December Exploit Trends: Internet Explorer CButton

Last updated at Mon, 24 Jul 2017 21:17:42 GMT

Each month we compile a list of the most searched exploit and auxiliary modules from our exploit database. To protect user's privacy, the statistics come from analyzing webserver logs of searches, not from monitoring Metasploit usage.

December brings us the addition of a brand new Internet Explorer exploit module making its debut at #6 and the Apache Killer DoS jumping five spots to #5. Read on for the rest of December's exploit and auxiliary modules with commentary by Metasploit's own Tod Beardsley.

1. MS12-020 Microsoft Remote Desktop Use-After-Free DoS (CVE-2012-0002, MSB-MS12-020): This is the 2012 RDP Bug, where it was implied -- but never proven in public -- that a pre-auth bug in RDP can allow for remote code execution. This is likely the most popular module we have due to both recency bias and because there was an unusual level of spontaneous organization of the Metasploit developer community to search for the correct path to remote code execution. So far, nobody's gotten RCE yet (in public), but the Metasploit module provides the most clues. More on this topic in an article on ZD Net. Up one place from #2 last month.

2. Microsoft Server Service Relative Path Stack Corruption (CVE-2008-4250, MSB-MS08-067): A four year old vulnerability that tends to give the most reliable shells on Windows 2003 Server and Windows XP. It's also got a great pile of language pack targets. All of Metasploit's exploits provide US English targeted shellcode, a few might provide Chinese, Spanish, French, or other popular languages; this one has targets in pretty much every language you've ever heard of. This exploit is also not ancient, so it's reasonable to expect to find some unpatched systems in a medium to large enterprise vulnerable to it. More on this topic at Microsoft's Security TechCenter. Down one place from #1 last month.

3.  Java 7 Applet Remote Code Execution: Over a fateful weekend in August, Metasploit exploit devs Wei "sinn3r" Chen, Juan Vazquez, and contributor Josh "jduck" Drake got together on IRC and put together a Metasploit module to take advantage of the vulnerability reported privately to Oracle by Adam Gowdiak and James Forshow. Here's the twist: Nobody at the time knew about Adam's or James's private disclosure to Oracle -- this bug was instead spotted in the wild way before Oracle was planning to release their fix. So, we started the week with a new Java 0-day, and by the end of the week, after much speculation, Oracle did the right thing and accelerated their patch schedule. Interesting times, to say the least. Same place as last month.

4.  Microsoft RPC DCOM Interface Overflow (CVE-2003-0352, MSB-MS03-026): A nine year old vulnerability that used to be the de-facto standard exploit for Windows machines - this is the RPC DCom bug, and it affects ancient NT machines. It was most notable in that it was used by the Blaster and Nachi worms to transit networks. It's now pretty much a case study in stack buffer overflows in Windows, so it's got a lot of historical value. If memory serves, this was the most reliable exploit in Metasploit v2. More info on that at Windows IT Pro. Same place as last month.

5. Apache Range header DoS (Apache Killer): This old module might be appearing on this month's list because the vulnerability was discovered by KingCope who just dropped a ton of 0day (see the recent blog post, What Would Trinity Do With KingCope's SSH 0day? for an example). Perhaps someone (or a bunch of someones) is researching KingCope's past contributions? Other than that, I can't see why there would be sudden interest in a year-old Apache Dos. Up five places from #10 last month.

6. Microsoft Internet Explorer CButton Object Use-After-Free Vulnerability: The vulnerability exploited by ie_cbutton_uaf has the dubious distinction of being the last 0-day of 2012, and is discussed extensively on the Metasploit blog, Microsoft Internet Explorer 0-Day Marks the End of 2012. It's also a rare 0-day in MSIE – not Flash, not Java, not any of the other attendant technologies, but the browser itself. It's IE8 only, but as Metasploit exploit developer sinn3r points out, that's still 33% or so of all internet browser traffic today. This module also demonstrates the tirelessness of the Metasploit exploit dev community; in most of the world, December 29th was a weekend smack in the middle of the phone-it-in-I'm-not-doin'-nothin' holiday season between Christmas and New Year's. Sadly, the bad guys never rest, so when we become aware of new techniques in the wild, we try to be quick in giving the sysadmins and pen-testers of the world the tools they need to protect their networks' constituency. New since last month.

7. MS12-063 Microsoft Internet Explorer execCommand Use-After-Free Vulnerability: This bug started off with Eric Romang's blog post and ended up with a module being cooked up over a weekend by Eric, @binjo, and the Metasploit exploit dev team. This event, like the Java 0-day, had the net effect of speeding up the vendor's patch schedule. If there was no public, open exploit, would there have been a patch so rapidly? Was it connected with Java 0-day? Who's the primary source for these critical client-side bugs, anyway? These and other questions are still being speculated on and debated in the security industry and security press. Down two places from #5 since last month.

8. Apache mod_isapi <= 2.2.14 Dangling Pointer: Although this is an exploit in Apache, don't be fooled! It's only exploitable on Windows (so that knocks out the biggest chunk of Apache installs at the time of this module's release), and it's only a DoS. Again, kind of a mystery as to why it's so popular. Down one place from #7 last month.

9. Microsoft Windows Authenticated User Code Execution (CVE-1999-0504): The PSExec module is a utility module -- given an SMB username and password with sufficient privileges on the target machine, the user can get a shell. It's not sexy, but it's super handy for testing payloads and setup. I'd bet it's the most-used module in classroom and test environments. More on this topic in at the National Vulnerability Database. Same places as last month.

10. Microsoft Windows 7 / Server 2008 R2 SMB Client Infinite Loop: Not sure why this module is still popular -- it's a client side DoS. Historically, it's a neat DoS, since it demos a bug in Windows 7's kernel, but all the module does is crash Windows 7 clients after you get a user to connect to you. Down two places from #8 since last month.

If you want to use any of these exploits right now, you can download Metasploit for free.