Re: [Full-Disclosure] python does mangleme (with IE bugs!)

From: Berend-Jan Wever (skylined_at_edup.tudelft.nl)
Date: 10/25/04

  • Next message: David Brodbeck: "RE: Update: Web browsers - a mini-farce (MSIE gives in)" 
    To: "ned" <nd@felinemenace.org>, <bugtraq@securityfocus.com>
Date: Mon, 25 Oct 2004 03:55:10 +0200

    Hi all, here's my analysis of these bugs:

    2445.html does nothing on my win2ksp4en/ie6.0sp1. (IE does crash when you load it because the META refresh tag leads to 2446.html.)
    2446.html contains an exploitable BoF in the IFRAME tag using the SRC and NAME property. To trigger the BoF you only need this tag in a HTML file:
    <IFRAME SRC=AAAAAAAAAAAA.... NAME="BBBBBBBBBBB....">

    Exactly why or how it happens, I do not know yet. I do know you can control EAX, after which this gets executed:
    7178EC02 8B08 MOV ECX, DWORD PTR [EAX]
    7178EC04 68 847B7071 PUSH SHDOCVW.71707B84
    7178EC09 50 PUSH EAX
    7178EC0A FF11 CALL NEAR DWORD PTR [ECX]
    Control over EAX leads to control over ECX, which you can use to control EIP: Remote Command Execution.

    They'd better patch this one quickly, a reliable working exploit shouldn't take more then a day to code.

    Cheers,
    SkyLined

    ----- Original Message -----
    From: "ned" <nd@felinemenace.org>
    To: <bugtraq@securityfocus.com>
    Cc: <full-disclosure@lists.netsys.com>; <lcamtuf@ghettot.org>
    Sent: Sunday, October 24, 2004 06:36
    Subject: [Full-Disclosure] python does mangleme (with IE bugs!)

    > i've made a port of mangleme:
    > http://felinemenace.org/~nd/htmler.py
    > with a few extra quirks (such as file extentions/url types)
    >
    > it finds IE bugs after roughly 2.5 -> 3 hours and they are at:
    > http://felinemenace.org/~nd/crash_ie/
    >
    > They are not the null pointer dereference that Michal found (which
    > curiously seems to not own my 6.0.2800.1106.xpsp1?) but some other
    > probably non-exploitable problems!
    >
    > htmler.py doesn't use CGI like mangleme but generates webpages in the
    > directory 'html1' numbered 0.html to n.html. 0.html then uses a refresh to
    > load 1.html and so on with little user interaction required!
    >
    > anyway, if you find bugs with it, don't sell to anyone/notify vendors!
    > - nd
    >
    > --
    > http://felinemenace.org/~nd - "eat a duck"
    >
    > _______________________________________________
    > Full-Disclosure - We believe in it.
    > Charter: http://lists.netsys.com/full-disclosure-charter.html
    >

  • Next message: David Brodbeck: "RE: Update: Web browsers - a mini-farce (MSIE gives in)"

    Relevant Pages

    • Re: [Full-Disclosure] python does mangleme (with IE bugs!)
      ... 2446.html contains an exploitable BoF in the IFRAME tag using the SRC and NAME property. ... Control over EAX leads to control over ECX, which you can use to control EIP: ... python does mangleme (with IE bugs!) ...
      (Full-Disclosure)
    • Re: [Full-Disclosure] python does mangleme (with IE bugs!)
      ... 2446.html contains an exploitable BoF in the IFRAME tag using the SRC and NAME property. ... Control over EAX leads to control over ECX, which you can use to control EIP: ... python does mangleme (with IE bugs!) ...
      (Full-Disclosure)
    • Re: Ajax File Uploader
      ... query string to Page2.aspx which uses this control, ... retrieve these variables from the query string. ... the iframe of the this file upload control, ... querystring to the page that contains the iframe tag but not to the url used ...
      (microsoft.public.dotnet.framework.aspnet)
    • automating word embedded within IE
      ... I would like to embed a word document in an IE window (presumably with an ... object or iframe tag) and then to have some control over it from the ... enclosing web page. ...
      (microsoft.public.office.developer.automation)