Hands-On Web Penetration Testing with Metasploit

Exploitation via the web console (the Invoker method)

Another way of exploiting a JBoss AS instance is via the web console's Invoker method. Executing a curl command while requesting the /web-console/Invoker URI path will get us a response from the server with the 0xAC and 0xED hex code characters (aced) in the first 4 bytes of the file. We can see this at the beginning of any Java serialized object, as follows:

The Invoker servlet can be found in the web console or Invoker at http://example.com/web-console/Invoker. This can mostly be accessed without authentication. We can send a serialized post request to this Invoker to execute commands ...