1

For example, if my client is using a vulnerable Internet Explorer which was vulnerable to the Aurora Vulnerability (I know its old and patch, but for now, let's assume) then I use Metasploit Client-side exploitation payload.

Steps as follows:-

  1. Run metasploit

  2. Set Exploit "aurora exploit"

  3. Set payload "payload/windows/reverse_tcp"

  4. set srvhost, srvport

  5. run

Now it will give us an URL through which if any Vulnerable web browser requested that URL with their browser and if the browser is vulnerable to it then it will exploit that vulnerability and gives us the shell of that system (Now we are on that system).

But how? I mean my exploit works only on the browser level, and how it connects it to the system level to give us the system shell.

Am I am missing something?

  • 1
    Why devoted, I don't know what type of question stack overflow wants? Seriously. – Utkarsh Agrawal Jul 2 '18 at 9:27
1

To understand how browser based exploits work, you should understand how browsers work. I have found a nice detailed article about it. How Browsers Work.

The summary point that you can get from the article related to the browser exploits is that browsers have javascript engines which translate javascript instructors into machine code. So the browser engines are translators between the browser and to your machine. Firefox's SpiderMonkey is an example for that. It is written in C/C++ as almost all browser engines. Since each browsers have its own engines, the browser based vulnerabilities are specific to the browser( also even Operating system specific ) . An exploit code for Internet Explorer 6 probably will not work for Google Chrome, for example. In addition, if you search for more browser vulnerabilities, you will find out that the vulnerability platforms are changing. There are exploits work in only some Android versions for example. You can check out several vulnerabilities of Google Chrome as example; Google Chrome List of Vulnerability .

Most of the browser exploits are rely on the classic buffer overflow attacks which is also used in Aurora exploit. Therefore, any vulnerability in these engines might be exploited by causing a buffer overflow by using javascript or html dom objects.

In short, Javascript or html can not lead to "Remote Code Execution" by any buffer overflow attack. itself. However, the vulnerability is exploited in the browser engine, not in the browser itself. Javascript or HTML are just used as a tool to exploit the vulnerability in the engines. You can read more about Auroa vulnerability : Rapid7 MS10-002 Microsoft Internet Explorer "Aurora" Memory Corruption and also from here: CVE-2010-0249

EDIT: I have found out an article about Microsoft Edge's Javascript Engine, it also describes well the principles of browsers' workflow; Microsoft Edge’s JavaScript engine to go open-source

Extra Reading: Understanding How the Chrome V8 Engine Translates JavaScript into Machine Code

  • 1
    Correct me if I am wrong but doesn't C++ do most of the mem management for you? – J.J Jun 28 '18 at 12:06
  • 1
    Yes, actually even C has some prevention methods for buffer overflows. However the point that I want to mention is that, the vulnerable code being exploited is C/C++ , not javascript. So an attacker can execute a remote code in the machine level, not in the browser level. How secure C or C++ is an another discussion topic :), I edited my post, and removed the unnecessary detail from my post. – Pilfility Jun 28 '18 at 13:13
  • @vvnn I didn't expect you to edit I actually had a gap in my knowledge. I thought I heard C++ does most of it for you, thanks for confirming :) – J.J Jun 28 '18 at 13:25
  • Indeed, it is a nice warning. My statement was confusing and unnecessary to read . Browser engines do not have fully C++, they require to include C language at the end. I have not analyzed each single found vulnerabilities, but mostly they are from invalid pointers, memory corruptions , invalid integer conversions. – Pilfility Jun 28 '18 at 13:29
  • 1
    More complex than just "give us the shell back" :) . Javascript code, or a html dom is just used to exploit the vulnerability in the browser engine. Since your engine has system level access, the attacker can apply code execution to return him a shell of the system. I recommend to you to search about "buffer overflow attacks". I am sorry, I have given many things to read but there are many concepts behind browser based attacks such as "buffer overflow" , "remote code execution", "browser engines". Once you know about these, you can easily understand the answer of your question by yourself. – Pilfility Jun 29 '18 at 6:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.