rapid7/metasploit-framework — pull request #3065 by jvennix-r7 (2014-03-04 23:18:01+00:00)
Title: Safari user-assisted download launch module

This adds a JSA-style user assisted exploit for all versions of safari. I noticed a while ago if I serve an zipped .app with a custom URL scheme to a Safari user, I can then immediately call that custom URL scheme from safari and launch the app. Quarantine prevents the app from just running, and the user is presented with a "Are you sure you want to launch this app". Funny enough, you can continually spam requests to the custom URL scheme and force the user into a loop until he clicks okay (this is the LOOP option). Another funny thing to do is the CONFUSE option, which tries to spawn tons of Terminal windows to further confuse and frustrate.

On 10.9, the CONFUSE option is not so useful, and the LOOP option sometimes goes too fast and will generate a "Unknown error failure" popup (imo this just adds to the confusion).

Verification:
- [ ] Run the module, visit the URL in any safari, click "Okay" when presented with the promp
- [ ] Play around with the LOOP and CONFUSE options