Full Disclosure mailing list archives
RE: Vuln. MacOSX/Safari: Remote help-call, execute scripts
From: Jose Commins <axora () myrealbox com>
Date: Thu, 20 May 2004 23:27:19 +0100
In reference to Troels Bay (troelsbay () troelsbay dk) post to this list on Sun, 16 May 2004 00:00:08 +0200,
This HTML can be embedded into Apple Mail (using Mozilla's HTML mail editor for example) and sent as a link which once clicked runs the code as per the exploit below:
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head><meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title> </head> <body bgcolor="#ffffff" text="#000000"> <ahref="help:runscript=MacHelp.help/Contents/Resourc es/English.lproj/shrd/OpnApp.scpt%20string=%27usr: bin:du%27">Click to go to your next message</a><br>
</body> </html>It will display 'Click to go to your next message' and run the code once clicked (without visiting a web page).
Below is the text from the original post. Regards, Jose. ------------------- FROM: Troels Bay troelsbay () troelsbay dk Sun, 16 May 2004 00:00:08 +0200 I usually complain a lot about the Windows-security settings, and consider *NIX systems to be of an entirely different level. But this time I found my own arguments off short. I'm an OS X user, and I would like to submit to you the latest exploit for this system. As I hope a fix will be running in soon... Perhaps the more people who know, the sooner a fix will be up (I might be considered naive here...) The Setting: The Help-application of OS X uses ordinary html-pages to display troubleshooting/etc, and parses a special command when displaying help-links that, for instance, open System Preferences, Finder etc. This command uses a built-in protocol called "help:" and can easily be exploited since Safari (the default browser, and possible every other browser on the system) can use the same protocol - probably due to the Help-application's dependency on the Safari html-engine. This means that a simple homepage meta redirect call can use it, without the user having to do anything but surf to the site, or it can be a simple href link on the site (most often connected to a "Porn HERE" picture). This is an example of how it works: help:runscript=../../Scripts/Info Scripts/Current Date & Time.scpt Use: This, placed as a link on a homepage, will trick Safari to 1) open the Help-application 2) open the "Current Date & Time" script. Though the Date & Time script is pretty harmless, consider that one can (through another link or meta redirect call) use the disk:// protocol to mount a script on /Volumes/danger.scpt and then let the link from above execute it, by altering the path. Vulnerable Systems: Mac OS X 10.3 (probably will work with 10.2 as well, but I cannot test that, someone please confirm?) Risk: This can potentially wipe the entire hard-disk (or large parts of it), if a hacker runs a script with "rm -rf /" included. Solution: Alter the "help:" protocol to use another application than "Help" (for quick editing use "MisFox" or "Default Apps"-3rdparty prefpane) The funny thing is that this newly assigned application (in my case a Chess program) will open whenever a hacker tries to use the vulnerability, or whenever you rightfully try to use the Helper-application's special links. Credits: I can only be seen as the messenger here, the real credits are to be found on the forums of macnn: http://forums.macnn.com/showthread.php? s=&threadid=213043&perpage=50&pagenumber=1 Off topic: I'm still waiting for that psexec tool look-a-like for *NIX, I hope some people are working on it, perhaps samba could get a grip and implement "NET SERVICE" anytime soon. --Apple-Mail-1--1022973840 Content-Transfer-Encoding: 7bit Content-Type: text/enriched; charset=US-ASCII I usually complain a lot about the Windows-security settings, and consider *NIX systems to be of an entirely different level. But this time I found my own arguments off short. I'm an OS X user, and I would like to submit to you the latest exploit for this system. As I hope a fix will be running in soon... Perhaps the more people who know, the sooner a fix will be up (I might be considered naive here...) <bold>The Setting:</bold> The Help-application of OS X uses ordinary html-pages to display troubleshooting/etc, and parses a special command when displaying help-links that, for instance, open System Preferences, Finder etc. This command uses a built-in protocol called "help:" and can easily be exploited since Safari (the default browser, and possible every other browser on the system) can use the same protocol - probably due to the Help-application's dependency on the Safari html-engine. This means that a simple homepage meta redirect call can use it, without the user having to do anything but surf to the site, or it can be a simple href link on the site (most often connected to a "Porn HERE" picture). This is an example of how it works: help:runscript=../../Scripts/Info Scripts/Current Date & Time.scpt <bold>Use:</bold> This, placed as a link on a homepage, will trick Safari to 1) open the Help-application 2) open the "Current Date & Time" script. Though the Date & Time script is pretty harmless, consider that one can (through another link or meta redirect call) use the disk:// protocol to mount a script on /Volumes/danger.scpt and then let the link from above execute it, by altering the path. <bold>Vulnerable Systems:</bold> Mac OS X 10.3 (probably will work with 10.2 as well, but I cannot test that, someone please confirm?) <bold>Risk: </bold>This can potentially wipe the entire hard-disk (or large parts of it), if a hacker runs a script with "rm -rf /" included. <bold>Solution:</bold> Alter the "help:" protocol to use another application than "Help" (for quick editing use "MisFox" or "Default Apps"-3rdparty prefpane) The funny thing is that this newly assigned application (in my case a Chess program) will open whenever a hacker tries to use the vulnerability, or whenever you rightfully try to use the Helper-application's special links. <bold>Credits:</bold> I can only be seen as the messenger here, the real credits are to be found on the forums of macnn:http://forums.macnn.com/showthread.php? s=&threadid=213043&perpage=50&pagenumber=1
<bold>Off topic: </bold>I'm still waiting for that psexec tool look-a-like for *NIX, I hope some people are working on it, perhaps samba could get a grip and implement "NET SERVICE" anytime soon. --Apple-Mail-1--1022973840-- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Vuln. MacOSX/Safari: Remote help-call, execute scripts Troels Bay (May 15)
- <Possible follow-ups>
- Fwd: Vuln. MacOSX/Safari: Remote help-call, execute scripts Troels Bay (May 16)
- Vuln. MacOSX/Safari: Remote help-call, execute scripts Troels Bay (May 16)
- RE: Vuln. MacOSX/Safari: Remote help-call, execute scripts Jose Commins (May 20)