Adding new skills to the Metasploit Firefox addon

I have been modifying the firefox_xpi_bootstrapped_addon exploit of Metasploit to add some new skills that were necessary to make it more real (for SE) and successful.

From the beginning:
Firefox uses .xpi extensions, in this case uses the restless method, which is able to install the addon and execute it without rebooting the browser.
Here you have more info about the Mozilla Bootstrap addons.

Signatures not required

The bad news:
The last versions of Firefox have the xpinstall.signatures.required flag enabled, and we have to disable it if we want to execute unsigned ones. So by default it’s only possible to execute addons signed by Mozilla (previous review).

The worst news:
In future versions of Firefox it will not be possible to disable the signatures, and only Mozilla signed addons could be executed.

The good news:
Special versions of Firefox ESR will still have the xpinstall flag in the about:config.
Many companies disable it to execute their own plugins. (In this case Mozilla offers the possibility to sign it and store it in a local repository, not the public market)

Here you have more info about the signatures and versions.

This is the MSF exploit that we are going to use:

Once executed it creates a webserver with the plugin

Downloading and unziping the addon

Now the funny part, what we want to do?
– We want to know when the user executes the addon.
– We want to get all his cookies (all the cookies of the browser, doesn’t matter if they have httponly).

– Because in a phishing attack, it will be very suspicious to execute a plugin that doesn’t do anything. Once the user installs it, we set a cookie that the Javascript code in the client side will read and make some action.
– Because it’s very powerful getting all the cookies in that easy way, and at least we could still have them in the worst case that the RCE exploit fails for any reason.

We are not going to explain all the Metasploit payload, just the code we added.


– In firs place we enumerate all the cookies of the selected domain, and we send them via GET to our external server. It could be also possible to concatenate all of them and send it via POST. (In this case all the user cookies are sent by HTTP so it’s not recommendable at all to use unsecure protocols)
– We create a cookie to be checked by the JavaScript code on client side.
– We also send a request to the server to know that this user executed the plugin.

With this little tricks it’s easy to evade AV as it’s executed on Firefox directly and the stage is encrypted with RC4, it’s easy to fool the users as you can make post execution actions, and easy to get all the cookies as a bonus.

The code works well, but we have not tested it very hard, so we are not responsible for any misuse.

Violent Rapberry Pi Zero: Configuration – Part 1

As it’s possible to configure the USB port of the Raspberry Pi Zero as an Ethernet (also  HID, hard drive) device, we will try to imitate the USB Armory attacks in a cheaper open-source hardware.

Objectives Part 1:  Configure the Pi to enable the USB Ethernet and connect trough SSH.

We will follow the instructions to modify the image:

  1. Flash Raspbian Jessie onto the SD card.
  2. In the boot partition:
    • config.txt  -(Add)–> dtoverlay=dwc2
    • cmdline.txt -(Add after rootwait)–> modules-load=dwc2,g_ether

In this case we will connect through the serial port to the Raspberry Pi to check the IP, as we can not SSH into it using the raspberrypi.local address. (and because we can 😀 )

We will connect with the Bus Pirate tool to the UART port.

Check the color of the UART wires (gray and black):

Bus Pirate Pinout diagram (take care as the color of the wires depends on the way it was soldered)

Check the Pins of the UART protocol (GPIO 14 and 15):

Raspberry Pi Zero Pinout diagram


Connection resume:
  • Bus Pirate Red wire      –> RPI Pin #3 (3.3V)
  • Bus Pirate Black wire   –> RPI Pin #8 (GPIO14)
  • Bus Pirate Gray wire     –> RPI Pin #10 (GPIO15)
  • Bus Pirate Brown wire  –> RPI Pin #34 (GND)
Bus Pirate –  Raspberry connection

UART connection through Bus Pirate and SSH through USB0 interface:

Actually the simplest way is to edit the dhcpcd.conf file after flashing the SD:

Add the static IP configuration in the Raspberry Pi (/etc/dhcpcd.conf):
interface usb0
static ip_address=

Add the static IP configuration in the host: