Recently I wanted to test a client-side attack against the IE6 browser to see how vulnerable it was. So, I set up a WIndows XP box, fully patched to SP3, but being sure not to upgrade the browser at all from IE6.
Then I went through the Social Engineering Toollkit (SET) browser exploits trying to pwn my host, browsing to each exploit in the toolkit.
I thought that I'd easily pwn IE6, since it is so old, but I was surprised that out of the 21 exploits in the SET menu, only ONE worked! That exploit was "ie_unsafe_scripting", and even that exploit popped up an alert on the victim box stating "An ActiveX control might be unsafe to interact with other parts of the page. Do you want to allow this interaction?" If the user clicks yes (or if they have "Initialize and script ActiveX controls not marked to safe" marked as "Enable"), they are pwned.
So the lesson learned for me is that the browser exploits in Metasploit, even against an ancient and vulnerable browser like IE6, need other features aside from the default installation (like .Net 2.0, Adobe Flash, Java, etc). A default, bare-bones IE6 is actually tougher to pwn than I thought.
Then I went through the Social Engineering Toollkit (SET) browser exploits trying to pwn my host, browsing to each exploit in the toolkit.
I thought that I'd easily pwn IE6, since it is so old, but I was surprised that out of the 21 exploits in the SET menu, only ONE worked! That exploit was "ie_unsafe_scripting", and even that exploit popped up an alert on the victim box stating "An ActiveX control might be unsafe to interact with other parts of the page. Do you want to allow this interaction?" If the user clicks yes (or if they have "Initialize and script ActiveX controls not marked to safe" marked as "Enable"), they are pwned.
So the lesson learned for me is that the browser exploits in Metasploit, even against an ancient and vulnerable browser like IE6, need other features aside from the default installation (like .Net 2.0, Adobe Flash, Java, etc). A default, bare-bones IE6 is actually tougher to pwn than I thought.
Comments
Post a Comment