Re: Java Signed Applet / Sign it with CA Certificate

[scriptjunkie <scriptjunkie1 () googlemail com>]

Well, right now it's not easy, but it could be fixed without too much
trouble. The relevant code is in
msf3/lib/msf/core/exploit/java.rb
jarsigner_opts = [
"-keystore", msf_keystore, "-storepass", msf_store_pass,
"-keypass", msf_key_pass, "-signedJar",
File.join(datastore['JavaCache'], signed_jar), # Signed Jar
File.join(datastore['JavaCache'], unsiged_jar),  # Input Jar we're signing
cert_alias  # The cert we're using
]
signer_klass._invoke('JarSignerMSF','[Ljava.lang.String;',jarsigner_opts)

I would assume you could substitute  msf_keystore msf_store_pass and
msf_key_pass for your own keystore information. That should probably
be an option. Can you create a redmine ticket for this?
https://www.metasploit.com/redmine/projects/framework/issues/new



On Wed, Mar 16, 2011 at 8:37 AM, John Mistikopoulos
<mailtest1223133456 () gmail com> wrote:
> Yes! But how I can instruct the signed applet that I 'll I create, to execute the desired payload?
> (I assume that the files that msf uses are under the folder "/opt/metasploit3/msf3/data/exploits/java_signed_applet", 
> right?)
>
> On Wed, Mar 16, 2011 at 2:35 PM, AK <platsakos () gmail com> wrote:
> > You mean something like that ?
> >
> > http://java.sun.com/developer/onlineTraining/Programming/JDCBook/signed.html
> >
> > Cheers
> >
> > On 03/16/2011 09:55 AM, JOhn Mistikopoulos wrote:
> >
> > Greetings to everyone!
> >
> > I am experimenting on the Java Signed Applet.
> > I 'd like to ask if there is any way to sign this applet with my own
> > certificate, issued by a CA.
> > Thanks in advance,
> >
> > --John
> >
> >
> > _______________________________________________
> > https://mail.metasploit.com/mailman/listinfo/framework
> >
> >
> > --
> > -- thanasisk
>
> _______________________________________________
> https://mail.metasploit.com/mailman/listinfo/framework



--
scriptjunkie
https://scriptjunkie1.wordpress.com/
_______________________________________________
https://mail.metasploit.com/mailman/listinfo/framework