[framework] ie_unsafe_scripting

[spinbad]

Hi

Attached you find a exploit module which can be used if a administrator
set the IE security zone setting "Initialize and script ActiveX controls not
marked as safe"
to "enable".

The default setting is "disabled", but I had two cases where it was enabled
for
the intranet zone in a large network, making it a perfect attack vector for
internal
pentests.

Hope you like it. Would be cool if someone buts it into the SVN.

spinbad
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.metasploit.com/pipermail/framework/attachments/20091023/6517c771/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: ie_unsafe_scripting.rb
Type: application/x-ruby
Size: 3670 bytes
Desc: not available
URL: <http://mail.metasploit.com/pipermail/framework/attachments/20091023/6517c771/attachment.rb>