OP 16 March, 2019 - 09:26 PM
(This post was last modified: 19 March, 2019 - 07:26 PM by 0dayExploit.)
For research purposes:
In this guide you will learn how to create a .htm file which can execute arbitrary commands in the remote powershell. This is working on all Windows versions and exploits Internet Explorer / Microsoft Office. First of all, the MSHTML Engine is vulnerable due to improper validation of specially crafted web documents (html, xhtml, etc). In other words, the exploit is triggered when users “edit” the documents. These documents are containing a ‘meta’ HTML tag set to ‘ProgId’ and its content set to ‘ProgId’. In this example we use ‘HTAFILE’ to exploit MS IE Browser or MS Office. On patched systems, the file will always open in notepad for editing.
First we will begin with a simple HTML document, opening the HTMl, HEAD and meta tag. As stated before, we are filling the content of the meta with ‘HTAFILE’, and the name as ‘ProgId’.
Next we will add some fail-safes in the event that a user does not open in Internet Explorer or MS Office. For example, if JavaScript is disabled we will leave an error message persuading to edit with Internet Explorer.
Now you have successfully made an exploited .htm file which executes the shell command to run calculator. You can edit this for any of your hacking needs.
Happy hacking!
Source: https://www.0dayexploits.net/2019/03/16/...loit-free/
Code:
CVE-2019-0541
First we will begin with a simple HTML document, opening the HTMl, HEAD and meta tag. As stated before, we are filling the content of the meta with ‘HTAFILE’, and the name as ‘ProgId’.
Next we will add some fail-safes in the event that a user does not open in Internet Explorer or MS Office. For example, if JavaScript is disabled we will leave an error message persuading to edit with Internet Explorer.
Now you have successfully made an exploited .htm file which executes the shell command to run calculator. You can edit this for any of your hacking needs.
Happy hacking!
Source: https://www.0dayexploits.net/2019/03/16/...loit-free/