JBOSS

☁️ HackTricks Cloud ☁️ -🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥

Do you work in a cybersecurity company? Do you want to see your company advertised in HackTricks? or do you want to have access to the latest version of the PEASS or download HackTricks in PDF? Check the SUBSCRIPTION PLANS!
Discover The PEASS Family, our collection of exclusive NFTs
Get the official PEASS & HackTricks swag
Join the 💬 Discord group or the telegram group or follow me on Twitter 🐦@carlospolopm.
Share your hacking tricks by submitting PRs to the hacktricks repo and hacktricks-cloud repo.

If you are interested in hacking carer and hack the unhackable - we are hiring! (fluent polish written and spoken required).

{% embed url="https://www.stmcyber.com/careers" %}

Enumeration

The /web-console/ServerInfo.jsp and /status?full=true web pages often reveal server details.

You can expose management servlets via the following paths within JBoss (depending on the version): /admin-console, /jmx-console, /management, and /web-console. Default credentials are admin/admin. Upon gaining access, you can use available invoker servlets to interact with exposed MBeans:

/web-console/Invoker (JBoss versions 6 and 7)
/invoker/JMXInvokerServlet and /invoker/EJBInvokerServlet (JBoss 5 and prior)

You can enumerate and even exploit a JBOSS service using clusterd
Or using metasploit: msf > use auxiliary/scanner/http/jboss_vulnscan

Exploitation

https://github.com/joaomatosf/jexboss

Google Dork

inurl:status EJInvokerServlet