331 lines
12 KiB
HTML
331 lines
12 KiB
HTML
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
|
||
|
|
<html>
|
||
|
|
<head>
|
||
|
|
<style type="text/css">
|
||
|
|
body {
|
||
|
|
font-family: Verdana, Arial, sans-serif;
|
||
|
|
font-size: 10pt;
|
||
|
|
}
|
||
|
|
|
||
|
|
p {
|
||
|
|
margin-left: 2em;
|
||
|
|
margin-right: 2em;
|
||
|
|
}
|
||
|
|
</style>
|
||
|
|
<title>JavaPayload4Metasploit - Single payload loader class to
|
||
|
|
be used in the Metasploit project</title>
|
||
|
|
</head>
|
||
|
|
<body>
|
||
|
|
<h1>JavaPayload4Metasploit - Single payload loader class to be used
|
||
|
|
in the Metasploit project</h1>
|
||
|
|
|
||
|
|
<p><i>© 2010 Michael 'mihi' Schierl, <tt><schierlm
|
||
|
|
at users dot sourceforge dot net></tt></i></p>
|
||
|
|
|
||
|
|
<h2>Introduction</h2>
|
||
|
|
|
||
|
|
<p>The <a href="http://schierlm.users.sourceforge.net/JavaPayload/">JavaPayload</a>s
|
||
|
|
contain useful payloads written in pure Java. But they assume that the
|
||
|
|
attacker has a Java VM on his machine, as the the builders and stage
|
||
|
|
handlers are written in Java. In addition, when creating a new payload
|
||
|
|
class that should reside in a signed jar, the jar has to be re-signed as
|
||
|
|
classes have changed.</p>
|
||
|
|
|
||
|
|
<p>In contrast, this package contains a single <i>metasploit.Payload</i>
|
||
|
|
class which is configured by a property file in the classpath (i. e. in
|
||
|
|
the same jar). As it is possible to add unsigned resources to a jar
|
||
|
|
without requiring to re-sign it, and as it is easy to manipulate zip/jar
|
||
|
|
files from Ruby, this makes it possible to leverage the powers of
|
||
|
|
JavaPayload from Metasploit which is written in Ruby and not in Java.</p>
|
||
|
|
|
||
|
|
<h2>System requirements</h2>
|
||
|
|
|
||
|
|
<p>Same as JavaPayload. JRE 1.2 on the victim machine is enough <tt>:-)</tt></p>
|
||
|
|
|
||
|
|
<p>On the attacker machine, no Java at all is required.</p>
|
||
|
|
|
||
|
|
<h2>How to use the <i>Payload</i> class.</h2>
|
||
|
|
|
||
|
|
<p>The <i>Payload</i> class is (among a collection of JavaPayload
|
||
|
|
stage classes) stored inside <tt>JavaPayload4Meterpreter.jar</tt>.</p>
|
||
|
|
|
||
|
|
<p>It is a standard java main class (i. e. it has a <tt>public
|
||
|
|
static void main(String[])</tt> method), so the most obvious way to invoke it
|
||
|
|
is putting it into a Jar file whose manifest's <tt>Main-Class</tt>
|
||
|
|
attribute is <tt>metasploit.Payload</tt>. The resuling jar can be
|
||
|
|
started using <tt>java -jar jarfile.jar</tt>. There are 3 example jars
|
||
|
|
available that use this technique; they are described later.</p>
|
||
|
|
|
||
|
|
<p>Alternatively, the main class can of course be called from other
|
||
|
|
classes, like <tt>metasploit.Payload.main(null);</tt>, as the arguments
|
||
|
|
parameter is ignored. Note that in a sandboxed environment the caller
|
||
|
|
needs to have all permissions, and also the <i>Payload</i> class has to
|
||
|
|
be loaded with all permissions. In case there is untrusted code on the
|
||
|
|
stack trace (but the direct caller has all permissions), the call has to
|
||
|
|
be wrapped in a <a
|
||
|
|
href="http://download.oracle.com/javase/1.4.2/docs/api/java/security/AccessController.html#doPrivileged(java.security.PrivilegedExceptionAction)">doPrivileged</a>
|
||
|
|
call (like it is done in the several well known public exploits for
|
||
|
|
CVE-2008-5353).</p>
|
||
|
|
|
||
|
|
<p>Once loaded, the class will lookup a file called <tt>/metasploit.dat</tt>
|
||
|
|
from the class path and load it as a <a
|
||
|
|
href="http://download.oracle.com/javase/1.4.2/docs/api/java/util/Properties.html#load(java.io.InputStream)">Property
|
||
|
|
file</a> (basically a text file with <tt>Name=value</tt> lines, but note
|
||
|
|
that some special characters need escaping). If the file cannot be
|
||
|
|
found, default values are used.</p>
|
||
|
|
|
||
|
|
<p>Depending on the property values (see below), the class will then
|
||
|
|
optionally write itself to disk and spawn a sub-process (once or several
|
||
|
|
times) to disconnect the payload from the calling process. All temporary
|
||
|
|
files will be deleted afterwards. (Even on Windows it is possible to
|
||
|
|
delete a running class file as technically, not the class file but the
|
||
|
|
Java VM is running).</p>
|
||
|
|
|
||
|
|
<p>After that, it will either listen on a port and accept a socket,
|
||
|
|
create an active socket connection, or (for debugging purposes) just
|
||
|
|
uses standard input and standard output; in any case, the resulting
|
||
|
|
input/output streams are used for the staging</p>
|
||
|
|
|
||
|
|
<p>The property file can configure an <i>embedded stage</i> which
|
||
|
|
will be loaded directly from the current classloader (i. e. JAR). Note
|
||
|
|
that this feature cannot be used from a sub-process, as the rest of the
|
||
|
|
JAR file will not be available any longer there.</p>
|
||
|
|
|
||
|
|
<p>If no embedded stage is configured, the stage is loaded from the
|
||
|
|
input stream instead (see below for the data format).</p>
|
||
|
|
|
||
|
|
<p>Once the stage is loaded, the streams are handed to the stage.
|
||
|
|
Stages may require optional parameters (a string) which can be given
|
||
|
|
either in the property file or by using the <tt>SendParameters</tt>
|
||
|
|
stage from JavaPayload.</p>
|
||
|
|
|
||
|
|
<p>When the stage quits, the payload class terminates and cleans up
|
||
|
|
after itself if needed.</p>
|
||
|
|
|
||
|
|
<h2>Supported properties (and their default values)</h2>
|
||
|
|
|
||
|
|
<h3><tt>Spawn</tt>(<tt>=0</tt>)</h3>
|
||
|
|
|
||
|
|
<p>The number of java processes that should be spawned. <tt>0</tt>
|
||
|
|
will run the payload inside the original process, <tt>1</tt> will spawn
|
||
|
|
once (to continue running when the original process terminates), and <tt>2</tt>
|
||
|
|
will spawn twice (on certain popular operating systems it is impossible
|
||
|
|
to obtain parent process informaion if the parent process has already
|
||
|
|
died).</p>
|
||
|
|
|
||
|
|
<h3><tt>EmbeddedStage</tt>(<tt>=</tt>)</h3>
|
||
|
|
|
||
|
|
<p><b>Note: </b> this option will not work with the <tt>Spawn</tt>
|
||
|
|
option!</p>
|
||
|
|
|
||
|
|
<h3><tt>StageParameters</tt>(<tt>=</tt>)</h3>
|
||
|
|
|
||
|
|
<p>Additional parameters to be used by the stage, regardless whether
|
||
|
|
it was embedded or not. Only few stages support/require parameters.</p>
|
||
|
|
|
||
|
|
<h3><tt>LPORT</tt>(<tt>=4444</tt>)</h3>
|
||
|
|
|
||
|
|
<p>Port to listen on or to connect to (if <tt>LHOST</tt> is also
|
||
|
|
set). If explicitly set to <tt>0</tt>, no connection will be made, but
|
||
|
|
standard input/output streams will be used instead.</p>
|
||
|
|
|
||
|
|
<h3><tt>LHOST</tt>(<tt>=<a></a></tt>)</h3>
|
||
|
|
|
||
|
|
<p>Host to connect to. If not set, the payload will listen instead.</p>
|
||
|
|
|
||
|
|
<h2>Staging protocol</h2>
|
||
|
|
|
||
|
|
<p>The staging protocol is quite simple. All classes are sent
|
||
|
|
uncompressed (as they are inside the .jar file). Each class is prefixed
|
||
|
|
by a 32-bit big-endian size. After the last class, a size of 0 is sent.
|
||
|
|
The classes will be defined in the order they are sent (i. e. they can
|
||
|
|
only refer to classes defined before), and the last sent class will be
|
||
|
|
loaded as a stage.</p>
|
||
|
|
|
||
|
|
<p>In case of an embedded stage, no staging is used - the stream is
|
||
|
|
directly passed to the stage.</p>
|
||
|
|
|
||
|
|
<h2>Supported stages (in alphabetical order)</h2>
|
||
|
|
|
||
|
|
<p>The stages are original <a
|
||
|
|
href="http://schierlm.users.sourceforge.net/JavaPayload/">JavaPayload</a>
|
||
|
|
stages to make updates easier. All stages listed here can be used
|
||
|
|
without special "Java" tricks (like serialization or JDWP protocol), to
|
||
|
|
easily use them from Ruby.</p>
|
||
|
|
|
||
|
|
<h3><tt>Exec</tt></h3>
|
||
|
|
<dl>
|
||
|
|
<dt><b>Stage classes</b></dt>
|
||
|
|
<dd>javapayload.stage.Stage, javapayload.stage.StreamForwarder,
|
||
|
|
javapayload.stage.Exec</dd>
|
||
|
|
</dl>
|
||
|
|
<dl>
|
||
|
|
<dt><b>Parameters</b></dt>
|
||
|
|
<dd><tt><b>Exec</b> <i>commandline</i></tt></dd>
|
||
|
|
</dl>
|
||
|
|
<dl>
|
||
|
|
<dt><b>Stage protocol</b></dt>
|
||
|
|
<dd>raw Input/output streams</dd>
|
||
|
|
</dl>
|
||
|
|
|
||
|
|
<p>Execute an executable on the target machine and forward streams.
|
||
|
|
Stdout and Stderr are merged automatically.</p>
|
||
|
|
|
||
|
|
<h3><tt>JSh</tt></h3>
|
||
|
|
<dl>
|
||
|
|
<dt><b>Stage classes</b></dt>
|
||
|
|
<dd>javapayload.stage.Stage, javapayload.stage.JShSignalSender,
|
||
|
|
javapayload.stage.JShStreamForwarder, javapayload.stage.JSh</dd>
|
||
|
|
</dl>
|
||
|
|
<dl>
|
||
|
|
<dt><b>Parameters</b></dt>
|
||
|
|
<dd>Not supported</dd>
|
||
|
|
</dl>
|
||
|
|
<dl>
|
||
|
|
<dt><b>Stage protocol</b></dt>
|
||
|
|
<dd>Plain text</dd>
|
||
|
|
</dl>
|
||
|
|
|
||
|
|
<p>A simple shell written in pure Java.</p>
|
||
|
|
|
||
|
|
<pre>Supported commands:
|
||
|
|
help - show this help
|
||
|
|
info - list system properties
|
||
|
|
pwd - show current directory
|
||
|
|
cd - change directory
|
||
|
|
ls - list directory
|
||
|
|
exec - execute native command
|
||
|
|
cat - show text file
|
||
|
|
wget - download file
|
||
|
|
telnet - create TCP connection
|
||
|
|
paste - create text file
|
||
|
|
jobs - list or continue jobs
|
||
|
|
exit - Exit JSh</pre>
|
||
|
|
|
||
|
|
|
||
|
|
<h3><tt>Meterpreter</tt></h3>
|
||
|
|
<dl>
|
||
|
|
<dt><b>Stage classes</b></dt>
|
||
|
|
<dd>javapayload.stage.Stage,
|
||
|
|
com.metasploit.meterpreter.MemoryBufferURLConnection,
|
||
|
|
com.metasploit.meterpreter.MemoryBufferURLStreamHandler,
|
||
|
|
javapayload.stage.Meterpreter</dd>
|
||
|
|
</dl>
|
||
|
|
<dl>
|
||
|
|
<dt><b>Parameters</b></dt>
|
||
|
|
<dd>Optional parameter <tt>NoRedirect</tt> for debugging.</dd>
|
||
|
|
</dl>
|
||
|
|
<dl>
|
||
|
|
<dt><b>Stage protocol</b></dt>
|
||
|
|
<dd>Meterpreter protocol</dd>
|
||
|
|
</dl>
|
||
|
|
|
||
|
|
<p>Loader to load the Java version of Metasploit's own
|
||
|
|
post-exploitation toolkit.</p>
|
||
|
|
|
||
|
|
<h3><tt>SendParameters</tt></h3>
|
||
|
|
<dl>
|
||
|
|
<dt><b>Stage classes</b></dt>
|
||
|
|
<dd><i>all classes needed by the stage to use</i>,
|
||
|
|
javapayload.stage.SendParameters</dd>
|
||
|
|
</dl>
|
||
|
|
<dl>
|
||
|
|
<dt><b>Parameters</b></dt>
|
||
|
|
<dd>Not supported</dd>
|
||
|
|
</dl>
|
||
|
|
<dl>
|
||
|
|
<dt><b>Stage protocol</b></dt>
|
||
|
|
<dd>First transfer of parameters, then as the stage to use</dd>
|
||
|
|
</dl>
|
||
|
|
|
||
|
|
<p>"Intermediate" stage that can be used to change the stage
|
||
|
|
parameters in cases where they cannot be cast in stone when the payload
|
||
|
|
is built.</p>
|
||
|
|
|
||
|
|
<p>After sending the stage, but before sending data for the stage,
|
||
|
|
you have to send the parameters:</p>
|
||
|
|
|
||
|
|
<p>The parameters start with a unsigned big-endian 16-bit integer
|
||
|
|
that specifies the number of parameters. Then each parameter is sent in
|
||
|
|
Java's <a
|
||
|
|
href="http://download.oracle.com/javase/1.4.2/docs/api/java/io/DataInput.html#readUTF()">modified
|
||
|
|
UTF string format</a>. After that, the actual data for the stage can be
|
||
|
|
sent.</p>
|
||
|
|
|
||
|
|
<h3><tt>Shell</tt></h3>
|
||
|
|
<dl>
|
||
|
|
<dt><b>Stage classes</b></dt>
|
||
|
|
<dd>javapayload.stage.Stage, javapayload.stage.StreamForwarder,
|
||
|
|
javapayload.stage.Exec</dd>
|
||
|
|
</dl>
|
||
|
|
<dl>
|
||
|
|
<dt><b>Parameters</b></dt>
|
||
|
|
<dd>Not supported</dd>
|
||
|
|
</dl>
|
||
|
|
<dl>
|
||
|
|
<dt><b>Stage protocol</b></dt>
|
||
|
|
<dd>Plain text</dd>
|
||
|
|
</dl>
|
||
|
|
|
||
|
|
<p>This stager loads /bin/sh on Unix systems and cmd.exe on Windows
|
||
|
|
systems, and else just behaves like the <tt>Exec</tt> stage.</p>
|
||
|
|
|
||
|
|
<h3><tt>SystemInfo</tt></h3>
|
||
|
|
<dl>
|
||
|
|
<dt><b>Stage classes</b></dt>
|
||
|
|
<dd>javapayload.stage.Stage, javapayload.stage.SystemInfo</dd>
|
||
|
|
</dl>
|
||
|
|
<dl>
|
||
|
|
<dt><b>Parameters</b></dt>
|
||
|
|
<dd>Not supported</dd>
|
||
|
|
</dl>
|
||
|
|
<dl>
|
||
|
|
<dt><b>Stage protocol</b></dt>
|
||
|
|
<dd>Plain text</dd>
|
||
|
|
</dl>
|
||
|
|
|
||
|
|
<p>This stage just returns some system and network information. The
|
||
|
|
input stream is ignored. Useful as an embedded stage for automatic data
|
||
|
|
gathering with <tt>netcat</tt>, but not useful for anything else.</p>
|
||
|
|
|
||
|
|
<h3><tt>UpExec</tt></h3>
|
||
|
|
<dl>
|
||
|
|
<dt><b>Stage classes</b></dt>
|
||
|
|
<dd>javapayload.stage.Stage, javapayload.stage.StreamForwarder,
|
||
|
|
javapayload.stage.UpExec</dd>
|
||
|
|
</dl>
|
||
|
|
<dl>
|
||
|
|
<dt><b>Parameters</b></dt>
|
||
|
|
<dd><b>UpExec</b> <i>program_name</i> <i>arguments</i></dd>
|
||
|
|
</dl>
|
||
|
|
<dl>
|
||
|
|
<dt><b>Stage protocol</b></dt>
|
||
|
|
<dd>raw Input/output streams</dd>
|
||
|
|
</dl>
|
||
|
|
|
||
|
|
<p>Acts like exec, just that the a file can be uploaded first
|
||
|
|
(stored with a random file name) which will be executed with parameters.</p>
|
||
|
|
|
||
|
|
<p>The file is uploaded directly after uploading the stage classes,
|
||
|
|
prefixed by a 32-bit big-endian integer size value.</p>
|
||
|
|
|
||
|
|
<h2>Included example jars</h2>
|
||
|
|
|
||
|
|
<h3><tt>example-reverse-meterpreter.jar</tt></h3>
|
||
|
|
|
||
|
|
<p>Will connect back to metasploit at localhost:4444. and try to
|
||
|
|
bootstrap meterpreter (via an embedded stage). Except for the hard-coded
|
||
|
|
address in the property file, it acts like <i>loader.jar</i>.</p>
|
||
|
|
|
||
|
|
<h3><tt>example-spawn-bind.jar</tt></h3>
|
||
|
|
|
||
|
|
<p>Will spawn 2 Java processes and then listen on port 5555 for
|
||
|
|
incoming connections. No embedded stages.</p>
|
||
|
|
|
||
|
|
<h3><tt>example-standalone-jsh.jar</tt></h3>
|
||
|
|
|
||
|
|
<p>Will run JSh on stdin/stdout. Example for the stdin/stdout
|
||
|
|
feature and useful for testing JSh easily.</p>
|
||
|
|
|
||
|
|
</body>
|
||
|
|
</html>
|