## # This module requires Metasploit: http//metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'msf/core' class Metasploit3 < Msf::Auxiliary include Msf::Exploit::Remote::Tcp include Msf::Auxiliary::Scanner include Msf::Auxiliary::Report def initialize super( 'Name' => 'Java RMI Server Insecure Endpoint Code Execution Scanner', 'Description' => 'Detect Java RMI endpoints', 'Author' => ['mihi', 'hdm'], 'License' => MSF_LICENSE, 'References' => [ # RMI protocol specification [ 'URL', 'http://download.oracle.com/javase/1.3/docs/guide/rmi/spec/rmi-protocol.html'], # Placeholder reference for matching [ 'MSF', 'java_rmi_server'] ], 'DisclosureDate' => 'Oct 15 2011' ) register_options( [ Opt::RPORT(1099) ], self.class) end def setup buf = gen_rmi_loader_packet jar = Rex::Text.rand_text_alpha(rand(8)+1) + '.jar' old_url = "file:./rmidummy.jar" new_url = "file:RMIClassLoaderSecurityTest/" + jar # Java strings in serialized data are prefixed with a 2-byte, big endian length # (at least, as long as they are shorter than 65536 bytes) find_me = [old_url.length].pack("n") + old_url idx = buf.index(find_me) len = [new_url.length].pack("n") # Now replace it with the new url buf[idx, find_me.length] = len + new_url @pkt = "JRMI" + [2,0x4b,0,0].pack("nCnN") + buf end def run_host(target_host) begin connect sock.put("\x4a\x52\x4d\x49\0\x02\x4b") res = sock.get_once disconnect if res and res =~ /^\x4e..([^\x00]+)\x00\x00/ info = $1 begin # Determine if the instance allows remote class loading connect sock.put(@pkt) rescue nil buf = "" 1.upto(6) do res = sock.get_once(-1, 5) rescue nil break if not res buf << res end rescue ::Interrupt raise $! rescue ::Exception ensure disconnect end if buf =~ /RMI class loader disabled/ print_status("#{rhost}:#{rport} Java RMI Endpoint Detected: Class Loader Disabled") report_service(:host => rhost, :port => rport, :name => "java-rmi", :info => "Class Loader: Disabled") elsif buf.length > 0 print_good("#{rhost}:#{rport} Java RMI Endpoint Detected: Class Loader Enabled") svc = report_service(:host => rhost, :port => rport, :name => "java-rmi", :info => "Class Loader: Enabled") report_vuln( :host => rhost, :service => svc, :name => self.name, :info => "Module #{self.fullname} confirmed remote code execution via this RMI service", :refs => self.references ) else print_status("#{rhost}:#{rport} Java RMI Endpoint Detected") report_service(:host => rhost, :port => rport, :name => "java-rmi", :info => "") end end rescue ::Interrupt raise $! rescue ::Rex::ConnectionError, ::IOError ensure disconnect end end def gen_rmi_loader_packet "\x50\xac\xed\x00\x05\x77\x22\x00\x00\x00\x00\x00\x00\x00\x02\x00" + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + "\x00\xf6\xb6\x89\x8d\x8b\xf2\x86\x43\x75\x72\x00\x18\x5b\x4c\x6a" + "\x61\x76\x61\x2e\x72\x6d\x69\x2e\x73\x65\x72\x76\x65\x72\x2e\x4f" + "\x62\x6a\x49\x44\x3b\x87\x13\x00\xb8\xd0\x2c\x64\x7e\x02\x00\x00" + "\x70\x78\x70\x00\x00\x00\x00\x77\x08\x00\x00\x00\x00\x00\x00\x00" + "\x00\x73\x72\x00\x14\x6d\x65\x74\x61\x73\x70\x6c\x6f\x69\x74\x2e" + "\x52\x4d\x49\x4c\x6f\x61\x64\x65\x72\xa1\x65\x44\xba\x26\xf9\xc2" + "\xf4\x02\x00\x00\x74\x00\x13\x66\x69\x6c\x65\x3a\x2e\x2f\x72\x6d" + "\x69\x64\x75\x6d\x6d\x79\x2e\x6a\x61\x72\x78\x70\x77\x01\x00\x0a" end end