jetlib.sec » Carnal0wnage » Hacking Unprotected JBOSS JMX Console Installations

Feeds

133019 items (0 unread) in 27 feeds

• 1337day (was: Inj3ct0r, 1337db)
• OSVDB Vulnerabilities
• Exploit-DB
• SecurityFocus Vulnerabilities
• Bugtraq
• Full Disclosure
• XSSed
• Packet Storm Security Headlines
• Packet Storm Security Advisories
• Packet Storm Security Exploits
• Packet Storm Security Recent Files
• Packet Storm Security Tools
• Packet Storm Security Misc. Files
• Sophos security news
• Sophos product advisories
• Penetration Testing
• SecuriTeam
• BackTrack Linux Forums
• Threatpost
• SecDocs
• carnal0wnage.attackresearch.com
• Carnal0wnage
• Kernel Fun
• Darknet
• The Exploitant
• Hack a Day
• Wirevolution

Carnal0wnage

• November 30, 2009
• 

  Hacking Unprotected JBOSS JMX Console Installations

  Posted: November 30th, 2009, 7:00am PST by CG

  Tags:   

  Nothing new, notes for later, actually got most of the info from:
  
  http://www.notsosecure.com/folder2/2009/10/27/hacking-jboss-with-jmx-console/
  [goohackle.com]
  [www.nruns.com]
  
  The pdf (last link) actually details all the steps to get it done.
  
  Google Dorks
  
  intitle:”jboss management console” “application server” version inurl:”web-console”
  
  intitle:”JBoss Management Console – Server Information” “application server” inurl:”web-console” OR inurl:”jmx-console”
  
  Those searches will lead you to
  
  http://somecrappysite.com/web-console/ServerInfo.jsp
  
  will all kinds of fun information like below:
  
  
  switch the URL to
  
  http://somecrappysite.com/jmx-console/
  
  and you'll either be greeted with a password prompt box (good) or the JMX Console page (not good--least for them)
  
  Good
  
  Bad
  
  Very Bad
  
  From there, just add the link to your cmd shell wrapped up in a war file. (check pdf for screenshot)
  
  need to turn your .jsp into a .war?
  
  jar -cf meh.war meh.jsp
  
  From there enjoy access to your jsp shell.
  
  Todo: Kick the shell to an msf instance via the msf jsp reverse shell