Microsoft Exploit

This may be here allready and i just didnt see it so if it is my appologies.

I just want to say that i didnt discover this. I found it @ unixhideout.com and they had a demo for winxp. I used the source of that and made it work for win9x - Win ME and WINNT and XP.

Win95_98_Me Click here For Win NT Click here For WinXP click here

The site is nothing fancy i just signed up for it and threw it together in minutes.
Just so you know what you are clicking on this website will make your calculator open

Just think with a little bit of time and practice what you could do to someone by them just clicking on a link in their page

way to go microsuck

Hmmmm...if it worked it would be scary! :)

It said opening 'calc.exe', but it didn't open anything. It said it could take a few seconds, I waited about 5 minutes, but nothing opened. Maybe it's cos I got a firewall, I dunno - but I'd like to hear if it actually worked for other people.

Greg

whats your OS ? I tired it on all versions and it worked for me. i doublechecked before i posted it

I'm running WinXP and have Sygate Personal Firewall running.

Greg

thats probably why then. as long as you clicked on the link for the winxp one then it should have worked ; sygate must have blocked it...It really does work

Oh by the way : If anyone messes around with this and comes up with other programs to open PM me

Thanks

worked on my 2k box...

Hehe, I found out what it was Euclid. It's not the firewall at all. I'm using Opera and I tried opening the page with IE and yup, 'calc.exe' opened.

Well, there's another good reason why you should use Opera and keep away from MS Internet Explorer!! :)

Greg

oh yea i forgot to mention that have to be using IE ....My bad

I tried it out on an XP box and got a warning about the dreaded XMlid.Exploit from Norton 2002. Nice to see the virus protection software is earning it's keep........

yea i just checkd out atS.A.R.C.

This was just discoved on march 6th and if you have the lates virus protection it should stop it. They classified it as Zoo/Trojan

I check for updates religiously and usually Norton will update daily.


I've got a few box's that run the freeware AVG and you won't got an updated database for a week! I suppose you really do "get what you pay for"..............

UPDATE:

sample of the code:

<object id="oFile" classid="clsid:11111111-1111-1111-1111-111111111111"
codebase="c:/WINDOWS/system32/calc.exe"></object>

I did some experiments and changed where it says c:/WINDOWS/system32/calc.exe"> to ftp://ftp.aol.com and then did netstat and it said i was connected to ftp.aol.com. It does not open IE though but the connection is running in the background...

Hello Euclid,

I tried earlier to use this exploit to do something more constructive but with no sussess. This is a example about what I tried to do amongst other things aswell "cmd /c netstat -an > status.txt".

I could open a shell but not make anything further with it and I did not succed to pass any arguments to any program.

Have you been more successful then I have been, and really used the bug to do something constructive or destructive please send me a PM with the details.

~micael

did you try encoding the spaces and the slash?
that would make it:
"cmd%20/c%20netstat%20-an%20>%20status.txt"

never mind, i just tryed it on my own...i bet if your inventive enough you can get it to do commands...

i have also discovered that it has to be plain text, no encoded chars or it doesnt work(atleast it didnt work when i encoded the whole thing)

Conf1rm3d_K1ll - I have NAV corp ed 7.6 with the latest updates. Mine did not catch the exploit. It didnt even give me any warning. I'm probably gonna end up calling Sytmantec on it, but you have any ideas why it wouldnt catch it?
It would be great if I can rely on NAV to stop this instead of waiting for MS to patch it.
Thanks

Nice Sygate'll stop even these type of attacks. Sweet. I wonder if anyone running NeoWatch or Tiny wouldn't mind trying it.??????? And maybe let me know.........

I found a simmilar one here

http://www.liquidwd.freeserve.co.uk/

Hello everyone. I found a way to prevent this exploit from working. In Internet Explorer go to tools, Internet Options, then click on the Security Tab. At the security tab choose custom level. Disable the "Download unsigned ActiveX controls, and "Initialize and script ActiveX controls not marked as safe". Now the malicious code will no longer work on your system.

Updated NAV 2001 (defs dated 03/08) did NOT catch it...

Sygate did NOT catch it....

there is no hotfix at m$ yet...

this may in fact be the worst freakin exlpoit yet....

FORMAT C:??!!!!???? for f8ck sake....i'm so pissed right now...

thnx for the heads up Euclid

Hey just to let you people know the Default on IE 6 says to prompt the user if an unsigned Active X control is downloaded, well Microsoft fubared and it won't even tell you. So make sure to change that. Check your clone browsers too..


Good Job Preacher!

Korp Death--In response to your Tiny request

I am running Win Me, with Norton av, AVG av, AND Tiny personal firewall, and my calculator popped up just as pretty as a picture.....and I update my av daily.

Okay, now I am going to turn my computer off....thought I was relatively safe!!

@!&#!(!&#@

:eek:

Quote:

---

Originally posted here by zigar
Updated NAV 2001 (defs dated 03/08) did NOT catch it...

Sygate did NOT catch it....

there is no hotfix at m$ yet...

this may in fact be the worst freakin exlpoit yet....

FORMAT C:??!!!!???? for f8ck sake....i'm so pissed right now...

thnx for the heads up Euclid

---

just so you know, i have yet to see any evidence that there is a way do anything other than open the program, so as we know it, there is no possible way to format the c drive(unless the box has already been compromised and there is a known exe or batch file that may be run to do so).

FYI -
Under IE 5.00, and 6.0 (accoriding to Preacher) you can disable the 'Download unsigned ActiveX controls', and it will stop the .exe from running. In IE 5.5 SP2, you can disable the ActiveX all you want, and the exe is still going to run.

well...i'm running 5.5 here...so it does run....

HOWEVER THERE IS A FIX...

Quote:

---

Update - 3 Mar 2002
Since the injected <object> runs in the "My Computer" Zone changing the Internet Zone's settings didn't affect it, but changing the correct zone's settings will prevent this exploit from running.
Here is the registry information:
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0]
Change the value of "1004" (DWORD) to 0x3.
Many thanks to Axel Pettinger and Garland Hopkins for this workaround.

---

from http://security.greymagic.com/adv/gm001-ie/


here's something interesting...

in searching i found THIS page

which does trigger NAV....

and the page that euclid posted does NOT???...

having looked at the source...the nasty part of the code

Quote:

---

<span datasrc="#oExec" datafld="exploit" dataformatas="html"></span>
<xml id="oExec">
<security>
<exploit>
<![CDATA[
<object id="oFile" classid="clsid:11111111-1111-1111-1111-111111111111" codebase="c:/winnt/system32/calc.exe"></object>
]]>
</exploit>
</security>
</xml>

---

is exactly the same...so question is why is NAV finding one...but not the other...also...even though NAV does detect the file...it still allows the code (calc.exe) to be run...nice...

Quote:

---

yet to see any evidence that there is a way do anything other than open the program

---

if it can be done....it will be done...and looks like it might already have been...check this out...with particular attention to the last paragraph

http://www.hackcanada.com/ice3/misc/...rcefeeding.txt

Yeah it worked on my ME box, I'm also running TPF. But I suppose firewalls wouldn't really have anything to do with it.