni

This comment has been minimized.

Show comment Hide comment
@mcantoni

mcantoni Feb 15, 2014

Contributor

Sorry, this PR is only for modules/auxiliary/gather/jboss_status.rb.
Now I have to figure out how to remove the module snmp_enum_hp_laserjet.rb :(
The latter already has a PR: #2919

Contributor

mcantoni commented Feb 15, 2014

Sorry, this PR is only for modules/auxiliary/gather/jboss_status.rb.
Now I have to figure out how to remove the module snmp_enum_hp_laserjet.rb :(
The latter already has a PR: #2919

@jvazquez-r7

This comment has been minimized.

Show comment Hide comment
@jvazquez-r7

jvazquez-r7 Mar 18, 2014

Contributor

@mcantoni you can use:

git rm modules/auxiliary/scanner/snmp/snmp_enum_hp_laserjet.rb

Then proceed with git commit and git push origin as usual to push the changes, so the pull request will be updated :) Hope it helps!

Contributor

jvazquez-r7 commented Mar 18, 2014

@mcantoni you can use:

git rm modules/auxiliary/scanner/snmp/snmp_enum_hp_laserjet.rb

Then proceed with git commit and git push origin as usual to push the changes, so the pull request will be updated :) Hope it helps!

@jvazquez-r7

This comment has been minimized.

Show comment Hide comment
@jvazquez-r7

jvazquez-r7 Mar 28, 2014

Contributor

Processing....

Contributor

jvazquez-r7 commented Mar 28, 2014

Processing....

@jvazquez-r7 jvazquez-r7 self-assigned this Mar 28, 2014

jvazquez-r7 added a commit that referenced this pull request Mar 28, 2014

@jvazquez-r7 jvazquez-r7 merged commit fbcd661 into rapid7:master Mar 28, 2014

1 check passed

default The Travis CI build passed
Details
@jvazquez-r7

This comment has been minimized.

Show comment Hide comment
@jvazquez-r7

jvazquez-r7 Mar 28, 2014

Contributor

Hi @mcantoni,

Landed it after several modifications, check final result here: 9374777

( deleted the RETRY thing because doesn't look super useful, if you need to keep the module pinging a machine or a set of machines, worths to add automation maybe through a rc file).

After changes, working successfully:

msf > use auxiliary/scanner/http/jboss_status 
msf auxiliary(jboss_status) > set rhosts 192.168.172.134
rhosts => 192.168.172.134
msf auxiliary(jboss_status) > run

[+] 192.168.172.134:8080 JBoss application server found

JBoss application server requests
=================================

 Client         Vhost target     Request
 ------         ------------     -------
 192.168.172.1  192.168.172.134  GET /status HTTP/1.1

[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(jboss_status) > notes
[*] Time: 2014-03-28 20:59:37 UTC Note: host=192.168.172.134 service=http type=JBoss application server info data="192.168.172.134:8080 GET /status HTTP/1.1"
msf auxiliary(jboss_status) > services

Services
========

host             port  proto  name  state  info
----             ----  -----  ----  -----  ----
192.168.172.134  8080  tcp    http  open   Apache-Coyote/1.1 ( Powered by Servlet 2.4; JBoss-4.2.3.GA (build: SVNTag=JBoss_4_2_3_GA date=200807181417)/JBossWeb-2.0 )

Thanks @mcantoni !

Contributor

jvazquez-r7 commented Mar 28, 2014

Hi @mcantoni,

Landed it after several modifications, check final result here: 9374777

( deleted the RETRY thing because doesn't look super useful, if you need to keep the module pinging a machine or a set of machines, worths to add automation maybe through a rc file).

After changes, working successfully:

msf > use auxiliary/scanner/http/jboss_status 
msf auxiliary(jboss_status) > set rhosts 192.168.172.134
rhosts => 192.168.172.134
msf auxiliary(jboss_status) > run

[+] 192.168.172.134:8080 JBoss application server found

JBoss application server requests
=================================

 Client         Vhost target     Request
 ------         ------------     -------
 192.168.172.1  192.168.172.134  GET /status HTTP/1.1

[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(jboss_status) > notes
[*] Time: 2014-03-28 20:59:37 UTC Note: host=192.168.172.134 service=http type=JBoss application server info data="192.168.172.134:8080 GET /status HTTP/1.1"
msf auxiliary(jboss_status) > services

Services
========

host             port  proto  name  state  info
----             ----  -----  ----  -----  ----
192.168.172.134  8080  tcp    http  open   Apache-Coyote/1.1 ( Powered by Servlet 2.4; JBoss-4.2.3.GA (build: SVNTag=JBoss_4_2_3_GA date=200807181417)/JBossWeb-2.0 )

Thanks @mcantoni !

@wvu-r7

This comment has been minimized.

Show comment Hide comment
@wvu-r7

wvu-r7 Mar 28, 2014

Contributor

@mcantoni: You left f18fef1 and 7c860b9, so GitHub thinks #2919 has been merged.

Contributor

wvu-r7 commented Mar 28, 2014

@mcantoni: You left f18fef1 and 7c860b9, so GitHub thinks #2919 has been merged.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment