Microsoft Internet Explorer Unsafe Scripting Misconfiguration

This exploit takes advantage of the "Initialize and script ActiveX controls not
marked safe for scripting" setting within Internet Explorer. When this option is set,
IE allows access to the WScript.Shell ActiveX control, which allows javascript to
interact with the file system and run commands. This security flaw is not uncommon
in corporate environments for the 'Intranet' or 'Trusted Site' zones.

When set via domain policy, the most common registry entry to modify is HKLM\
Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\1201,
which if set to '0' forces ActiveX controls not marked safe for scripting to be
enabled for the Intranet zone.

This module creates a javascript/html hybrid that will render correctly either
via a direct GET http://msf-server/ or as a javascript include, such as in:
http://intranet-server/xss.asp?id=">
.

IE Tabs, WScript and subsequent Powershell prompts all run as x86 even when run from
an x64 iexplore.exe.

By default, this module will not attempt to fire against IEs that come with Protected
Mode enabled by default, because it can trigger a security prompt. However, if you are
feeling brave, you can choose to ignore this restriction by setting the ALLOWPROMPT
datastore option to true.

natron [email protected]
Ben Campbell [email protected]

Windows

x86