RE: [Full-Disclosure] Re: shell:windows

• Previous message: Florian Weimer: "Re: [Full-Disclosure] Is Mozilla's "patch" enough?"
• Maybe in reply to: Nick Eoannidis: "[Full-Disclosure] Re: shell:windows"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

To: "'Barry Fitzgerald'" <bkfsec@sdf.lonestar.org>, Larry Seltzer <larry@larryseltzer.com>
Date: Mon, 12 Jul 2004 14:11:41 -0500

After my initial question I see that IE isn't a big issue like Mozilla was.
However, I think it could be used in an attack.

But it would be limited- I haven't found a way to pass variables to it
because you are already passing a variable in the .exe or whatever you call
from the shell: statement. But what if it was used to start a service or a
program that isn't running or something to that effect. I agree that
having the dialog box appear isn't automated and requires intervention by
the user. But how many (( End-users)) click on that popup banner that says
your the 1,000,000 visitor and you win.. Or opened the email that was from
Microsoft saying it was a security patch.

What if you could use it as the link in an image or something else.

I have played around with it a lot but haven't had a lot of luck crating a
super l33t exploit with it ;)

Maybe it's not the shell: command itself that is an issue. But it starts
that mindset of looking for other protocols in the url bar?

JP

-----Original Message-----
From: Barry Fitzgerald [mailto:bkfsec@sdf.lonestar.org]
Sent: Monday, July 12, 2004 12:49 PM
To: Larry Seltzer
Cc: nikon@xillioncomputers.com; full-disclosure@lists.netsys.com
Subject: Re: [Full-Disclosure] Re: shell:windows

Larry Seltzer wrote:

>
>meaningful problem either, then we can agree to disagree on the scope.
I'll agree that
>getting this issue to run code of the choosing of the attacker is more
difficult than
>some other unpatched IE holes, but it is not impossible.
>
>I disagree completely. The Mozilla problem, which I'll readily agree is not
in the same
>league with most of the recent IE problems, allowed a local program to
execute simply by
>visiting a web page that had the appropriate shell: link in a META tag. You
actually
>think this is on the same level as requiring a user to type
>"shell:windows\system32\foo.exe" into the Address bar?
>
>
>
>
No - there are numerous ways to force input into places like the address
bar. As someone else already stated, for this to work you have to be
able to push it into that area. There are numerous ways to do this and
for a person with a little more time on their hands, finding one that
works properly should not be difficult.

Stop thinking about this as being a one-dimensional issue. Security
issues very rarely are that one-dimensional.

             -Barry

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

• Previous message: Florian Weimer: "Re: [Full-Disclosure] Is Mozilla's "patch" enough?"
• Maybe in reply to: Nick Eoannidis: "[Full-Disclosure] Re: shell:windows"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]