CVE-2010-0886

This Metasploit module exploits CVE-2010-0886, a flaw in Sun Java Web Start Plugin where command line arguments are improperly validated. It leverages the -J and -XXaltjvm options to execute arbitrary code via a malicious JNLP file served over HTTP.

This exploit leverages insufficient parameter validation in the Java Deployment Toolkit's launch() method to pass arbitrary command-line arguments to javaws.exe, enabling remote code execution via a malicious JAR file loaded from a UNC path.

This Metasploit module exploits CVE-2010-0886, a command line argument injection vulnerability in Sun Java Web Start Plugin. It leverages the -J and -XXaltjvm options to execute arbitrary code via a crafted JNLP file, targeting Windows systems with WebClient service enabled.

This Metasploit module exploits CVE-2010-0886 by leveraging the -J and -XXaltjvm Java Web Start plugin options to execute arbitrary code via a crafted JNLP file. It uses WebDAV and SMB to deliver a malicious DLL payload to vulnerable Windows systems.

The writeup details a logic flaw in Java JRE's Web Start support, where command-line parameters are not validated, allowing attackers to inject malicious parameters via crafted HTML embed tags. The analysis includes disassembly snippets and explains how the '-XXaltjvm' parameter can be abused to load a malicious JVM library.