Add Adobe Flash version detection in JavaScript

[wchen-r7]

This adds Adobe Flash version detection in JavaScript. In order to test this, I also updated the firefox_svg_plugin exploit module so you can use it as a test case.

Verification

• Make sure you have Mozilla Firefox 17: http://www.oldapps.com/firefox.php?old_firefox=8492
• Make sure you have Adobe Flash for FF: http://get.adobe.com/flashplayer/
• Test the firefox_svg_plugin exploit. The browser should pass the exploitable requirements.
• Uninstall Flash on your test box
• Test the exploit again. This time you should be denied because of the flash requirement.

Demo

With Flash:

msf exploit(firefox_svg_plugin) > [*] 10.0.1.91        firefox_svg_plugin - Gathering target information.
[*] 10.0.1.91        firefox_svg_plugin - Sending response HTML.
[*] 10.0.1.91        firefox_svg_plugin - Target selected: Universal (Javascript XPCOM Shell)
[*] 10.0.1.91        firefox_svg_plugin - Sending Firefox 17.0.1 Flash Privileged Code Injection
[*] 10.0.1.91        firefox_svg_plugin - Sending .swf trigger.
[*] 10.0.1.91        firefox_svg_plugin - Sending .swf trigger.
[*] Command shell session 1 opened (10.0.1.76:4444 -> 10.0.1.91:49918) at 2014-03-28 15:36:01 -0500

Without Flash:

msf exploit(firefox_svg_plugin) > [*] 10.0.1.91        firefox_svg_plugin - Gathering target information.
[*] 10.0.1.91        firefox_svg_plugin - Sending response HTML.
[!] 10.0.1.91        firefox_svg_plugin - Exploit requirement(s) not met: flash

[jvazquez-r7]

Working on it!

[jvazquez-r7]

• With FF 17 and Flash:

msf exploit(firefox_svg_plugin) > 
[*] 192.168.172.135  firefox_svg_plugin - Gathering target information.
[*] 192.168.172.135  firefox_svg_plugin - Sending response HTML.
[*] 192.168.172.135  firefox_svg_plugin - Target selected: Universal (Javascript XPCOM Shell)
[*] 192.168.172.135  firefox_svg_plugin - Sending Firefox 17.0.1 Flash Privileged Code Injection
[*] 192.168.172.135  firefox_svg_plugin - Sending .swf trigger.
[*] 192.168.172.135  firefox_svg_plugin - Sending .swf trigger.
[*] Command shell session 1 opened (10.6.0.136:4444 -> 10.6.0.136:53682) at 2014-04-02 15:12:17 -0500

• With just FF17

msf exploit(firefox_svg_plugin) > [*] 192.168.172.135  firefox_svg_plugin - Gathering target information.
[*] 192.168.172.135  firefox_svg_plugin - Sending response HTML.
[!] 192.168.172.135  firefox_svg_plugin - Exploit requirement(s) not met: flash

Landing!