rapid7/metasploit-framework — pull request #463 by schierlm (2012-06-09 20:04:37+00:00)
Title: Add ARCH_JAVA support to struts_code_exec_exception_delegator

It will chop the payload JAR file into chunks of 384 bytes, base64 encode them (resulting in 512 bytes each) and then use OGNL to append each chunk to a remote file via FileOutputStream. Then a new class loader is created, which is used to lookup and execute metasploit.Payload inside the jar. Increasing the chunk length worked well when testing with the struts hello world project, but better safe than sorry.

(Another possible approach to implement this would be to use a HTTP URL pointing back at the attacker instead of the file URL. This would avoid all the hassle with uploading the JAR file and avoid touching disk, but the exploited machine would have to be able to connect back to the attacker)