3.1 KiB
Support HackTricks and get benefits!
Do you work in a cybersecurity company? Do you want to see your company advertised in HackTricks? or do you want to have access the latest version of the PEASS or download HackTricks in PDF? Check the SUBSCRIPTION PLANS!
Discover The PEASS Family, our collection of exclusive NFTs
Get the official PEASS & HackTricks swag
Join the 💬 Discord group or the telegram group or follow me on Twitter 🐦@carlospolopm.
Share your hacking tricks submitting PRs to the hacktricks github repo.
JBOSS
Enumeration
The /web-console/ServerInfo.jsp and /status?full=true web pages often reveal server details.
You can expose management servlets via the following paths within JBoss (depending on the version): /admin-console, /jmx-console, /management, and /web-console. Default credentials are admin/admin. Upon gaining access, you can use available invoker servlets to interact with exposed MBeans:
- /web-console/Invoker (JBoss versions 6 and 7)
- /invoker/JMXInvokerServlet and /invoker/EJBInvokerServlet (JBoss 5 and prior)
You can enumerate and even exploit a JBOSS service using clusterd
Or using metasploit:
msf > use auxiliary/scanner/http/jboss_vulnscan
Exploitation
https://github.com/joaomatosf/jexboss
Google Dork
inurl:status EJInvokerServlet
Support HackTricks and get benefits!
Do you work in a cybersecurity company? Do you want to see your company advertised in HackTricks? or do you want to have access the latest version of the PEASS or download HackTricks in PDF? Check the SUBSCRIPTION PLANS!
Discover The PEASS Family, our collection of exclusive NFTs
Get the official PEASS & HackTricks swag
Join the 💬 Discord group or the telegram group or follow me on Twitter 🐦@carlospolopm.
Share your hacking tricks submitting PRs to the hacktricks github repo.