Hands-On Web Penetration Testing with Metasploit

Exploitation via the JMX console using Metasploit (BSHDeployer)

Metasploit can also be used to deploy a BSH to achieve code execution on the server. Metasploit has the jboss_bshdeployer exploit module for this purpose, so let's look at its usage. We can load the exploit in msfconsole using the following command:

Use exploit/multi/http/jboss_bshdeployer

To view the list of options, we need to type show options, as shown:

We need to then set the respective options before running the exploit, as shown:

We need to set the payload that we're using ...