SECURE SOCKETS LAYER COELACANTH: Phreak Phishing Expedition

[http-equiv@excite.com]

We wrap this up with a full-on ssl site spoof. It seems limited
how far you can 'shove' the real domain out of the way, but just
enough to make it convincing so we adapt the window to 'cover'
it up. Interestingly [with apologies to e-gold for playing with
their site], they have a secured connection [ignore the warning]
which gives us our https, our little golden 'safe' padlock and
most interestingly, all the links inside the site function and
show the spoofed address:


http://www.malware.com/gutted.html

couple all that with the absurd ability to trick Internet
Explorer into believing it is in a 'trusted zone' by inserting
whatever gibberish you want into the fake link regardless of the
actual domain, and you have the catch of the day.

Big thanks to Drew Copley for whacking the sucker on the head,
Brett Moore for correctly pointing out that it can be achieved
without the 'redir' thing as well being able to stuff it with
anything else you want and expedition leader: 'bitlance winter'
who sighted it, tracked it, snagged it and reeled it in.

End Call

--
http://www.malware.com

[Jelmer]

>As a addendum, perhaps, though I wouldn't doubt someone
>might make some nice proof of concept code for this...

Don't mind if I do :)

The following demo will read out your logon name and your logon domain, or
at least it should :)

http://jelmer.homedns.org/test.htm

The url used is http://jelmer%2fwww.jelmer.homedns.org

The problem is that ie looks at the part before the %2f to determine the
security zone etc but then loads the url in it's entirety, like this

http://jelmer - used to determine the zone
http://jelmer/www.jelmer.homedns.org - loaded

IE treats any url it sees without a period in it such as http://jelmer as
part of the Local Intranet Zone

From the intranet zone we can easily obtain the logon name because Automatic
logon thru NTLM is enabled by default in the intranet zone.


Code at http://jelmer.homedns.org/code.zip

I excluded the rather large jcifs jar, you can download it from
http://jcifs.samba.org/src/jcifs-0.9.2.jar and place it in the lib folder