Summary: I would like to show a proof of concept of a Java exploit using an old JRE
on an up-to-date machine to cut short discussions on the "but we are patched so why removing older versions" subject.
(I am not a developer - apologies for possible unfortunate expressions below.)
Details: When patching Java (at least on MS Windows) the JRE
us updated to the latest version (there is a single jre
folder in <path to Java install>
) but the JDK
is updated though a new jdk<version>
folder, which also contains a JRE
.
Oracle allows to choose the version to run in an applet so I would like to show a proof of concept of the style
- someone with an up-to-date Java install connects to a web page with the "malicious" applet
- something "bad" happens showing that he/she is hacked
I was initially thinking about writing a minimal applet (I will find help on that subject locally) and using Metasploit to run the actual attack - it seems however that the Metasploit payloads are not configurable (in the sense of using java_version
to hit an older version of Java)
Note: this is a practical followup of a discussion on detecting Java vulnerabilities on the nessus forum.