Apache Tomcat / JBoss EJBInvokerServlet / JMXInvokerServlet Code Execution

php 9sgejb.php 192.168.0.1 id HTTP/1.1 200 OK Server: Apache-Coyote/1.1 X-Powered-By: Servlet 2.4; JBoss-4.0.5.GA build: CVSTag=Branch40 date=2006101 62339/Tomcat-5.5 Set-Cookie: JSESSIONID=E9EEE1D6AD27D64ED3835C1092C4FC29; Path=/ Content-Type: text/html;charset=ISO-8859-1 Content-Length: 43 Date...

Apache Tomcat/JBoss EJBInvokerServlet / JMXInvokerServlet (RMI over HTTP) Marshalled Object - Remote Code Execution

php 9sgejb.php 192.168.0.1 id HTTP/1.1 200 OK Server: Apache-Coyote/1.1 X-Powered-By: Servlet 2.4; JBoss-4.0.5.GA build: CVSTag=Branch40 date=2006101 62339/Tomcat-5.5 Set-Cookie: JSESSIONID=E9EEE1D6AD27D64ED3835C1092C4FC29; Path=/ Content-Type: text/html;charset=ISO-8859-1 Content-Length: 43 Date...

Design/Logic Flaw

HP ProCurve Manager PCM 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager IDM 4.0, and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled object to 1 EJBInvokerServlet or 2 JMXInvokerServlet, aka ZDI-CAN-1760. NOTE: this is probably a duplica...

CVE-2013-4810

HP ProCurve Manager PCM 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager IDM 4.0, and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled object to 1 EJBInvokerServlet or 2 JMXInvokerServlet, aka ZDI-CAN-1760. NOTE: this is probably a duplica...

CVE-2013-4810

HP ProCurve Manager (PCM) 3.20/4.0, PCM+ 3.20/4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle Management are affected. The root cause is a remote code execution vector via a marshalled object to the EJBInvokerServlet or JMXInvokerServlet, enabling an attacker to execute arbitrar...

HP PCM+ and Application Lifecycle Management JBoss Invoker Servlets Marshalled Object Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of HP PCM Plus and Application Lifecycle Management. Authentication is not required to exploit this vulnerability. The specific flaw exists within the exposed EJBInvokerServlet and JMXInvokerServlet. ...

JBoss DeploymentFileRepository WAR Deployment

require 'msf/core' class Metasploit4 /JBoss/ include Msf::Exploit::Remote::HttpClient include Msf::Exploit::EXE def initializeinfo = superupdateinfoinfo, 'Name' = 'JBoss DeploymentFileRepository WAR Deployment via JMXInvokerServlet', 'Description' = %q This module can be used to execute a payload...

JBoss DeploymentFileRepository WAR Deployment

Exploit for multiple platform in category remote exploits require 'msf/core' class Metasploit4 /JBoss/ include Msf::Exploit::Remote::HttpClient include Msf::Exploit::EXE def initializeinfo = superupdateinfoinfo, 'Name' = 'JBoss DeploymentFileRepository WAR Deployment via JMXInvokerServlet',...

JBoss - DeploymentFileRepository WAR Deployment (via JMXInvokerServlet) (Metasploit)

require 'msf/core' class Metasploit4 /JBoss/ include Msf::Exploit::Remote::HttpClient include Msf::Exploit::EXE def initializeinfo = superupdateinfoinfo, 'Name' = 'JBoss DeploymentFileRepository WAR Deployment via JMXInvokerServlet', 'Description' = %q This module can be used to execute a payload...

JBoss DeploymentFileRepository WAR Deployment (via JMXInvokerServlet)

This module can be used to execute a payload on JBoss servers that have an exposed HTTPAdaptor's JMX Invoker exposed on the "JMXInvokerServlet". By invoking the methods provided by jboss.admin:DeploymentFileRepository a stager is deployed to finally upload the selected payload to the target. The...