Summary: I would like to show a proof of concept of a Java exploit using an old
JRE on an up-to-date machine to cut short discussions on the "but we are patched so why removing older versions" subject.
(I am not a developper - apologies for possible unfortunate expressions below.)
Details: When patching Java (at least on MS Windows) the
JRE us updated to the latest version (there is a single
jre folder in
<path to Java install>) but the
JDK is updated though a new
jdk<version> folder, which also contains a
Oracle allows to choose the version to run in an applet so I would like to show a proof of concept of the style
- someone with an up-to-date Java install connects to a web page with the "malicious" applet
- something "bad" happens showing that he/she is hacked
I was initially thinking about writing a minimal applet (I will find help on that subject locally) and using Metasploit to run the actual attack - it seems however that the Metasploit payloads are not configurable (in the sense of using
java_version to hit an older version of Java)
Note: this is a practical followup of a discussion on detecting Java vulnerabilities on the nessus forum.