metasploit-framework

https://github.com/rapid7/metasploit-framework

Ruby

Metasploit Framework

Msf::Payload::Firefox#run_cmd_source

Javascript source code of runCmd(str,cb) - runs a shell command on the OS

Because of a limitation of firefox, we cannot retrieve the shell output
so the stdout/err are instead redirected to a temp file, which is read and
destroyed after the command completes.

On posix, the command is double wrapped in "/bin/sh -c" calls, the outer of
which redirects stdout.

On windows, the command is wrapped in two "cmd /c" calls, the outer of which
redirects stdout. A JScript "launch" file is dropped and invoked with wscript
to run the command without displaying the cmd.exe prompt.

When the command contains the pattern "[JAVASCRIPT] ... [/JAVASCRIPT]", the
javascript code between the tags is eval'd and returned.

Source | Google | Stack overflow

Edit

git clone [email protected]:rapid7/metasploit-framework.git

cd metasploit-framework

open lib/msf/core/payload/firefox.rb

Contribute

# Make a new branch

git checkout -b -your-name--update-docs-Msf--Payload--Firefox-run_cmd_source-for-pr

# Commit to git

git add lib/msf/core/payload/firefox.rbgit commit -m "better docs for Msf::Payload::Firefox#run_cmd_source"

# Open pull request

gem install hub # on a mac you can `brew install hub`

hub fork

git push <your name> -your-name--update-docs-Msf--Payload--Firefox-run_cmd_source-for-pr

hub pull-request

# Celebrate!