Internet Explorer .HTM Remote Code Execution [Infect via Browser] New Exploit!

[14]

For research purposes: 

Code:

CVE-2019-0541

In this guide you will learn how to create a .htm file which can execute arbitrary commands in the remote powershell. This is working on all Windows versions and exploits Internet Explorer / Microsoft Office. First of all, the MSHTML Engine is vulnerable due to improper validation of specially crafted web documents (html, xhtml, etc). In other words, the exploit is triggered when users “edit” the documents. These documents are containing a ‘meta’ HTML tag set to ‘ProgId’ and its content set to ‘ProgId’. In this example we use ‘HTAFILE’ to exploit MS IE Browser or MS Office. On patched systems, the file will always open in notepad for editing.
First we will begin with a simple HTML document, opening the HTMl, HEAD and meta tag. As stated before, we are filling the content of the meta with ‘HTAFILE’, and the name as ‘ProgId’.

Hidden Content

You must register or login to view this content.

Next we will add some fail-safes in the event that a user does not open in Internet Explorer or MS Office. For example, if JavaScript is disabled we will leave an error message persuading to edit with Internet Explorer.

Hidden Content

You must register or login to view this content.

Now you have successfully made an exploited .htm file which executes the shell command to run calculator. You can edit this for any of your hacking needs.
Happy hacking!

Source: https://www.0dayexploits.net/2019/03/16/...loit-free/

[35]

[Video: https://www.youtube.com/watch?v=cwKvTfoDGB4]

[168]

Thanks brother

[14]

[Video: https://www.youtube.com/watch?v=cwKvTfoDGB4]

Thanks for sharing video example!

People can also note if you want to embed some sort of payload, just put the directory in place of calc.exe

[18]

yet another reason to not use windows.

Underwurld Club - RAT Museum - http://sunjester.dev

[14]

yet another reason to not use windows.

Agreed. I prefer Debian, by far the best

[21]

gadgndkjagkjdnakjvnladgas

[60]

Thanks brother