7 ms·
New Metasploit 0-day exploit for IE 7, 8 & 9 on Windows XP, Vista, and 7
- RutZap 14y agoI sure hope this exploit gets a lot of attention, in this way most people will understand the importance of upgrading their browser and thus... we, web developers, will not have to support crappy browsers (IE7 I'm looking at you!) :D
- recursive 14y agoCould someone who understands them explain the screenshots to me like I was 5? I'm familiar with ruby, internet explorer, and virtual machines, but I can not make any sense of these images.
- burlyscudd 14y agoHe's running a web server process w/ Metasploit, configured to serve/run the exploit module. Then he issues a GET request to the server w/ the affected browser and gets a session in Metasploit (framework). The screenshots are basically proof showing that the session (connection to compromised machine w/ high-level/root access) has been created.
- xtdx 14y agoIt's not root access. It's access as whatever user was running the browser.
- burlyscudd 14y agoYeah fair point that this exploit gives privs @ the level of the browser's current user. In that parenthetical, I was basically trying to explain what "session" means in Metasploit parlance in general.
- Ntrails 14y agoIgnoring that most users run their main windows login as administrator, if we pretend it's just a guest account, how much of an impediment would that to them disrupting any anti-virus and installing a some malware?
- xtdx 14y agoAre you asking if anybody has a 0day windows kernel exploit? Or if lots of users are going to click okie dokie when the uac prompt comes up? I'd say yes and yes.
- greedo 14y agoGoogle hashdump...
- xtdx 14y agoIs your point that local user access is valuable? Was that ever in doubt?
- burlyscudd 14y agoNope
- jneal 14y agoCan't say I'm ever surprised when exploits like this pop up, but it's definitely valuable to know. I don't use IE nor manage users on IE so I know I'm fine, but those of you out there using it or managing users that use it should probably take this as an opportunity to re-educate users on security best practices including email attachments and visiting unfamiliar websites. Also important to note that some websites you may be familiar with could become compromised and attack-code added within iFrames is very common, so it's best to just not use IE at all until a patch is released.
- givan 14y agoComputers can get compromised simply by visiting a malicious website Since Microsoft has not released a patch for this vulnerability yet, Internet users are strongly advised to switch to other browsers. The long release cycle of internet explorer is a very big problem for ie users, unfortunately most of them don't even now what a browser is.
- greenyoda 14y agoThe long release cycle for new versions of IE is irrelevant. Internet Explorer security patches get pushed regularly through Windows Update, which Microsoft encourages users to set up for automatic installation. So this problem will get fixed for the average user as soon as Microsoft sends out the patch. It requires no more knowledge than updating Chrome does. Note that I'm not recommending that anybody use IE. I'm just pointing out that it does get automatic updates, just like other browsers.
- just2n 14y agoI don't think I'd compare Windows Updates (the most broken updating system I've ever seen) to how Chrome manages updates. I've fixed computers running IE7 and with WU disabled. I ask why and I'm told "because the popups are annoying, and because upgrading IE is a pain in the ass." I agree. When I install Chrome for them, then later point out that it has updated 10 times in the past few months, they say "I never saw anything." As it should be.
- ladzoppelin 14y agoI find Windows update to be the most reliable update of any software. Since 2005 I can't even imagine how many updates I have run on thousands of computers that never once "broke" because of an update. MS worked out how to test updates years ago and now , unless you have malware, its probably not going to break anything. Also keep in mind that if Chrome was released in 1998 with its current update model it would of failed with people screaming to governments that Google was spying on them.
- thaumaturgy 14y ago
- deleted 14y ago[deleted]
- dkroy 14y agoResistance is futile. It is time to assimilate, download chrome.
- dj_axl 14y agoMore explanation here: http://www.ehackingnews.com/2012/09/new-zero-day-ie-exploit-metasploit-module.html http://www.ehackingnews.com/2012/09/new-zero-day-ie-exploit-...
- propercoil 14y agowow this is so big it makes my head spin.. most def the new ms08-067
- Zenst 14y agowww.google.com/chrome dont leave 127.0.0.1 without it. I find packaging up 0-day's into point-click downloads for metaspliot and the likes akin to giving a small child a loaded gun, but thats me I guess. Will only encourage the digital-vandals (media calls them hackers, bless).
- burlyscudd 14y agoIn addition to giving security professionals tools to see how vulnerable their infrastructure is to real-world attacks, releasing exploits like this actually creates significant pressure for vendors to patch vulnerable software. Take the recent Java 1.7 vuln (3 weeks or so ago). Oracle released a patch 4 days after that exploit was rolled into Metasploit. I'm sure they'll tell you that's a coincidence, but it's still nice to see happen completely out-of-band from their normal patch process. Word around the campfire is that Oracle knew of that vuln for months w/out a patch. Then along comes big bad Metasploit and you've got a patch for everyone on Java 1.7. I call that a win.
- Zenst 14y agoOh your dead right, but security profesionals have access to less public sources of tools and testing abilities, just don't have to be so easily accessable for those who could perhaps fail at unpacking a tar file. As for embarassing the vendor and highlighting there sloppyness, well there may be some millage in that. Though you would of thought vendors were a little bit more proactive. Still it's out there now and in that evolution is a wonderous thing to behold at work, some will learn and some will not.
- dguido 14y agoThis title is a bit misleading. This exploit will not be able to fully exploit anyone running on Vista or Windows 7, since Internet Explorer renderers run in low integrity processes on those operating systems (essentially, they are sandboxed). No one has released a second exploit that would escalate privileges outside of this sandbox. If you are running IE on Windows XP and you've taken no other steps to protect yourself (like running EMET, SandboxIE, or another mitigation), then it's your own damn fault that you got owned. On the other hand, take a look at how many exploits for IE that Rapid7/Metasploit has that support Windows 7: 0.
- fjarlq 14y agoAre you sure about that? The article specifically states that on Windows 7 the attacker obtains the privileges of the current user. Microsoft's advisory agrees: http://technet.microsoft.com/en-us/security/advisory/2757760 http://technet.microsoft.com/en-us/security/advisory/2757760 "The vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer." What's more, most people run with administrator privileges on Windows 7/Vista/XP because that's the default.
- dguido 14y agoYes, I'm sure that my analysis was correct. IE8+ on Vista+ run IE renderer's in Low Integrity, which means read-only access. It's not possible to further compromise (ie, install malware) on the exploited machine without a second exploit that escalates integrity levels to medium.