Adds a :vuln_test option to BES, just like in BAP.
I needed this to run a custom JS check for the Android webview vuln when the exploit is served straight through BES. The check already existed when using BAP, so I tried to preserve that syntax, and also added a :vuln_test_error as an optional error message. This commit also does some mild refactoring of un- useful behavior in BES.
This commit is contained in:
@@ -12,18 +12,20 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||
include Msf::Exploit::Remote::BrowserAutopwn
|
||||
include Msf::Exploit::Android
|
||||
|
||||
VULN_CHECK_JS = %Q|
|
||||
for (i in top) {
|
||||
try {
|
||||
top[i].getClass().forName('java.lang.Runtime');
|
||||
is_vuln = true; break;
|
||||
} catch(e) {}
|
||||
}
|
||||
|
|
||||
|
||||
autopwn_info(
|
||||
:os_flavor => 'Android',
|
||||
:javascript => true,
|
||||
:rank => ExcellentRanking,
|
||||
:vuln_test => %Q|
|
||||
for (i in top) {
|
||||
try {
|
||||
top[i].getClass().forName('java.lang.Runtime');
|
||||
is_vuln = true; break;
|
||||
} catch(e) {}
|
||||
}
|
||||
|
|
||||
:vuln_test => VULN_CHECK_JS
|
||||
)
|
||||
|
||||
def initialize(info = {})
|
||||
@@ -71,7 +73,9 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||
'DefaultTarget' => 0,
|
||||
'BrowserRequirements' => {
|
||||
:source => 'script',
|
||||
:os_flavor => 'Android'
|
||||
:os_flavor => 'Android',
|
||||
:vuln_test => VULN_CHECK_JS,
|
||||
:vuln_test_error => 'No vulnerable Java objects were found in this web context.'
|
||||
}
|
||||
))
|
||||
|
||||
|
||||
Reference in New Issue
Block a user