HijackClick 3

[Paul]

Note: This vulnerability as well as several more can be found at http://www.greyhats.cjb.net

HijackClick 3!!!
Took the name from Liu Die Yu :)

[Tested]
IEXPLORE.EXE file version 6.0.2800.1106
MSHTML.DLL file version 6.00.2800.1400
Microsoft Windows XP sp2

[Discussion]
The HijackClick series have been used to force a drag and drop event simply from the user clicking a something. This is done by moving the window when onmousedown fires. Previously, window.moveBy/To has been used. This has been patched. Apparently, window
.resizeBy/To would work too because it gives access denied if it tries to execute when onmousedown fires. Microsoft just disabled those functions from being called when the mouse button is down and called it patched. No more hijackclick, right?

Wrong.

Popup.show() allows you to show a popup with desired left, top, height, and width values. The show() function doesnt give access denied when we call it on mousedown. Let's try it with a link on a popup. I'll make show() move the popup off the screen. Does
it work? Yes, it changes the cursor. Good. A drag event just took place. With a little fine-tuning, we can make it show the popup on loading of the main window, move the popup and show a favorites list on mousedown, and set a timer to hide the favorites
list and taunt the victim who just got tricked into adding a link of our choice to their favorites list :).

[Example]
http://freehost07.websamba.com/greyhats/hijackclick3.htm

And when you patch this one, Microsoft, please remember to patch the show() function method cache part, too. You don't want HijackClick4, do you? ;)

[Drew Copley]

=20

> -----Original Message-----
> From: http-equiv@excite.com [mailto:1@malware.com]=20
> Sent: Monday, July 12, 2004 12:06 PM
> To: bugtraq@securityfocus.com
> Cc: NTBugtraq@listserv.ntbugtraq.com
> Subject: Re: HijackClick 3
>=20

<snip>

> This is absolutely fantastic Paul, with a patented double-click=20
> of the mouse we can remotely take over the target's computer:
>=20
> Just substitute as follows:
>=20
> 1. <img src=3D"greyhat.html" id=3Danch=20
> =
onmousedown=3D"parent.nsc.style.width=3D2000;parent.nsc.style.hei ght=3D
> 2000;parent.pop.show(1,1,1,1);parent.setTimeout('s howalert
> ()',3000);" style=3D"width=3D168px;height=3D152px;background-image:url
> ('youlickit.gif');cursor:hand" title=3D"click me!"></a>
>=20
> 2. location=3D"shell:favorites\\greyhat[1].htm"
>=20
> Someone was querying the other day whether shell in Internet=20
> Explorer poses a problem [despite repeated demonstrations].=20
> Pah ! Probably not.
>=20
> Quick and Dirty Working Demo:
>=20
> http://www.malware.com/paul.html

Just to add... this, too, works on using shell.application,
a bug which has been open for around ten months.=20

In fact, I don't think there has been a bug in about ten
months (coincidentally) that does not rely on either Jelmer's
adodb bug or your shell.application bug.

Microsoft can remove the threat from all users right now, today,
and issue a fix. We won't see criminals using these things
to grab people's money tommorrow. We won't see hundreds of articles
critical of their browser. We won't see devious, targetted
attacks on bank employees or anyone else.

Remove the escalating security holes, and you remove the
ones that depend on it. They then might only serve some use
for phishers and the like, people who are only minorly more
successful using such exploits over using straight cons.

=20

> --=20
> http://www.malware.com
>=20
>=20
>=20
>=20

[http-equiv@excite.com]

Thor Larholm ha scritto nel messaggio:

> From: Drew Copley
> > In fact, I don't think there has been a bug in about ten
> > months (coincidentally) that does not rely on either
Jelmer's
> > adodb bug or your shell.application bug.

> I'm sorry, but did everybody suddenly forget about codeBase
command
> execution? Use a non-existent GUID for your OBJECT's classid
and point
> the codeBase attribute to the executable you want launched.

The codebase has been out of use since May 2003 at which time I
noted it had been patched:

http://cert.uni-
stuttgart.de/archive/ntbugtraq/2003/05/msg00005.html

Up until yesterday it still did not work, however after
Microsoft's series of patches it seems
to be back with mixed results.

> Well technically, you also posted about it in 200 and gave
proper credit
> to Dildog.

Technically I found and used the concept in June of 2000 at
which time everyone got it wrong. It was the runner window
object a piece of code designed to do just that, which allowed
for a file in the same directory to execute without having to
point to it.

http://www.securityfocus.com/archive/1/66678

The entire concept of little 'Zones' was so alien to everyone
back then that CERT even missed the point until I explained and
demo'd it to them:

http://www.cert.org/advisories/CA-2000-14.html

I don't recall seeing your name around back in those 'good old
days'.

> codeBase has been the basis of most IE exploits before we
started using
> AD+ODB or Sh+ell

No it hasn't. While the executing of files already on the
machine proved to be nothing more than 'parlor tricks' the
real 'trick' was to introduce arbitrary code to run. That was
achieved only by encoding the executable in base64 and
extracting it using mthml and referencing to the embedded
executable that way. This is note the same as the code base
pointing to a 'compiled' arbitrary executable introduced onto
the machine which is next to impossible except for some rare
bypassing of the Temporary Internet File. All methods via MHTML
or CHM files are closed as well. The introduction or the ability
to 'run' adobd in the Local Zone itself is sufficient to use any
other measure to then execute the file it has written. No need
to use codebase [which in that 'era' didn't work anyway] to run
it. Shell has never been used with any measure of success 'in
the wild' owing to its limited [at the time] capabilities. Only
very recently was it demonstrated to enjoy even more powerful
capabilities by combining a number of different techniques:

http://msgs.securepoint.com/cgi-bin/get/bugtraq0407/32.html

But this is a complete waste of time. It has been patched, as
has the adobd.stream. Both of which do not work on Windows 95 or
Windows 98 as they are not installed.

> The codeBase attribute allows command execution from the My
Computer
> zone and you can mitigate against it by either completely
disabling
> ActiveX in that zone or setting it to only allow administrator
approved
> ActiveX controls.

You don't need to do either. It has been sufficiently patched
all this time except by all indications as of yesterday with the
introduction of the 'mega patch' series from Microsoft. In any
event to introduce the executable you intend to run is next to
impossible and only digitally signed files can bypass whatever
warnings or prompts remain today [as noted above in May 2003]



>The latter will solve the functionality regression
> problem that e.g. MMC and Norton Antivirus will have since
both of these
> rely on executional privileges given by the My Computer zone.
This is
> also the approach we took in Qwik-Fix ( http://qwik-
fix.net/ ).

Regrettably I cannot find any validity to this. For all the
reasons already stated. By the way despite 'hiding' the download
url of your little 'gimmick' a quick Google shows where it can
be downloaded. Having now 'played' with it for a number of weeks
I could not in good faith recommend it to anyone. Unraveling its
code reveals nothing more than a series of registry entries that
are freely available from Microsoft directly plus all the so-
called 'killbit' registry entries everyone else has been
recommending from day one. With a difference of a 'little'
on/off switch. The entire thing can be accomplished with a .vbs
file or any other number of scriptings. That plus an elaborate
[and in my opinion unnecessary 'updating' scheme. The 'scheme'
itself comprises the whole gadget]. While it certainly
does 'killbit' what everyone has been discussing and how to do
it for what seems like ages now, I am unable to see any effect
whatsoever in regards to the 'import win32api, win32con name
= "Zones fix" ' -- it simply does not work on my stock, fully
patched test machine XP home. The little 'log file' you provides
confirms it is enabled, but it does absolutely nothing here. All
scripting works in the Local Zone, Jelmers very last demo with
the Java .tmp file my demo of Paul's favorites tricked worked
until shell and its path [which can still be defeated] was
patched yesterday:

- Info: IeZoneFix: Unable to query registry value "{F6406E36-
812A-4501-8C0C-3A6CAEF6DB84}"
- Info: IeZoneFix: Unable to query registry value "{FD0AE533-
61C2-11D2-B980-00805FCDA1A3}"
- Info: IeZoneFix: Enabled.

Furthermore I caught it autoupdating without permission the
other day as well. Despite there being no little 'checkmark' in
that 'feature'. However despite it not working as advertised
[which in itself is quite dangerous creating a complete false
sense of security to the truly 'naive' as it were], the fact
that it overwrites or deletes access to the 'My Computer'
setting in Internet Explorer [having manually applied it] is
simply not acceptable. That is Trojan type behavior. It does not
have permission to effectively 'monkey about' with the computer
owners private / custom settings.

Finally a generous free 'tip' would to not have the
entire 'thing' install in a predictable location particularly as
you have a series text based files in there that may very well
be leveraged down the road [since operations in the My Computer
zone still function].


> You can circumvent the initial restrictions on codebase
through a series
> of Refresh's.

By all accounts the latest patches from Microsoft have an effect
on codebase which appear to allow it to work as before without
any need of anything else. Though thorough testing at this time
is incomplete.


> Microsoft could blacklist the Sh+ell.App+lication object and
still be no
> better off. They could fix codeBase and I am sure we would
find new
> vulnerabilities in IE.

This is all dated now as it is all fixed. As one who is 'in the
trenches' I must admit that I am impressed with this
comprehensive patching to date. Certainly has killed of many
many possibilities [yet some still remain]. But overall I would
give them 3 Gold Stars.

Internet Explorer and its associated or embedded applications
are only getting 'tougher' to defeat. Without a doubt in the
very near future [certainly before the end of this year] it
along with the Operating System should be sufficiently 'locked
down' that all need for third-party gadgetry will be unnecessary
and a waste of time and money.

> Any privileges that you could ever need in the My Computer
zone
> can safely be used from an HTML Application by embedding MSHTA
instead
> of IEXPLORE.

That is the only thing that is correct. We all await XP SP 2 and
will certainly put it through its paces. But you should
understand that all of these 'fun and game' vulnerability
findings in IE are nothing more than a moment in time. So short
a time it would be considered an utter gamble to invest time and
money in such a fleeting moment.


--
http://www.malware.com

[Paul]

In-Reply-To: <200407121905.i6CJ5Z4Q006082@web115.megawebservers. com>

>From: "http-equiv@excite.com" <1@malware.com>
>
>Someone was querying the other day whether shell in Internet
>Explorer poses a problem [despite repeated demonstrations].
>Pah ! Probably not.
>
>Quick and Dirty Working Demo:
>
>http://www.malware.com/paul.html
>
>
>
>--
>http://www.malware.com
>
>

always leave it to malware to follow through with a full system compromise. :)

great work http-equiv

[Thor Larholm]

> -----Original Message-----
> From: http-equiv@excite.com [mailto:1@malware.com]=20

The codeBase attribute has allowed command execution from the My
Computer zone without interruption since this misfeature was discovered
by Dildog. It was not automatically re-enabled with yesterdays patches
so there must have been some other problem with your systems that has
made it untestable for you during the years.

If you need any easily reproduceable POC for codeBase you can use the
example from GM#001-IE [1]. Put a fresh Windows XP image on VMWare or
VirtualPC, apply all the patches up to June/July 2003 and you will see
that the POC still works. You can even combine codebase with any of the
recent click hijacking vulnerabilities from Paul and you can see that
beneath the new Information Bar in SP2 the same codebase functionality
is present (by the way, that bar is not present in the Intranet or
Trusted Sites zones).

[1]
http://www.greymagic.com/security/advisories/gm001-ie/

We have by no means been trying to hide the download location of
Qwik-Fix Pro from anyone. We are in the middle of a data center move and
have been readily handing out internal download locations and
instructions, delivering guidance and support to anyone who has
inquired. However, I cannot locate a download request from you in our
support center.

Qwik-Fix Pro is currently in Release Candidate 1 with a planned General
Availability for August. We most certainly appreciate the tremendous
beta feedback we have received over these last months, it has helped us
tremendously. It is not apparent from your post whether you have been
testing the long ago discontinued Qwik-Fix Beta v0.60 or the later
Qwik-Fix Pro, but the description of your problems sounds as if no
changes are even applied to your system. If you could give us more
details about your system (OS, SP level) I would love to reproduce this.

You are not mentioning any of the URL protocol handler lockdowns, MIME
type mitigations or icon handler restrictions that RC1 contains so I am
guestimating that you have been testing an older beta version. Feel very
welcome to request an RC1 download from our site.=20

I am also positive that your concerns about the updating logic will be
answered fully once you look at the multiple layers of encryption and
digital signatures based on 2048 bit RSA keys that combined mitigate
against the impact of any imaginable MITM attack - these are all covered
in the complete forensics analysis of Qwik-Fix Pro that will be released
in the near future. We are trying to far exceed the industry
expectations on the level of openness and are eagerly playing cards with
our hands open.

It is encouraging that you have enough faith in Windows XP Service Pack
2 to hint that it will solve all the security issues in Internet
Explorer. I will have to disagree on that sentiment as vulnerabilities
have been discovered that even work on a fully patched XPSP2RC2. Much as
you, I am looking forward to the improvements of the final service pack.


Regards

Thor Larholm
Senior Security Researcher
PivX Solutions
23 Corporate Plaza #280
Newport Beach, CA 92660
http://www.pivx.com
thor@pivx.com
Stock symbol: (PIVX.OB)
Phone: +1 (949) 231-8496
PGP: 0x4207AEE9
B5AB D1A4 D4FD 5731 89D6 20CD 5BDB 3D99 4207 AEE9

PivX defines a new genre in Desktop Security: Proactive Threat
Mitigation.=20
<http://www.pivx.com/qwikfix>