Land #18355, Fixes OpenJDK reflection issue.

This PR updates metasploit-framework side for the metasploit-payloads fix #672. This PR also includes metasploit-framework PR #18445 which bumps the metasploit-payloads gem version to 2.0.156.
rapid7 · Oct 11, 2023 · 7f4a9c4 · 7f4a9c4
2 parents 6c33bf9 + 8743665
commit 7f4a9c4
Show file tree

Hide file tree

Showing 4 changed files with 5 additions and 6 deletions.
diff --git a/Gemfile.lock b/Gemfile.lock
@@ -33,7 +33,7 @@ PATH
       metasploit-concern
       metasploit-credential
       metasploit-model
-      metasploit-payloads (= 2.0.154)
+      metasploit-payloads (= 2.0.156)
       metasploit_data_models
       metasploit_payloads-mettle (= 1.0.26)
       mqtt
@@ -278,7 +278,7 @@ GEM
       activemodel (~> 7.0)
       activesupport (~> 7.0)
       railties (~> 7.0)
-    metasploit-payloads (2.0.154)
+    metasploit-payloads (2.0.156)
     metasploit_data_models (6.0.3)
       activerecord (~> 7.0)
       activesupport (~> 7.0)

diff --git a/LICENSE_GEMS b/LICENSE_GEMS
@@ -80,7 +80,7 @@ metasploit-concern, 5.0.1, "New BSD"
 metasploit-credential, 6.0.5, "New BSD"
 metasploit-framework, 6.3.38, "New BSD"
 metasploit-model, 5.0.1, "New BSD"
-metasploit-payloads, 2.0.154, "3-clause (or ""modified"") BSD"
+metasploit-payloads, 2.0.156, "3-clause (or ""modified"") BSD"
 metasploit_data_models, 6.0.2, "New BSD"
 metasploit_payloads-mettle, 1.0.26, "3-clause (or ""modified"") BSD"
 method_source, 1.0.0, MIT

diff --git a/lib/msf/core/payload/java/meterpreter_loader.rb b/lib/msf/core/payload/java/meterpreter_loader.rb
@@ -88,8 +88,7 @@ def stage_class_files
     # a second jar.
     [
       [ "javapayload", "stage", "Stage.class" ],
-      [ "com", "metasploit", "meterpreter", "MemoryBufferURLConnection.class" ],
-      [ "com", "metasploit", "meterpreter", "MemoryBufferURLStreamHandler.class" ],
+      [ "com", "metasploit", "meterpreter", "JarFileClassLoader.class" ],
       # Must be last!
       [ "javapayload", "stage", "Meterpreter.class" ],
     ]

diff --git a/metasploit-framework.gemspec b/metasploit-framework.gemspec
@@ -72,7 +72,7 @@ Gem::Specification.new do |spec|
   # are needed when there's no database
   spec.add_runtime_dependency 'metasploit-model'
   # Needed for Meterpreter
-  spec.add_runtime_dependency 'metasploit-payloads', '2.0.154'
+  spec.add_runtime_dependency 'metasploit-payloads', '2.0.156'
   # Needed for the next-generation POSIX Meterpreter
   spec.add_runtime_dependency 'metasploit_payloads-mettle', '1.0.26'
   # Needed by msfgui and other rpc components