Internet Explorer Winhlp32.exe MsgBox Code Execution

This module exploits a code execution vulnerability that occurs when a user presses F1 on MessageBox originated from VBscript within a web page. When the user hits F1, the MessageBox help functionaility will attempt to load and use a HLP file from an SMB or WebDAV (if the WebDAV redirector is enabled) server. This particular version of the exploit implements a WebDAV server that will serve HLP file as well as a payload EXE. During testing warnings about the payload EXE being unsigned were witnessed. A future version of this module might use other methods that do not create such a warning.

Search Other Modules

Exploit Rank

• Great

Exploit Authors

• Maurycy Prodeus < >
• jduck < jduck [at] metasploit.com >

Vulnerability References

• CVE-2010-0483
• OSVDB-62632
• MSB-MS10-023
• http://www.microsoft.com/technet/security/advisory/981169.mspx
• http://blogs.technet.com/msrc/archive/2010/02/28/investigating-a-new-win32hlp...
• http://isec.pl/vulnerabilities/isec-0027-msgbox-helpfile-ie.txt

Exploit Targets

• 0 - Automatic (default)
• 1 - Internet Explorer on Windows

Exploit Development

• Source Code
• History

Similar Exploit Modules

• exploit/windows/browser/adobe_cooltype_sing
• exploit/windows/browser/adobe_flash_mp4_cprt
• exploit/windows/browser/adobe_flash_sps
• exploit/windows/browser/adobe_flashplayer_avm
• exploit/windows/browser/adobe_flashplayer_flash10o
• exploit/windows/browser/adobe_flashplayer_newfunction
• exploit/windows/browser/adobe_flatedecode_predictor02
• exploit/windows/browser/adobe_geticon
• exploit/windows/browser/adobe_jbig2decode
• exploit/windows/browser/adobe_media_newplayer

Exploit Usage Information

Exploit Module Options