Are the browsers you're attempting to exploit affected by the vulnerability in question or have they been patched?
Metasploit: Sending exploits to different networks.
Hey guys,
This is my first time posting I believe. I'm a senior in highschool on my way to take network security at UAT in Tempe, AZ. I've been trying to get to know metasploit and it was a little daunting at first.
The situation is this: I have successfully exploited some of my own Win2K machines with the MS03-26 vulnerability. I have a friends permission to test on his system. I have been trying the browser_autopwn and other internet explorer exploits to no avail. I have them connect to my public IP address and my server recognizes it but always hangs on the Sending (exploit name). Then I tried it on my own computer just to check if it was an issue with his end and it still won't work.
Are the browsers you're attempting to exploit affected by the vulnerability in question or have they been patched?
I'm a compulsive post editor, you might wanna wait until my post has been online for 5-10 mins before quoting it as it will likely change.
I know I seem harsh in some of my replies. SORRY! But if you're doing something illegal or posting something that seems to be obvious BS I'm going to call you on it.
I have tried it on multiple versions of IE including five six and seven but it is a possibility. Does anyone have the full version name for an IE that is vulnerable to say the COM CreateObject Code Execution so I can download it and give it a go?
Why not use a different exploit/ vulnerability with one of your older browsers?Originally Posted by drowningsucks
It would also be a good time to start learning how those exploits/vulnerabilities work.
To be successful here you should read all of the following.
ForumRules
ForumFAQ
If you are new to Back|Track
Back|Track Wiki
Failure to do so will probably get your threads deleted or worse.
Shouldn't autopwn nab my older IE 6 browser then?
Is it necessary to have both LHOST and SRVHOST set to the same private IP when both are listed?
no, SRVHOST can be default but LHOST you must set it
start by installing a different versions of windows in a virtual machine
without updates and test it with metasploit.
with a fresh install of windows 2000 (no updates) you can get like 10 exploits to work... you can test fast-track to make things easer... ( learn how to use nmap via command line)
nmap -PN -p 135,139,445
try that nmap scan with fast track on a windows 2000 box
Posting Permissions