Sploitus

Exploit for Immunity Canvas: JAVA_MBEANINSTANTIATOR_FINDCLASS

CVE-2013-0422

canvas Β· 2013-01-10

Exploit Code

MARKDOWN27 lines
## https://sploitus.com/exploit?id=JAVA_MBEANINSTANTIATOR_FINDCLASS
**Name**|  java_MBeanInstantiator_findClass  
---|---  
**CVE**|  CVE-2013-0422  
**Exploit Pack**|  [CANVAS](<http://http://www.immunityinc.com/products-canvas.shtml>)  
**Description**| java_MBeanInstantiator_findClass  
**Notes**| CVE Name: CVE-2013-0422  
VENDOR: Sun  
Notes:   
  
Affected versions  
JDK and JRE 7 Update 10 and earlier  
  
Tested on:  
\- Windows 7 with JDK/JRE 7 update 10  
  
To run from command line, first start the listener (UNIVERSAL):  
python commandlineInterface.py -l 192.168.1.10 -p 5555 -v 17  
  
And then run the exploit from clientd:  
python ./exploits/clientd/clientd.py -l 192.168.1.10 -d 5555 -O server_port:8080 -O allowed_attack_modules:java_MBeanInstantiator_findClass -O allowed_recon_modules:js_recon -O auto_detect_exploits:0  
  
  
Repeatability: Infinite (client side - no crash)  
References: http://malware.dontneedcoffee.com/2013/01/0-day-17u10-spotted-in-while-disable.html  
CVE Url: https://vulners.com/cve/CVE-2013-0422  
Date public: 01/10/2013