HijackClick 3

[Paul <paul () greyhats cjb net>]

Note: This vulnerability as well as several more can be found at http://www.greyhats.cjb.net

HijackClick 3!!!
Took the name from Liu Die Yu :) 

[Tested]
IEXPLORE.EXE file version 6.0.2800.1106
MSHTML.DLL file version 6.00.2800.1400
Microsoft Windows XP sp2 

[Discussion]
The HijackClick series have been used to force a drag and drop event simply from the user clicking a something. This is 
done by moving the window when onmousedown fires. Previously, window.moveBy/To has been used. This has been patched. 
Apparently, window.resizeBy/To would work too because it gives access denied if it tries to execute when onmousedown 
fires. Microsoft just disabled those functions from being called when the mouse button is down and called it patched. 
No more hijackclick, right?

Wrong. 

Popup.show() allows you to show a popup with desired left, top, height, and width values. The show() function doesnt 
give access denied when we call it on mousedown. Let's try it with a link on a popup. I'll make show() move the popup 
off the screen. Does it work? Yes, it changes the cursor. Good. A drag event just took place. With a little 
fine-tuning, we can make it show the popup on loading of the main window, move the popup and show a favorites list on 
mousedown, and set a timer to hide the favorites list and taunt the victim who just got tricked into adding a link of 
our choice to their favorites list :).

[Example]
http://freehost07.websamba.com/greyhats/hijackclick3.htm

And when you patch this one, Microsoft, please remember to patch the show() function method cache part, too. You don't 
want HijackClick4, do you? ;)