Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
if log.ThugOpts.features_logging:
log.ThugLogging.Features.increase_url_count()
try:
self.window._navigator.fetch(data,
redirect_type = "object data",
params = params)
except Exception as e:
log.info("[ERROR][handle_object] %s", str(e))
if not log.ThugOpts.Personality.isIE():
return
if classid:
try:
axo = _ActiveXObject(self.window, classid, 'id')
except TypeError as e: # pragma: no cover
log.info("[ERROR][handle_object] %s", str(e))
return
if _id is None:
return
try:
setattr(self.window, _id, axo)
setattr(self.window.doc, _id, axo)
except TypeError as e: # pragma: no cover
log.info("[ERROR][handle_object] %s", str(e))
def CreateObject(self, strProgID, strPrefix = ""):
import thug.ActiveX as ActiveX
log.ThugLogging.add_behavior_warn("[WScript.Shell ActiveX] CreateObject (%s)" % (strProgID))
log.ThugLogging.log_exploit_event(self._window.url,
"WScript.Shell ActiveX",
"CreateObject",
data = {
"strProgID": strProgID,
"strPrefix": strPrefix
},
forward = False)
return ActiveX.ActiveX._ActiveXObject(self._window, strProgID)
def CreateObject(self, _object, param = ''):
import thug.ActiveX as ActiveX
log.ThugLogging.add_behavior_warn("[VsaIDE.DTE ActiveX] CreateObject (%s)" % (_object))
log.ThugLogging.log_exploit_event(self._window.url,
"VsaIDE.DTE ActiveX",
"CreateObject",
data = {
"object": _object
},
forward = False)
return ActiveX.ActiveX._ActiveXObject(self._window, _object)
def CreateObject(self, _object, param = ''):
import thug.ActiveX as ActiveX
log.ThugLogging.add_behavior_warn("[VisualStudio.DTE.8.0 ActiveX] CreateObject (%s)" % (_object))
log.ThugLogging.log_exploit_event(self._window.url,
"VisualStudio.DTE.8.0 ActiveX",
"CreateObject",
data = {
"object": _object
},
forward = False)
return ActiveX.ActiveX._ActiveXObject(self._window, _object)
def _do_ActiveXObject(self, cls, typename = 'name'):
return _ActiveXObject(self, cls, typename)
def __init_window_personality_IE(self):
from .ClipboardData import ClipboardData
from .Console import Console
from .External import External
from thug.DOM.W3C.DOMParser import DOMParser
log.ThugOpts.activex_ready = False
if not (log.ThugOpts.local and log.ThugOpts.attachment):
self.XMLHttpRequest = self._XMLHttpRequest
self.document = self._document
self.ActiveXObject = self._do_ActiveXObject
self.DeferredListDataComplete = self._DeferredListDataComplete
self.CollectGarbage = self._CollectGarbage
self.WScript = _ActiveXObject(self, "WScript.Shell")
self.navigate = self._navigate
self.clientInformation = self.navigator
self.clipboardData = ClipboardData()
self.external = External()
self.console = Console()
self.ScriptEngineMajorVersion = log.ThugOpts.Personality.ScriptEngineMajorVersion
self.ScriptEngineMinorVersion = log.ThugOpts.Personality.ScriptEngineMinorVersion
self.ScriptEngineBuildVersion = log.ThugOpts.Personality.ScriptEngineBuildVersion
if log.ThugOpts.Personality.browserMajorVersion < 11:
self.execScript = self._execScript
self.attachEvent = self._attachEvent
self.detachEvent = self._detachEvent
if log.ThugOpts.Personality.browserMajorVersion >= 8:
self.DOMParser = DOMParser
obj = c
break
if not obj:
log.warning("Unknown ActiveX Object: %s", cls)
raise TypeError()
if log.ThugOpts.activex_ready:
log.warning("ActiveXObject: %s", cls)
if log.ThugOpts.features_logging and log.ThugOpts.activex_ready:
log.ThugLogging.Features.increase_activex_count()
for method_name, method in obj['methods'].items():
# _method = new.instancemethod(method, self, _ActiveXObject)
_method = method.__get__(self, _ActiveXObject)
setattr(self, method_name, _method)
methods[method] = _method
for attr_name, attr_value in obj['attrs'].items():
setattr(self, attr_name, attr_value)
for attr_name, attr_value in obj['funcattrs'].items():
self.funcattrs[attr_name] = methods[attr_value]
if cls.lower() in ('wscript.shell', ):
self.scriptFullName = log.ThugLogging.url if log.ThugOpts.local else ''