Possible new cross zone scripting in IE

[Cheng Peng Su]

title:Possible new cross zone scripting in IE
program:MS Internet Explorer
test on:IE 6.0(sp1),winXP/ME

Proof of Concept:
From res://C:\WINDOWS\SYSTEM\BROWSELC.DLL/mbOffline.htm
,i found
<a href="shell:My Music" onmouseover="window.status=L_MyMusic_Text;return true" onmouseout="window.status='';return true">
this links to a folder(c:\My document\My Music).

I built a page(http://www.freewebs.com/applesoup/shell_my_music.htm) like following:
<iframe src="shell:my music"/>
this frame is in "My computer" zone.
I think there is some way to make cross zone scripting to this frame.






-------------
Cheng Peng Su

[http-equiv@excite.com]

<!--

Cheng Peng Su Wrote:

<a href="shell:My Music"

-->

Excellent ! The revival of the Pull's shell game:

"directoryInfo.html", ie the "file://::{CLSID}"

[see: http://www.securityfocus.com/bid/3867/]


The following on this so-called Microsoft Windows XP machine:

Control Panel
Administrative Tools
Cache
CD Burning
Cookies
Desktop
Favorites
Fonts
History
Application Data
Local Settings
My Music
My Pictures
My Video
NetHood
Personal [my documents]
PrintHood
Programs
Recent
SendTo
Start Menu
Startup
Templates

http://www.malware.com/shell.game.html

"Cache" can be very interesting


--
http://www.malware.com