Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

removing slice operators from jdwp_debugger #8871

Merged
merged 1 commit into from Aug 23, 2017

Conversation

lsato-r7
Copy link
Contributor

@lsato-r7 lsato-r7 commented Aug 21, 2017

Tell us what this change does. If you're fixing a bug, please mention
the github issue number.

Verification

List the steps needed to make sure this thing works

  • Start jdwp on test instance
cat > HelloWorld.java <<'EOF'
public class HelloWorld {
    public static void main(String[] args) {
        while (1==1) {
            try {
                Thread.sleep(1000);
                System.out.println("hello");
            } catch (Exception e) {
                e.printStackTrace();
            }
        }
    }
}
EOF
javac HelloWorld.java
java -agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=8000 -cp . HelloWorld
  • Start msfconsole
  • use exploit/multi/misc/java_jdwp_debugger
  • set rhost this.is.my.ip
  • exploit
  • Verify shell!
  • Document This removes the slice! operator from the exploit - with the slice operator, it modifies the buffer every single time which could take extensive amounts of time vs just grabbing content from the string as it does now (following more closely to https://github.com/IOActive/jdwp-shellifier/blob/master/jdwp-shellifier.py)

@busterb
Copy link
Member

busterb commented Aug 22, 2017

this is way too hard to verify. can you please write a script that also lands it for me?

@busterb
Copy link
Member

busterb commented Aug 22, 2017

I'm adding OS X and 64-bit support too, since this is just a file dropper.

@busterb
Copy link
Member

busterb commented Aug 23, 2017

found an old-ish bug in builtin handlers for exploits that needs to be fixed. luckily this module triggered it for meterpreter payloads easily.

@busterb busterb merged commit e01caac into rapid7:master Aug 23, 2017
@busterb
Copy link
Member

busterb commented Aug 23, 2017

Added 7263c7a bb12096 and 1289492 to add OSX and extend the Linux supported Arch list.

@busterb
Copy link
Member

busterb commented Aug 24, 2017

Release Notes

The speed and interoperability of the jdwp_debugger exploit have been improved.

@tdoan-r7 tdoan-r7 added the rn-enhancement release notes enhancement label Aug 30, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants