TUCoPS :: Browsers :: hack2188.htm

IE Remote Compromise by Getting Cache Location
IE Remote Compromise by Getting Cache Location

IE Remote Compromise by Getting Cache Location


OS:WinXp, CN version

Microsoft Internet Explorer v6.Sp1; up-to-date on 2003/11/16


With the help of LocalZoneInCache(refer to "[technical details]" part), an attacker can compromise a user's system even though the user has:

1. Customized IE cache directory,

2. Applied MS03-048 patch,

3. Set killbit for ADODB.STREAM ActiveX.


online demo, powered by ASP:

http://www.safecenter.net/UMBRELLAWEBV4/execdror6/execdror6-D emo/index.html

(runs harmless demonstration executable)

[technical details]

execdror6 is derived from execdror5.

(Liu Die Yu's http://www.safecenter.net/UMBRELLAWEBV4/execdror5/) 

execdror6 differs from execdror5 in that:

1st, execdror6 uses LocalZoneInCache to reach MYCOMPUTER security zone.

(Liu Die Yu's http://www.safecenter.net/UMBRELLAWEBV4/LocalZoneInCache/inde x.html)

2nd, execdror6 gets IE cache directory directly from location.href.

(LocalZoneInCache makes attaker's HTML page opened in cache directory.)


Disable Active Scripting in INTERNET zone, so HTML page opened in the cache can't send information back to the attacker.


greetings to:

Drew Copley, dror, guninski, vadim and mkill.


all mentioned resources can always be found at UMBRELLA.MX.TC


LiuDieyuinchina [N0-@-Sp2m] yahoo.com.cn

UMBRELLA.MX.TC ==> How to contact "Liu Die Yu"


I would like to work professionally as a security researcher/bug finder. 

See my resume at my site. I am very eager to work, flexible, and 

extremely productive. I have a top notch resume, with credentials 

from leading bug finders. I am willing to work per contract, relocate, 

or telecommute. 


[Give a Hand]

I haven't got a job as a security researcher yet and my family don't support my security work - so, I don't have a computer of my own. Please consider about donating at:


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH