Rapid7 Vulnerability & Exploit Database

Apple Safari Webkit libxslt Arbitrary File Creation

Back to Search

Apple Safari Webkit libxslt Arbitrary File Creation

Disclosed
07/20/2011
Created
05/30/2018

Description

This module exploits a file creation vulnerability in the Webkit rendering engine. It is possible to redirect the output of a XSLT transformation to an arbitrary file. The content of the created file must be ASCII or UTF-8. The destination path can be relative or absolute. This module has been tested on Safari and Maxthon. Code execution can be achieved by first uploading the payload to the remote machine in VBS format, and then upload a MOF file, which enables Windows Management Instrumentation service to execute the VBS.

Author(s)

  • Nicolas Gregoire

Platform

Windows

Development

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use exploit/windows/browser/safari_xslt_output
msf exploit(safari_xslt_output) > show targets
    ...targets...
msf exploit(safari_xslt_output) > set TARGET < target-id >
msf exploit(safari_xslt_output) > show options
    ...show and set options...
msf exploit(safari_xslt_output) > exploit

Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.

– Jim O’Gorman | President, Offensive Security

;