[TOOL] HTMLer - An Automated Broken HTML Generator (Mangleme Python Port)

From: SecuriTeam (support_at_securiteam.com)
Date: 10/26/04

  • Next message: SecuriTeam: "[NT] RealPlayer Zipped Skin File Buffer Overflow" 
    To: list@securiteam.com
Date: 26 Oct 2004 18:20:43 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      HTMLer - An Automated Broken HTML Generator (Mangleme Python Port)
    ------------------------------------------------------------------------

    SUMMARY

    DETAILS

    HTMLer is a Python port of the original
    <http://freshmeat.net/projects/mangleme/> mangleme (an automated broken
    HTML generator to test browsers) with added quirks such as MIME types
    (file extensions) and URL types.

    HTMLer is a command line driven application, unlike the original mangleme.
    It will create a plethora of broken HTML pages in a subdirectory under the
    directory in which it is run from. The files are linked in the sense that
    opening one in a browser will cause the browser to open the next one
    automatically using HTML refresh.

    One test scenario found by Berend-Jan Wever is an exploitable buffer
    overflow in Internet Explorer when parsing an IFRAME tag in a broken HTML
    file named 2446.html. A small excerpt follows:
    <IFRAME SRC=AAAAAAAAAAAA.... NAME="BBBBBBBBBBB....">

    It allows the crafter of the HTML to control EAX, afterwhich the following
    code gets executed:
    7178EC02 8B08 MOV ECX, DWORD PTR
    [EAX]
    7178EC04 68847B7071 PUSH SHDOCVW.71707B84
    7178EC09 50 PUSH EAX
    7178EC0A FF11 CALL NEAR DWORD PTR
    [ECX]

    Control over EAX leads to control over ECX which you can use to control
    EIP, hence paving the way to remote command execution.

    The tool's source can be downloaded from the author's site and is pasted
    here for convenience.

    Source Code
    # jumped in a river what did i see?
    # black-eyed angels swimming with me

    # SHAMELESS PORT OF LCAMTUF'S MANGELME
    # nd@felinemenace.org - (c) 1984
    # with a few extra hacks, finds elusive IE bugs ;)

    import random

    types = []
    data = {}

    data["A"] = ["NAME", "HREF", "REF", "REV", "TITLE", "TARGET", "SHAPE",
    "onLoad", "STYLE"]
    data["APPLET"] = ["CODEBASE", "CODE", "NAME", "ALIGN", "ALT", "HEIGHT",
    "WIDTH", "HSPACE", "VSPACE", "DOWNLOAD", "HEIGHT", "NAME", "TITLE",
    "onLoad", "STYLE"]
    data["AREA"] = ["SHAPE", "ALT", "CO-ORDS", "HREF", "onLoad", "STYLE"]
    data["B"] = ["onLoad", "STYLE"]
    data["BANNER"] = ["onLoad", "STYLE"]
    data["BASE"] = ["HREF", "TARGET", "onLoad", "STYLE"]
    data["BASEFONT"] = ["SIZE", "onLoad", "STYLE"]
    data["BGSOUND"] = ["SRC", "LOOP", "onLoad", "STYLE"]
    data["BQ"] = ["CLEAR", "NOWRAP", "onLoad", "STYLE"]
    data["BODY"] = ["BACKGROUND", "BGCOLOR", "TEXT", "LINK", "ALINK", "VLINK",
    "LEFTMARGIN", "TOPMARGIN", "BGPROPERTIES", "onLoad", "STYLE"]
    data["CAPTION"] = ["ALIGN", "VALIGN", "onLoad", "STYLE"]
    data["CENTER"] = ["onLoad", "STYLE"]
    data["COL"] = ["ALIGN", "SPAN", "onLoad", "STYLE"]
    data["COLGROUP"] = ["ALIGN", "VALIGN", "HALIGN", "WIDTH", "SPAN",
    "onLoad", "STYLE"]
    data["DIV"] = ["ALIGN", "CLASS", "LANG", "onLoad", "STYLE"]
    data["EMBED"] = ["SRC", "HEIGHT", "WIDTH", "UNITS", "NAME", "PALETTE",
    "onLoad", "STYLE"]
    data["FIG"] = ["SRC", "ALIGN", "HEIGHT", "WIDTH", "UNITS", "IMAGEMAP",
    "onLoad", "STYLE"]
    data["FN"] = ["ID", "onLoad", "STYLE"]
    data["FONT"] = ["SIZE", "COLOR", "FACE", "onLoad", "STYLE"]
    data["FORM"] = ["ACTION", "METHOD", "ENCTYPE", "TARGET", "SCRIPT",
    "onLoad", "STYLE"]
    data["FRAME"] = ["SRC", "NAME", "MARGINWIDTH", "MARGINHEIGHT",
    "SCROLLING", "FRAMESPACING", "onLoad", "STYLE"]
    data["FRAMESET"] = ["ROWS", "COLS", "onLoad", "STYLE"]
    data["H1"] = ["SRC", "DINGBAT", "onLoad", "STYLE"]
    data["HEAD"] = ["onLoad", "STYLE"]
    data["HR"] = ["SRC", "SIZE", "WIDTH", "ALIGN", "COLOR", "onLoad", "STYLE"]
    data["HTML"] = ["onLoad", "STYLE"]
    data["IFRAME"] = ["ALIGN", "FRAMEBORDER", "HEIGHT", "MARGINHEIGHT",
    "MARGINWIDTH", "NAME", "SCROLLING", "SRC", "ADDRESS", "WIDTH", "onLoad",
    "STYLE"]
    data["IMG"] = ["ALIGN", "ALT", "SRC", "BORDER", "DYNSRC", "HEIGHT",
    "HSPACE", "ISMAP", "LOOP", "LOWSRC", "START", "UNITS", "USEMAP", "WIDTH",
    "VSPACE", "onLoad", "STYLE"]
    data["INPUT"] = ["TYPE", "NAME", "VALUE", "onLoad", "STYLE"]
    data["ISINDEX"] = ["HREF", "PROMPT", "onLoad", "STYLE"]
    data["LI"] = ["SRC", "DINGBAT", "SKIP", "TYPE", "VALUE", "onLoad",
    "STYLE"]
    data["LINK"] = ["REL", "REV", "HREF", "TITLE", "onLoad", "STYLE"]
    data["MAP"] = ["NAME", "onLoad", "STYLE"]
    data["MARQUEE"] = ["ALIGN", "BEHAVIOR", "BGCOLOR", "DIRECTION", "HEIGHT",
    "HSPACE", "LOOP", "SCROLLAMOUNT", "SCROLLDELAY", "WIDTH", "VSPACE",
    "onLoad", "STYLE"]
    data["MENU"] = ["onLoad", "STYLE"]
    data["META"] = ["HTTP-EQUIV", "CONTENT", "NAME", "onLoad", "STYLE"]
    data["MULTICOL"] = ["COLS", "GUTTER", "WIDTH", "onLoad", "STYLE"]
    data["NOFRAMES"] = ["onLoad", "STYLE"]
    data["NOTE"] = ["CLASS", "SRC", "onLoad", "STYLE"]
    data["OVERLAY"] = ["SRC", "X", "Y", "HEIGHT", "WIDTH", "UNITS",
    "IMAGEMAP", "onLoad", "STYLE"]
    data["PARAM"] = ["NAME", "VALUE", "onLoad", "STYLE"]
    data["RANGE"] = ["FROM", "UNTIL", "onLoad", "STYLE"]
    data["SCRIPT"] = ["LANGUAGE", "onLoad", "STYLE"]
    data["SELECT"] = ["NAME", "SIZE", "MULTIPLE", "WIDTH", "HEIGHT", "UNITS",
    "onLoad", "STYLE"]
    data["OPTION"] = ["VALUE", "SHAPE", "onLoad", "STYLE"]
    data["SPACER"] = ["TYPE", "SIZE", "WIDTH", "HEIGHT", "ALIGN", "onLoad",
    "STYLE"]
    data["SPOT"] = ["ID", "onLoad", "STYLE"]
    data["TAB"] = ["INDENT", "TO", "ALIGN", "DP", "onLoad", "STYLE"]
    data["TABLE"] = ["ALIGN", "WIDTH", "BORDER", "CELLPADDING", "CELLSPACING",
    "BGCOLOR", "VALIGN", "COLSPEC", "UNITS", "DP", "onLoad", "STYLE"]
    data["TBODY"] = ["CLASS", "ID", "onLoad", "STYLE"]
    data["TD"] = ["COLSPAN", "ROWSPAN", "ALIGN", "VALIGN", "BGCOLOR",
    "onLoad", "STYLE"]
    data["TEXTAREA"] = ["NAME", "COLS", "ROWS", "onLoad", "STYLE"]
    data["TEXTFLOW"] = ["CLASS", "ID", "onLoad", "STYLE"]
    data["TFOOT"] = ["COLSPAN", "ROWSPAN", "ALIGN", "VALIGN", "BGCOLOR",
    "onLoad", "STYLE"]
    data["TH"] = ["ALIGN", "CLASS", "ID", "onLoad", "STYLE"]
    data["TITLE"] = ["onLoad", "STYLE"]
    data["TR"] = ["ALIGN", "VALIGN", "BGCOLOR", "CLASS", "onLoad", "STYLE"]
    data["UL"] = ["SRC", "DINGBAT", "WRAP", "TYPE", "PLAIN", "onLoad",
    "STYLE"]

    for x in data.keys():
     types.append(x)

    ext =
    [".jar",".class",".jpg",".htm",".css",".gif",".png",".eml",".mpg",".wav",".mp3",".swf"]
    pre = ["http:","https:","url:","about:","file:","mk:"]
    other = ["&","=",":","?","\"","\n","%n%n%n%n%n%n%n%n%n%n%n%n","\\"]
    ints =
    ["0","-1","127","7897","89000","808080","90928345","74326794236234","0xfffffff","ffff"]

    class htmler:
     maxparams = 20
     maxtypes = 20
     def __init__(self):
      pass

     def randnum(self,finish,start=0):
      return random.randint(start,finish)

     def randstring(self):
      char = chr(self.randnum(255))
      length = self.randnum(300)
      thestring = char * length
      what = self.randnum(1)
      if what == 0:
       which = self.randnum(len(ext) - 1)
       thestring += ext[which]
      elif what == 1:
       which = self.randnum(len(pre) - 1)
       thestring = pre[which] + thestring
      else:
       return
      return thestring
     
     def makestring(self):
      what = self.randnum(2)
      if what == 0:
       return self.randstring()
      elif what == 1:
       return ints[self.randnum(len(ints) - 1)]
      elif what == 2:
       return other[self.randnum(len(other) - 1)]
       
     def loop(self):
      string = ""
      i = self.randnum(len(types) - 1)
      t = types[i]
      arr = data[t]
      string += "<%s " % types[i]
      z = 0
      for z in range(0,self.maxparams):
       badparam = arr[self.randnum(len(arr) - 1)]
       badstring = self.makestring()
       string += "%s=%s " % (badparam,badstring)
      string += ">\n"
      return string

     def main(self):
      page = ""
      for k in range(0,self.maxtypes):
       page += self.loop()
      return page

    if __name__ == '__main__':
     h = htmler()
     count = 0
     while 1:
      shiz = "<HEAD>\n<META HTTP-EQUIV=\"Refresh\"
    content=\"0;URL=%d.html\">\n" % (count + 1)
      hehe = h.main()
      shiz += hehe
      print "count -> %d" % count
      file = open("html1/%d.html" % count,"w")
      file.write(shiz)
      file.close()
      count += 1

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:nd@felinemenace.org> ned.
    To keep updated with the tool visit the project's homepage at:
    <http://felinemenace.org/~nd/htmler.py>
    http://felinemenace.org/~nd/htmler.py and
    <http://freshmeat.net/projects/mangleme/>
    http://freshmeat.net/projects/mangleme/

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NT] RealPlayer Zipped Skin File Buffer Overflow"

    Relevant Pages