##
# $Id: java_signed_applet.rb 8328 2010-01-29 19:47:40Z natron $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'
require 'rex'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpServer::HTML
	include Msf::Exploit::Java

	def initialize( info = {} )

		super( update_info( info,
			'Name'          => 'Signed Applet Social Engineering Code Exec',
			'Description'   => %q{
				This exploit dynamically creates an applet via the Msf::Exploit::Java mixin, converts it 
				to a .jar file, then signs the .jar with a dynamically created certificate containing 
				values of your choosing.  This is presented to the end user via a web page with an applet 
				tag, loading the signed applet.

				The user's JVM pops a dialog asking if they trust the signed applet and displays the 
				values chosen.  Once the user clicks 'accept', the applet executes with full user 
				permissions.

				The java payload used in this exploit is derived from Stephen Fewer's and HDM's payload
				created for the CVE-2008-5353 java deserialization exploit.

				This module requires the rjb rubygem, the JDK, and the $JAVA_HOME variable to be set.
				If these dependencies are not present, the exploit falls back to a static, signed
				JAR.
			},
			'License'       => MSF_LICENSE,
			'Author'        => [ 'natron' ],
			'Version'       => '$Revision: 8328