Land #2527, addonsdetect

lib/msf/core/exploit/http/server.rb

@@ -4,6 +4,7 @@ require 'rex/exploitation/obfuscatejs'
 require 'rex/exploitation/encryptjs'
 require 'rex/exploitation/heaplib'
 require 'rex/exploitation/javascriptosdetect'
+require 'rex/exploitation/javascriptaddonsdetect'
 
 module Msf
 

lib/rex/exploitation/javascriptaddonsdetect.js

@@ -0,0 +1,51 @@
+window.addons_detect = { };
+
+/**
+ * Returns the version of Microsoft Office. If not found, returns null.
+ **/
+window.addons_detect.getMsOfficeVersion = function () {
+  var version;
+  var types = new Array();
+  for (var i=1; i <= 5; i++) {
+    try {
+      types[i-1] = typeof(new ActiveXObject("SharePoint.OpenDocuments." + i.toString()));
+    }
+    catch (e) {
+      types[i-1] = null;
+    }
+  }
+
+  if (types[0] == 'object' && types[1] == 'object' && types[2] == 'object' &&
+      types[3] == 'object' && types[4] == 'object')
+  {
+    version = "2012";
+  }
+  else if (types[0] == 'object' && types[1] == 'object' && types[2] == 'object' &&
+           types[3] == 'object' && types[4] == null)
+  {
+    version = "2010";
+  }
+  else if (types[0] == 'object' && types[1] == 'object' && types[2] == 'object' &&
+           types[3] == null && types[4] == null)
+  {
+    version = "2007";
+  }
+  else if (types[0] == 'object' && types[1] == 'object' && types[2] == null &&
+           types[3] == null && types[4] == null)
+  {
+    version = "2003";
+  }
+  else if (types[0] == 'object' && types[1] == null && types[2] == null &&
+           types[3] == null && types[4] == null)
+  {
+    // If run for the first time, you must manullay allow the "Microsoft Office XP"
+    // add-on to run. However, this prompt won't show because the ActiveXObject statement
+    // is wrapped in an exception handler.
+    version = "xp";
+  }
+  else {
+    version = null;
+  }
+
+  return version;
+}

lib/rex/exploitation/javascriptaddonsdetect.rb

@@ -0,0 +1,29 @@
+# -*- coding: binary -*-
+
+require 'msf/core'
+require 'rex/text'
+require 'rex/exploitation/jsobfu'
+
+module Rex
+module Exploitation
+
+#
+# Provides javascript functions to determine addon information.
+#
+# getMsOfficeVersion(): Returns the version for Microsoft Office
+#
+class JavascriptAddonsDetect < JSObfu
+
+  def initialize(custom_js = '', opts = {})
+    @js = custom_js
+    @js += ::File.read(::File.join(::File.dirname(__FILE__), "javascriptaddonsdetect.js"))
+
+    super @js
+
+    return @js
+  end
+
+end
+end
+
+end