jboss-xml-console-unauthorized: JBoss JMX Console Weak Credential Discovery

id: jboss-xml-console-unauthorized

info:
    name: JBoss JMX Console Weak Credential Discovery
    author: paradessia
    severity: high
    verified: true
    description: |
        利用jboss.deployment部署shell
        fofa: "jmx-console"
    reference:
        - https://xz.aliyun.com/t/6103

rules:
    r0:
        request:
            method: GET
            path: /jmx-console/
        expression: response.status == 200 && response.body.bcontains(b"jboss.management.local") && response.body.bcontains(b"jboss.web")
    r1:
        request:
            method: GET
            path: /jmx-console/
            headers:
                Authorization: "Basic YWRtaW46YWRtaW4="
        expression: response.status == 200 && response.body.bcontains(b'JMImplementation')
    r2:
        request:
            method: GET
            path: /jmx-console/
            headers:
                Authorization: "Basic cm9vdDpyb290"
        expression: response.status == 200 && response.body.bcontains(b'JMImplementation')
    r3:
        request:
            method: GET
            path: /jmx-console/
            headers:
                Authorization: "Basic YWRtaW46MTIzNDU2"
        expression: response.status == 200 && response.body.bcontains(b'JMImplementation')
expression: r0() || r1() || r2() || r3()