Auditing and exploiting vulnerabilities with JexBoss

JexBoss is a tool written in python that helps us audit and exploit vulnerabilities in JBoss Application Server and other Java platforms, Frameworks, Applications, etc.

Exploitation Vectors:

• /admin-console
  • tested and working in JBoss versions 5 and 6
• /jmx-console
  • tested and working in JBoss versions 4, 5 and 6
• /web-console/Invoker
  • tested and working in JBoss versions 4, 5 and 6
• /invoker/JMXInvokerServlet
  • tested and working in JBoss versions 4, 5 and 6
• Application Deserialization
  • tested and working against multiple java applications, platforms, etc, via HTTP POST Parameters
• Servlet Deserialization
  • tested and working against multiple java applications, platforms, etc, via servlets that process serialized objects (e.g. when you see an "Invoker" in a link)
• Apache Struts2 CVE-2017-5638
  • tested in Apache Struts 2 applications
• Others

Installing JexBoss

git clone https://github.com/joaomatosf/jexboss.git

cd jexboss

pip install -r requires.txt

We start…

To start the audit we simply execute the following command and it will begin to check the application:

python jexboss.py -u https://red-orbita.com

As we can see in this example, it exploits a web-console vulnerability and creates a reverse shell.

A very interesting option is –auto-exploit with which we can create a persistent reverse shell. In this example, as we can see, a jmxinvokerservlet bug explodes.

We can also perform a scan of an entire network and self-exploitation.

python jexboss.py -mode auto-scan -A -network 192.168.0.0/24 -ports 8080 -results results.txt

more information:

https://github.com/joaomatosf/jexboss

all the best.

:wq!