rapid7/metasploit-framework — pull request #1612 by neinwechter (2013-03-19 02:42:22+00:00)
Title: browser_autopwn exploit ordering updates (Bug #7253)

Updates to how browser_autopwn chooses exploits related to:
http://dev.metasploit.com/redmine/issues/7253

Results in higher ranked exploits being attempted before less stable low ranked exploits, regardless of status as a JS or non-JS related exploit.

I essentially placed JS and non-JS exploits into a single list (instead of the JS only list), ordered by exploit rank. If javascript is detected, this list is iterated through from highest exploit ranks to lowest and appropriate output written. When javascript support is not present, nothing changes from the past.

I have tested with clients connecting from OSX (Chrome), Ubuntu (Chrome and Firefox) and Windows XP (IE6,IE7,IE10), verifying exploit count and the fixed exploit order between pre-change and post-change versions of browser_autopwn (using debug to follow through on the client side).

Example of testing from IE6 in Windows:

**Original Version:**
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.2)

os_name Microsoft Windows
os_flavor XP
os_sp undefined
os_lang en-us
arch x86
ua_name MSIE
ua_version 7.0

starting exploits (42 total)
next_exploit(0)
trying /windows/browser/ie_createobject of 42
this client does not appear to be vulnerable to /windows/browser/ie_createobject
next_exploit(1)
trying /windows/browser/ms10_018_ie_behaviors of 42
test says it is vuln, writing iframe for /windows/browser/ms10_018_ie_behaviors
next_exploit(2)
trying /windows/browser/ms11_003_ie_css_import of 42
this client does not appear to be vulnerable to /windows/browser/ms11_003_ie_css_import
....
trying /multi/browser/java_jre17_method_handle of 42
test says it is vuln, writing iframe for /multi/browser/java_jre17_method_handle
next_exploit(40)
trying /multi/browser/java_rhino of 42
test says it is vuln, writing iframe for /multi/browser/java_rhino
next_exploit(41)
trying /multi/browser/java_verifier_field_access of 42
test says it is vuln, writing iframe for /multi/browser/java_verifier_field_access
next_exploit(42)
End

**New Version:**
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.2)

os_name Microsoft Windows
os_flavor XP
os_sp undefined
os_lang en-us
arch x86
ua_name MSIE
ua_version 7.0

starting exploits (42 total)
next_exploit(0)
trying /multi/browser/java_atomicreferencearray of 42
test says it is vuln, writing iframe for /multi/browser/java_atomicreferencearray
next_exploit(1)
trying /multi/browser/java_jre17_exec of 42
test says it is vuln, writing iframe for /multi/browser/java_jre17_exec
next_exploit(2)
trying /multi/browser/java_jre17_glassfish_averagerangestatisticimpl of 42
test says it is vuln, writing iframe for /multi/browser/java_jre17_glassfish_averagerangestatisticimpl
next_exploit(3)
...
trying /windows/browser/tom_sawyer_tsgetx71ex552 of 42
test threw an exception: Syntax error
next_exploit(40)
trying /windows/browser/winzip_fileview of 42
test threw an exception: Syntax error
next_exploit(41)
trying /windows/browser/wmi_admintools of 42
test says it is vuln, writing iframe for /windows/browser/wmi_admintools
next_exploit(42)
End