(invalid literal for int() with base 10 error when running JMX Tomcat

[joaomatosf]

(invalid literal for int() with base 10 error when running JMX Tomcat

[H4Xv1]

Hey @CaptainBoggle,

i know its a bit late - like a handfull years late. I recently looked at jexboss as a part of my bachelor-thesis to verify a webapp for CVE-2016-8735 and stumbled upon the same issue with the -jmxtomcat option. Considering it hasn't apperantly been fixed ever since and i see no further comment on it. Here a quick workaround that should fix the issue.

Its a rather small parsing error in the jexboss.py script. In Line 364 and 365 the script takes your URL and parses it in 3 sections split by ":" to (Protocol : //Adress : Port). Line 365 throws the error because it tries to assign an integer to e.g "//127.0.01". Simply increment both parameters by one and it fixes the parsing.

Either provide e.g. http:127.0.0.1:443 as CLI argument -
or add the line shown below to strip the slashes from the Host to prevent subsequent [Errno -2] Name or service not known.
In case you still want to use the double slash in your URL. The script should still work as intended afterwards.

            elif vector == 'JMX Tomcat':

                s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
                s.settimeout(7)
364             host_rmi = url.split(':')[0]            #Change 0->1
+               host_rmi = host_rmi.replace("//","")  #Strips the // from the Host Adress
365             port_rmi = int(url.split(':')[1])      #Change 1->2
                s.connect((host_rmi, port_rmi))
                s.send(b"JRMI\x00\x02K")
                msg = s.recv(1024)
                octets = str(msg[3:]).split(".")
                if len(octets) != 4:
                    paths[vector] = 505
                else:
                    paths[vector] = 200

Considering the time since you opend the issue you may have found that yourself. For those stumbling across it as well and still wanting to utilize the tool in 2023 for that purpose - that'll do it. Also when you run the script it creates a log file that's rather helpful ;)

EDIT: Done a bit of formatting and provided the additional solution for stripping the slashes from the host_rmi variable. Excuse the frequent edits - first time posting of GitHub. Hope the solution helps some of you encountering the same issue.

[CaptainBoggle]

Thank you!