RageLtMan
074120a2d3
Using the infrastructure developped for use in the log4shell HTTP scanner, implement a basic HTTP exploit module which performs the same action as the scanner does per-host on a specific target; but instead of logging the vulnerability, return a crafted LDAP search response containing the payload encoded within the search response. The crux of this effort lies in payload generation, specifically in crafting the legal LDAP response packet out of the request data and generated JAR-format payload. The payload selection is based on an offline discussion with @Mihi during which he indicated JNDI's ability to load JARs in the same way as raw Java classes. This assumption/interpretation on my part may be incorrect. At present, the delivered LDAP search response appears to be valid in WireShark, and the vulnerable test docker is showing internal values in its console output a la: ``` Received a request for API version com.sun.jndi.ldap.LdapCtx@3575a ``` which shows that it is processing the response on its end, just not in the way we would prefer, yet. This may be a result of how the MSF payload is being shuffled and mutated by the packet construction method, or a mistake in the way i pass in the queried base DN or execute the LDAP search response transaction. Testing: fails currently for aforementioned reason TODO: figure out how to encode the payload/LDAP response correctly continue testing until verified and upstreamed
Metasploit 
The Metasploit Framework is released under a BSD-style license. See COPYING for more details.
The latest version of this software is available from: https://metasploit.com
Bug tracking and development information can be found at: https://github.com/rapid7/metasploit-framework
New bugs and feature requests should be directed to: https://r-7.co/MSF-BUGv1
API documentation for writing modules can be found at: https://rapid7.github.io/metasploit-framework/api
Questions and suggestions can be sent to: Freenode IRC channel or e-mail the metasploit-hackers mailing list
Installing
Generally, you should use the free installer, which contains all of the dependencies and will get you up and running with a few clicks. See the Dev Environment Setup if you'd like to deal with dependencies on your own.
Using Metasploit
Metasploit can do all sorts of things. The first thing you'll want to do
is start msfconsole, but after that, you'll probably be best served by
reading Metasploit Unleashed, the great community
resources, or the wiki.
Contributing
See the Dev Environment Setup guide on GitHub, which will walk you through the whole process from installing all the dependencies, to cloning the repository, and finally to submitting a pull request. For slightly more information, see Contributing.