Vulnerability Development mailing list archives
Object Data IE Exploit
From: Pedro Jota Calvorota <calvorota () ya com>
Date: Sat, 27 Sep 2003 12:39:46 +0200
Im triying to reproduce the object data exploit in IE discovered in august by eeye in my own machine, I get to do it adding this in the first line of the exploit file (cmd.php):
<?php header("Content-type: application/hta"); ?> and, as you know, calling the file like this: <html> <object style="display:none" data="cmd.php"> </object> </html>My question is: Is there another way to modify the content-type header? I know there are some examples where the files are not php files. Is this way that I "invented" to reprododce the exploit perfecly valid?
Thanks. -- Using M2, Opera's revolutionary e-mail client: http://www.opera.com/m2/
Current thread:
- Object Data IE Exploit Pedro Jota Calvorota (Sep 27)
- RE: Object Data IE Exploit Dom De Vitto (Sep 29)