Re: What is the most cool IE exploit and java on the moment (metasploit)?

[Lukas Kuzmiak <metasploit () backstep net>]

Hey,

I think this only depends on the browser and whether it has built-in support
for pdf (module from adobe etc.) or not.

In my Firefox, in about:plugins I see:
Adobe Acrobat File: nppdf32.dllVersion: 9.4.1.222 Adobe PDF Plug-In For
Firefox and Netscape "9.4.1"and some extensions table underneath it, once
this is here it opens directly in the browser, however with the embedded
module from Acrobat.

Once Content-type header is defined as application/pdf it should open in the
browser directly, if you use force-download type, then the download dialog
should pop out.

Not sure for IE though, should be very similar in the module point of view.

I think it doesn't really matter as once the exploit works and user wants to
open it, you will just get there.

Regards,
Lukas

Only wimps use tape backup: _real_ men just upload their important stuff on
ftp, and let the rest of the world mirror it ;). Torvalds, Linus
(1996-07-20).


On Mon, Nov 22, 2010 at 5:33 PM, Jeffs <jeffs () speakeasy net> wrote:

>  Is there a method within the .pdf generation which forces the browser to
> open the file versus the adobe application?
>
>
> On 11/22/2010 9:13 AM, Gerry Brunelle wrote:
>
> I would honestly suggest doing something with a pdf exploit since most
> large companies love pdf and their users normally seem to have an inherent
> trust in pdf files. Maybe have the client open a pdf file in their browser
> since that wont go through email scanners which are starting to get better
> at picking up malicious pdf files.
>
> Gerry
>
> On Sun, Nov 21, 2010 at 11:42 PM, Richard Miles <
> richard.k.miles () googlemail com> wrote:
>
> > Hi
> >
> > There is no restriction.
> >
> > Do you suggest the most recent and most reliable one for Flash and Adobe?
> >
> > Yes, but browser autopwn is out of date.
> >
> > Thanks
> >
> > On Thu, Nov 11, 2010 at 4:01 PM, Chao Mu <chao.mu () minorcrash com> wrote:
> > > You may also want to consider Flash and Adobe vulnerabilities. Or are
> > > you restricting yourself to IE and Java? If so, what versions? There
> > > is always browser autopwn if you get lazy...
> > >
> > > On Wed, Nov 10, 2010 at 3:24 PM, Richard Miles
> > > <richard.k.miles () googlemail com> wrote:
> > > > I'm going to execute a client side attack, my target is win-xp SP3 in
> > > > Spanish. I'm able to make my client access a site controlled by me.
> > > > What is the more recent and more cool (good reliable and recent
> > > > patched) exploit for IE and Java available on metasploit? Both
> > > > launched from browser..
> > > >
> > > > Thanks
> > > > _______________________________________________
> > > > https://mail.metasploit.com/mailman/listinfo/framework
> > _______________________________________________
> > https://mail.metasploit.com/mailman/listinfo/framework
>
>
> _______________________________________________https://mail.metasploit.com/mailman/listinfo/framework
>
>
>
> _______________________________________________
> https://mail.metasploit.com/mailman/listinfo/framework
_______________________________________________
https://mail.metasploit.com/mailman/listinfo/framework