Apache Karaf Default Credentials Command Execution
This module exploits a default misconfiguration flaw on Apache Karaf versions 2.x-4.x. The 'karaf' user has a known default password, which can be used to login to the SSH service, and execute operating system commands from remote.
Module Name
auxiliary/scanner/ssh/apache_karaf_command_execution
Authors
- Nicholas Starke <nick [at] alephvoid.com>
Platforms
- unix
Architectures
- cmd
Reliability
Development
Module Options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use auxiliary/scanner/ssh/apache_karaf_command_execution
msf auxiliary(apache_karaf_command_execution) > show actions
...actions...
msf auxiliary(apache_karaf_command_execution) > set ACTION <action-name>
msf auxiliary(apache_karaf_command_execution) > show options
...show and set options...
msf auxiliary(apache_karaf_command_execution) > run