Sploitus

Exploit for Deserialization of Untrusted Data in Redhat Jboss Enterprise Application Platform

gitee · 2020-07-07

Exploit Code

MARKDOWN12 lines
## https://sploitus.com/exploit?id=2E4E069F-F046-592F-9F23-54F5B8A3EAB2
PoC exploit for CVE-2017-12149, an arbitrary file upload vulnerability in JBoss Application Server. 

The exploit module targets the JBoss Application Server, specifically the CVE-2017-12149 vulnerability, which allows for arbitrary file uploads. The module is designed to exploit this vulnerability by uploading a malicious file to the server, which can lead to remote code execution.

The exploit module is written in Python and uses the `requests` library to send HTTP requests to the target server. The module takes several parameters, including the target URL, the file to upload, and the username and password for authentication.

The module first checks if the target URL is valid and if the file to upload is specified. If both are valid, it sends a POST request to the target URL with the file attached. The request is authenticated using the provided username and password.

If the request is successful, the module checks if the file was uploaded correctly by checking the response from the server. If the file was uploaded, the module returns the path to the uploaded file.

The module also includes a function to check if the target URL is a JBoss server by checking the response from the server. If the response contains the string "JBoss", the module returns True, indicating that the target URL is a J