rapid7/metasploit-framework — pull request #2613 by wchen-r7 (2013-11-07 07:44:46+00:00)
Title: Add BrowserExploitServer mixin

This is a mixin for browser exploit development. This release includes the following features:

* Browser exploits can be written as ERB templates.
* The mixin does the browser detection automatically. The detection stage by default relies on Javascript (obfuscated), or it can gather target info based on HTTP headers if Javascript is disabled.
* The mixin can share browser information with the exploit(os name, office version, java version, browser name/version, proxy, etc)
* Modules can define "BrowserRequirements". If these requirements aren't met, the mixin will refuse to serve the exploit to the target (HTTP 404). The module can also define target-specific requirements.
* A browser's active session is tracked by the mixin with a cookie (or IP+user-agent if cookies are disabled). This allows the exploit to refuse to serve the malicious code again due to various reasons. You can set this with the "Retries" datastore option.
* Added support for automatic target selection
* The mixin keeps track of the "target" variable, that way it won't be lost when it's being passed around in the module
* ActiveX detection for Internet Explorer
* Java version detection for multiple browsers
* Added support for IE10/Win 7 SP1 detection
* New functions in RopDb to generate ROP junks and ROP nops
* Added support to transfer information using ajax
* A target-specific payload can be generated based on the mixin knows about the target (os, arch)

Everything is also documented, run "yard" to see. Some methods are spec'd, some will need to rely some manual testing for now.

There are more features planned for the mixin, but won't be included in this release.

This PR also covers the following Redmine tickets:
http://dev.metasploit.com/redmine/issues/8501
http://dev.metasploit.com/redmine/issues/5005

In order to do manual testing, I suggest you play with test/modules/exploits/test/browserexploitserver.rb module.