Skip to content

Commit c327073

Browse files
wchen-r7wchen-r7
committed
Merge branch 'bapv2_flash_test' into bapv2
2 parents 88a00b1 + 8384be6 commit c327073

File tree

8 files changed

+224
-5
lines changed

8 files changed

+224
-5
lines changed

‎data/flash_detector/flashdetector.swf

455 Bytes
Binary file not shown.

‎external/source/flash_detector/bin/expressInstall.swf

773 Bytes
Binary file not shown.

‎external/source/flash_detector/bin/index.html

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
<!DOCTYPE html>
2+
<html lang="en">
3+
<head>
4+
<meta charset="utf-8"/>
5+
<title>flash_detector</title>
6+
<meta name="description" content="" />
7+
8+
<script src="js/swfobject.js"></script>
9+
<script>
10+
var flashvars = {
11+
};
12+
var params = {
13+
menu: "false",
14+
scale: "noScale",
15+
allowFullscreen: "true",
16+
allowScriptAccess: "always",
17+
bgcolor: ""
18+
};
19+
var attributes = {
20+
id:"flashdetector"
21+
};
22+
swfobject.embedSWF(
23+
"flashdetector.swf",
24+
"altContent", "100%", "100%", "8.0.0",
25+
"expressInstall.swf",
26+
flashvars, params, attributes);
27+
</script>
28+
<style>
29+
html, body { height:100%; overflow:hidden; }
30+
body { margin:0; }
31+
</style>
32+
</head>
33+
<body>
34+
<div id="altContent">
35+
<h1>flash_detector</h1>
36+
<p><a href="http://www.adobe.com/go/getflashplayer">Get Adobe Flash player</a></p>
37+
</div>
38+
</body>
39+
</html>

‎external/source/flash_detector/bin/js/swfobject.js

Lines changed: 4 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎external/source/flash_detector/flash_detector.as2proj

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<project>
3+
<!-- Output SWF options -->
4+
<output>
5+
<movie disabled="False" />
6+
<movie input="" />
7+
<movie path="bin\flashdetector.swf" />
8+
<movie fps="30" />
9+
<movie width="800" />
10+
<movie height="600" />
11+
<movie version="8" />
12+
<movie background="#FFFFFF" />
13+
</output>
14+
<!-- Other classes to be compiled into your SWF -->
15+
<classpaths>
16+
<class path="src" />
17+
</classpaths>
18+
<!-- Build options -->
19+
<build>
20+
<option verbose="False" />
21+
<option strict="False" />
22+
<option infer="False" />
23+
<option useMain="True" />
24+
<option useMX="False" />
25+
<option warnUnusedImports="False" />
26+
<option traceMode="FlashConnectExtended" />
27+
<option traceFunction="" />
28+
<option libraryPrefix="" />
29+
<option excludeFile="" />
30+
<option groupClasses="False" />
31+
<option frame="1" />
32+
<option keep="True" />
33+
</build>
34+
<!-- Class files to compile (other referenced classes will automatically be included) -->
35+
<compileTargets>
36+
<compile path="src\Main.as" />
37+
</compileTargets>
38+
<!-- Assets to embed into the output SWF -->
39+
<library>
40+
<!-- example: <asset path="..." id="..." update="..." glyphs="..." mode="..." place="..." sharepoint="..." /> -->
41+
</library>
42+
<!-- Paths to exclude from the Project Explorer tree -->
43+
<hiddenPaths>
44+
<!-- example: <hidden path="..." /> -->
45+
</hiddenPaths>
46+
<!-- Executed before build -->
47+
<preBuildCommand />
48+
<!-- Executed after build -->
49+
<postBuildCommand alwaysRun="False" />
50+
<!-- Other project options -->
51+
<options>
52+
<option showHiddenPaths="False" />
53+
<option testMovie="Default" />
54+
</options>
55+
</project>

‎external/source/flash_detector/src/Main.as

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
import flash.external.ExternalInterface
2+
import System.capabilities
3+
4+
class Main
5+
{
6+
7+
public static function main(swfRoot:MovieClip):Void
8+
{
9+
// entry point
10+
var app:Main = new Main();
11+
}
12+
13+
public function Main()
14+
{
15+
var version:String = getVersion()
16+
ExternalInterface.call("setFlashVersion", version)
17+
}
18+
19+
private function getVersion():String
20+
{
21+
try {
22+
var version:String = capabilities.version
23+
version = version.split(" ")[1]
24+
version = version.split(",").join(".")
25+
return version
26+
} catch (err:Error) {
27+
return ""
28+
}
29+
}
30+
31+
}

‎lib/msf/core/exploit/remote/browser_exploit_server.rb

Lines changed: 94 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -90,6 +90,7 @@ def initialize(info={})
9090
@info_receiver_page = Rex::Text.rand_text_alpha(5)
9191
@exploit_receiver_page = Rex::Text.rand_text_alpha(6)
9292
@noscript_receiver_page = Rex::Text.rand_text_alpha(7)
93+
@flash_swf = "#{Rex::Text.rand_text_alpha(9)}.swf"
9394

9495
register_options(
9596
[
@@ -372,6 +373,57 @@ def get_detection_html(user_agent)
372373
return Base64.encode(q.join('&'));
373374
}
374375
376+
function isEmpty(str) {
377+
return (!str \|\| 0 === str.length);
378+
}
379+
380+
function sendInfo(info) {
381+
var query = objToQuery(info);
382+
postInfo("<%=get_resource.chomp("/")%>/<%=@info_receiver_page%>/", query, function(){
383+
window.location="<%= get_module_resource %>";
384+
});
385+
}
386+
387+
var flashVersion = "";
388+
var doInterval = true;
389+
var maxTimeout = null;
390+
var intervalTimeout = null;
391+
392+
function setFlashVersion(ver) {
393+
flashVersion = ver
394+
if (maxTimeout != null) {
395+
clearTimeout(maxTimeout);
396+
maxTimeout = null
397+
}
398+
doInterval = false
399+
return;
400+
}
401+
402+
function createFlashObject(src, attributes, parameters) {
403+
var i, html, div, obj, attr = attributes \|\| {}, param = parameters \|\| {};
404+
attr.type = 'application/x-shockwave-flash';
405+
if (window.ActiveXObject) {
406+
attr.classid = 'clsid:d27cdb6e-ae6d-11cf-96b8-444553540000';
407+
param.movie = src;
408+
} else {
409+
attr.data = src;
410+
}
411+
412+
html = '<object';
413+
for (i in attr) {
414+
html += ' ' + i + '="' + attr[i] + '"';
415+
}
416+
html += '>';
417+
for (i in param) {
418+
html += '<param name="' + i + '" value="' + param[i] + '" />';
419+
}
420+
html += '</object>';
421+
div = document.createElement('div');
422+
div.innerHTML = html;
423+
obj = div.firstChild;
424+
div.removeChild(obj);
425+
return obj;
426+
}
375427
376428
window.onload = function() {
377429
var osInfo = os_detect.getVersion();
@@ -409,10 +461,36 @@ def get_detection_html(user_agent)
409461
<% end %>
410462
<% end %>
411463
412-
var query = objToQuery(d);
413-
postInfo("<%=get_resource.chomp("/")%>/<%=@info_receiver_page%>/", query, function(){
414-
window.location="<%= get_module_resource %>";
415-
});
464+
if (d["flash"] != null && (d["flash"].match(/[\\d]+.[\\d]+.[\\d]+.[\\d]+/)) == null) {
465+
var flashObject = createFlashObject('<%=get_resource.chomp("/")%>/<%=@flash_swf%>', {width: 1, height: 1}, {allowScriptAccess: 'always', Play: 'True'});
466+
467+
// After 5s stop waiting and use the version retrieved with JS if there isn't anything
468+
maxTimeout = setTimeout(function() {
469+
if (intervalTimeout != null) {
470+
doInterval = false
471+
clearInterval(intervalTimeout)
472+
}
473+
if (!isEmpty(flashVersion)) {
474+
d["flash"] = flashVersion
475+
}
476+
sendInfo(d);
477+
}, 5000);
478+
479+
// Check if there is a new flash version every 100ms
480+
intervalTimeout = setInterval(function() {
481+
if (!doInterval) {
482+
clearInterval(intervalTimeout);
483+
if (!isEmpty(flashVersion)) {
484+
d["flash"] = flashVersion
485+
}
486+
sendInfo(d);
487+
}
488+
}, 100);
489+
490+
document.body.appendChild(flashObject)
491+
} else {
492+
sendInfo(d)
493+
}
416494
}
417495
|).result(binding())
418496

@@ -446,6 +524,13 @@ def cookie_header(tag)
446524
cookie
447525
end
448526

527+
def load_swf_detection
528+
path = ::File.join(Msf::Config.data_directory, 'flash_detector', 'flashdetector.swf')
529+
swf = ::File.open(path, 'rb') { |f| swf = f.read }
530+
531+
swf
532+
end
533+
449534

450535
# Handles exploit stages.
451536
#
@@ -469,6 +554,11 @@ def on_request_uri(cli, request)
469554
html = get_detection_html(ua)
470555
send_response(cli, html, {'Set-Cookie' => cookie_header(tag)})
471556

557+
when /#{@flash_swf}/
558+
vprint_status("Sending SWF used for Flash detection")
559+
swf = load_swf_detection
560+
send_response(cli, swf, {'Content-Type'=>'application/x-shockwave-flash', 'Cache-Control' => 'no-cache, no-store', 'Pragma' => 'no-cache'})
561+
472562
when /#{@info_receiver_page}/
473563
#
474564
# The detection code will hit this if Javascript is enabled

‎modules/auxiliary/server/browser_autopwn2.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,7 @@ def initialize(info={})
7878

7979
register_advanced_options([
8080
OptInt.new('ExploitReloadTimeout', [false, 'Number of milliseconds before trying the next exploit', 3000]),
81-
OptInt.new('MaxExploitCount', [false, 'Number of browser exploits to load', 20]),
81+
OptInt.new('MaxExploitCount', [false, 'Number of browser exploits to load', 21]),
8282
OptString.new('HTMLContent', [false, 'HTML Content', '']),
8383
OptAddressRange.new('AllowedAddresses', [false, "A range of IPs you're interested in attacking"]),
8484
OptInt.new('MaxSessionCount', [false, 'Number of sessions to get', -1]),

0 commit comments

Comments
 (0)