RE: [Full-Disclosure] Re: IE Shell URI Download and Execute, POC

[Ferruh Mavituna]

> Is the vulnerability mitigated by
> today's Microsoft patch?

Both of POCs are working well (at least in my system -W2K3 all patches-)
after recent MS patches.

Can anyone confirm this ?


Ferruh.Mavituna
http://ferruh.mavituna.com
PGPKey : http://ferruh.mavituna.com/PGPKey.asc

> -----Original Message-----
> From: full-disclosure-admin@lists.netsys.com [mailto:full-disclosure-
> admin@lists.netsys.com] On Behalf Of L33tPrincess
> Sent: Wednesday, July 14, 2004 5:34 AM
> To: bugtraq@securityfocus.com; full-disclosure@lists.netsys.com
> Subject: [Full-Disclosure] Re: IE Shell URI Download and Execute, POC
>
> Ferruh,
> Is this a new variant (wscript.shell)? Is the vulnerability mitigated by
> today's Microsoft patch?
>
>
>
> Hello;
>
> Code is based on http://www.securityfocus.com/archive/1/367878 (POC by
> Jelmer) message. I just added a new feature "download" and then execute
> application. Also I use Wscript.Shell in Javascript instead of
> Shell.Application.
>
> ________________________________
>
> Do you Yahoo!?
> New and Improved Yahoo! Mail
> <http://us.rd.yahoo.com/mail_us/taglines/100/*http://promotions.yahoo.com/
> new_mail/static/efficiency.html> - 100MB free storage!

[Drew Copley]

=20

> -----Original Message-----
> From: Ferruh Mavituna [mailto:ferruh@mavituna.com]=20
> Sent: Wednesday, July 14, 2004 7:52 AM
> To: 'L33tPrincess'; bugtraq@securityfocus.com;=20
> full-disclosure@lists.netsys.com
> Subject: RE: [Full-Disclosure] Re: IE Shell URI Download and=20
> Execute, POC
>=20
> > Is the vulnerability mitigated by
> > today's Microsoft patch?
>=20
> Both of POCs are working well (at least in my system -W2K3=20
> all patches-)
> after recent MS patches.
>=20
> Can anyone confirm this ?

I can not. Wscript was deactivated with Guninski's WSH bug
a long time ago. I just tested running wscript in the My
Computer zone. It prompts as an unsafe activex.

However, Microsoft needs to get on the ball here and secure
that zone or make it trivial for their customers to do so. (Kudos
for their link on their security page, but that kind of
thing is targetted to IT professionals -- not to the masses...
and they can figure that out by themselves already.)

I also noticed the shell: path url does work as a source in
an iframe.




>=20
>=20
> Ferruh.Mavituna
> http://ferruh.mavituna.com
> PGPKey : http://ferruh.mavituna.com/PGPKey.asc
>=20
> > -----Original Message-----
> > From: full-disclosure-admin@lists.netsys.com=20
> [mailto:full-disclosure-
> > admin@lists.netsys.com] On Behalf Of L33tPrincess
> > Sent: Wednesday, July 14, 2004 5:34 AM
> > To: bugtraq@securityfocus.com; full-disclosure@lists.netsys.com
> > Subject: [Full-Disclosure] Re: IE Shell URI Download and=20
> Execute, POC
> >=20
> > Ferruh,
> > Is this a new variant (wscript.shell)? Is the=20
> vulnerability mitigated by
> > today's Microsoft patch?
> >=20
> >=20
> >=20
> > Hello;
> >=20
> > Code is based on=20
> http://www.securityfocus.com/archive/1/367878 (POC by
> > Jelmer) message. I just added a new feature "download" and=20
> then execute
> > application. Also I use Wscript.Shell in Javascript instead of
> > Shell.Application.
> >=20
> > ________________________________
> >=20
> > Do you Yahoo!?
> > New and Improved Yahoo! Mail
> >=20
> <http://us.rd.yahoo.com/mail_us/taglines/100/*http://promotion
> s.yahoo.com/
> > new_mail/static/efficiency.html> - 100MB free storage!
>=20
>=20

[Todd Towles]

Once again, they are trying to patch the attack vector used instead of =
the
core IE problem itself (which is directly related to it being tied into =
the
OS level). I was once very pro-microsoft SMS Admin for my company but it =
is
getting out of hand.=20

If you patch a hole, instead of a vector, then L33tPrincess wouldn't be =
able
to add a couple of lines to the code and change the vector to make the
exploit workable in like 10 mins.

It is like they are throwing the media and the mass public trash "fix" =
to
make them happy while people like us shake our heads at what the public
doesn't know. The multiple patches for the same problem with different =
MS
numbers, it is a sad thing.

-----Original Message-----
From: Ferruh Mavituna [mailto:ferruh@mavituna.com]=20
Sent: Wednesday, July 14, 2004 1:15 PM
To: 'Todd Towles'; 'L33tPrincess'; bugtraq@securityfocus.com;
full-disclosure@lists.netsys.com
Subject: RE: [Full-Disclosure] Re: IE Shell URI Download and Execute, =
POC

The fun is MS says we fixed "shell" but it's still active for me.

Ferruh.Mavituna
http://ferruh.mavituna.com
PGPKey : http://ferruh.mavituna.com/PGPKey.asc

> -----Original Message-----
> From: full-disclosure-admin@lists.netsys.com [mailto:full-disclosure-
> admin@lists.netsys.com] On Behalf Of Todd Towles
> Sent: Wednesday, July 14, 2004 6:18 PM
> To: 'L33tPrincess'; bugtraq@securityfocus.com; full-
> disclosure@lists.netsys.com
> Subject: RE: [Full-Disclosure] Re: IE Shell URI Download and Execute, =
POC
>=20
> Depends on how Microsoft fixed IE. If they did the same thing as the =
ADODB
> patch from last week and just focused on the Shell.Application variant
> instead of the code IE problem, then it won't stop this WSH variant by
> L33tPrincess. Which I must say is a sweet name. =3D)
>=20
>=20
>=20
>=20
>=20
> -----Original Message-----
> From: full-disclosure-admin@lists.netsys.com [mailto:full-disclosure-
> admin@lists.netsys.com] On Behalf Of L33tPrincess
> Sent: Tuesday, July 13, 2004 9:34 PM
> To: bugtraq@securityfocus.com; full-disclosure@lists.netsys.com
> Subject: [Full-Disclosure] Re: IE Shell URI Download and Execute, POC
>=20
>=20
>=20
> Ferruh,
>=20
> Is this a new variant (wscript.shell)? Is the vulnerability mitigated =
by
> today's Microsoft patch?
>=20
>=20
>=20
>=20
>=20
>=20
>=20
> Hello;
>=20
> Code is based on http://www.securityfocus.com/archive/1/367878 (POC by
> Jelmer) message. I just added a new feature "download" and then =
execute
> application. Also I use Wscript.Shell in Javascript instead of
> Shell.Application.
>=20
> ________________________________
>=20
> Do you Yahoo!?
> New and Improved Yahoo! Mail
> =
<http://us.rd.yahoo.com/mail_us/taglines/100/*http:/promotions.yahoo.com/=
n
> ew_mail/static/efficiency.html> - 100MB free storage!

[Ferruh Mavituna]

The fun is MS says we fixed "shell" but it's still active for me.

Ferruh.Mavituna
http://ferruh.mavituna.com
PGPKey : http://ferruh.mavituna.com/PGPKey.asc

> -----Original Message-----
> From: full-disclosure-admin@lists.netsys.com [mailto:full-disclosure-
> admin@lists.netsys.com] On Behalf Of Todd Towles
> Sent: Wednesday, July 14, 2004 6:18 PM
> To: 'L33tPrincess'; bugtraq@securityfocus.com; full-
> disclosure@lists.netsys.com
> Subject: RE: [Full-Disclosure] Re: IE Shell URI Download and Execute, POC
>
> Depends on how Microsoft fixed IE. If they did the same thing as the ADODB
> patch from last week and just focused on the Shell.Application variant
> instead of the code IE problem, then it won't stop this WSH variant by
> L33tPrincess. Which I must say is a sweet name. =)
>
>
>
>
>
> -----Original Message-----
> From: full-disclosure-admin@lists.netsys.com [mailto:full-disclosure-
> admin@lists.netsys.com] On Behalf Of L33tPrincess
> Sent: Tuesday, July 13, 2004 9:34 PM
> To: bugtraq@securityfocus.com; full-disclosure@lists.netsys.com
> Subject: [Full-Disclosure] Re: IE Shell URI Download and Execute, POC
>
>
>
> Ferruh,
>
> Is this a new variant (wscript.shell)? Is the vulnerability mitigated by
> today's Microsoft patch?
>
>
>
>
>
>
>
> Hello;
>
> Code is based on http://www.securityfocus.com/archive/1/367878 (POC by
> Jelmer) message. I just added a new feature "download" and then execute
> application. Also I use Wscript.Shell in Javascript instead of
> Shell.Application.
>
> ________________________________
>
> Do you Yahoo!?
> New and Improved Yahoo! Mail
> <http://us.rd.yahoo.com/mail_us/taglines/100/*http:/promotions.yahoo.com/n
> ew_mail/static/efficiency.html> - 100MB free storage!

[Ferruh Mavituna]

It's my fault; I had a bad configuration on my computer.
Now I see it's patched correctly and this POC is not working anymore on
fully patched windows.

Ferruh Mavituna
http://ferruh.mavituna.com
PGP Key: http://ferruh.mavituna.com/pgpkey.asc

-----Original Message-----
From: Fabricio A. Angeletti [mailto:hellmind@rotten.daemon.sh]
Sent: 17 Temmuz 2004 Cumartesi 05:17
To: Todd Towles; 'Ferruh Mavituna'; 'L33tPrincess';
bugtraq@securityfocus.com; full-disclosure@lists.netsys.com
Subject: Re: [Full-Disclosure] Re: IE Shell URI Download and Execute, POC

Its patched for me,
there is another patch for it
maybe u didnt installed or isnt active
do u got a web to test it?

----- Original Message -----
From: "Todd Towles" <toddtowles@brookshires.com>
To: "'Ferruh Mavituna'" <ferruh@mavituna.com>; "'L33tPrincess'"
<l33tprincess@yahoo.com>; <bugtraq@securityfocus.com>;
<full-disclosure@lists.netsys.com>
Sent: Wednesday, July 14, 2004 3:20 PM
Subject: RE: [Full-Disclosure] Re: IE Shell URI Download and Execute, POC


> Once again, they are trying to patch the attack vector used instead of the
> core IE problem itself (which is directly related to it being tied into
the
> OS level). I was once very pro-microsoft SMS Admin for my company but it
is
> getting out of hand.
>
> If you patch a hole, instead of a vector, then L33tPrincess wouldn't be
able
> to add a couple of lines to the code and change the vector to make the
> exploit workable in like 10 mins.
>
> It is like they are throwing the media and the mass public trash "fix" to
> make them happy while people like us shake our heads at what the public
> doesn't know. The multiple patches for the same problem with different MS
> numbers, it is a sad thing.
>
> -----Original Message-----
> From: Ferruh Mavituna [mailto:ferruh@mavituna.com]
> Sent: Wednesday, July 14, 2004 1:15 PM
> To: 'Todd Towles'; 'L33tPrincess'; bugtraq@securityfocus.com;
> full-disclosure@lists.netsys.com
> Subject: RE: [Full-Disclosure] Re: IE Shell URI Download and Execute, POC
>
> The fun is MS says we fixed "shell" but it's still active for me.
>
> Ferruh.Mavituna
> http://ferruh.mavituna.com
> PGPKey : http://ferruh.mavituna.com/PGPKey.asc
>
> > -----Original Message-----
> > From: full-disclosure-admin@lists.netsys.com [mailto:full-disclosure-
> > admin@lists.netsys.com] On Behalf Of Todd Towles
> > Sent: Wednesday, July 14, 2004 6:18 PM
> > To: 'L33tPrincess'; bugtraq@securityfocus.com; full-
> > disclosure@lists.netsys.com
> > Subject: RE: [Full-Disclosure] Re: IE Shell URI Download and Execute,
POC
> >
> > Depends on how Microsoft fixed IE. If they did the same thing as the
ADODB
> > patch from last week and just focused on the Shell.Application variant
> > instead of the code IE problem, then it won't stop this WSH variant by
> > L33tPrincess. Which I must say is a sweet name. =)
> >
> >
> >
> >
> >
> > -----Original Message-----
> > From: full-disclosure-admin@lists.netsys.com [mailto:full-disclosure-
> > admin@lists.netsys.com] On Behalf Of L33tPrincess
> > Sent: Tuesday, July 13, 2004 9:34 PM
> > To: bugtraq@securityfocus.com; full-disclosure@lists.netsys.com
> > Subject: [Full-Disclosure] Re: IE Shell URI Download and Execute, POC
> >
> >
> >
> > Ferruh,
> >
> > Is this a new variant (wscript.shell)? Is the vulnerability mitigated
by
> > today's Microsoft patch?
> >
> >
> >
> >
> >
> >
> >
> > Hello;
> >
> > Code is based on http://www.securityfocus.com/archive/1/367878 (POC by
> > Jelmer) message. I just added a new feature "download" and then execute
> > application. Also I use Wscript.Shell in Javascript instead of
> > Shell.Application.
> >
> > ________________________________
> >
> > Do you Yahoo!?
> > New and Improved Yahoo! Mail
> >
<http://us.rd.yahoo.com/mail_us/taglines/100/*http:/promotions.yahoo.com/n
> > ew_mail/static/efficiency.html> - 100MB free storage!
>
>
>

[Fabricio A. Angeletti]

Its patched for me,
there is another patch for it
maybe u didnt installed or isnt active
do u got a web to test it?

----- Original Message -----
From: "Todd Towles" <toddtowles@brookshires.com>
To: "'Ferruh Mavituna'" <ferruh@mavituna.com>; "'L33tPrincess'"
<l33tprincess@yahoo.com>; <bugtraq@securityfocus.com>;
<full-disclosure@lists.netsys.com>
Sent: Wednesday, July 14, 2004 3:20 PM
Subject: RE: [Full-Disclosure] Re: IE Shell URI Download and Execute, POC


> Once again, they are trying to patch the attack vector used instead of the
> core IE problem itself (which is directly related to it being tied into
the
> OS level). I was once very pro-microsoft SMS Admin for my company but it
is
> getting out of hand.
>
> If you patch a hole, instead of a vector, then L33tPrincess wouldn't be
able
> to add a couple of lines to the code and change the vector to make the
> exploit workable in like 10 mins.
>
> It is like they are throwing the media and the mass public trash "fix" to
> make them happy while people like us shake our heads at what the public
> doesn't know. The multiple patches for the same problem with different MS
> numbers, it is a sad thing.
>
> -----Original Message-----
> From: Ferruh Mavituna [mailto:ferruh@mavituna.com]
> Sent: Wednesday, July 14, 2004 1:15 PM
> To: 'Todd Towles'; 'L33tPrincess'; bugtraq@securityfocus.com;
> full-disclosure@lists.netsys.com
> Subject: RE: [Full-Disclosure] Re: IE Shell URI Download and Execute, POC
>
> The fun is MS says we fixed "shell" but it's still active for me.
>
> Ferruh.Mavituna
> http://ferruh.mavituna.com
> PGPKey : http://ferruh.mavituna.com/PGPKey.asc
>
> > -----Original Message-----
> > From: full-disclosure-admin@lists.netsys.com [mailto:full-disclosure-
> > admin@lists.netsys.com] On Behalf Of Todd Towles
> > Sent: Wednesday, July 14, 2004 6:18 PM
> > To: 'L33tPrincess'; bugtraq@securityfocus.com; full-
> > disclosure@lists.netsys.com
> > Subject: RE: [Full-Disclosure] Re: IE Shell URI Download and Execute,
POC
> >
> > Depends on how Microsoft fixed IE. If they did the same thing as the
ADODB
> > patch from last week and just focused on the Shell.Application variant
> > instead of the code IE problem, then it won't stop this WSH variant by
> > L33tPrincess. Which I must say is a sweet name. =)
> >
> >
> >
> >
> >
> > -----Original Message-----
> > From: full-disclosure-admin@lists.netsys.com [mailto:full-disclosure-
> > admin@lists.netsys.com] On Behalf Of L33tPrincess
> > Sent: Tuesday, July 13, 2004 9:34 PM
> > To: bugtraq@securityfocus.com; full-disclosure@lists.netsys.com
> > Subject: [Full-Disclosure] Re: IE Shell URI Download and Execute, POC
> >
> >
> >
> > Ferruh,
> >
> > Is this a new variant (wscript.shell)? Is the vulnerability mitigated
by
> > today's Microsoft patch?
> >
> >
> >
> >
> >
> >
> >
> > Hello;
> >
> > Code is based on http://www.securityfocus.com/archive/1/367878 (POC by
> > Jelmer) message. I just added a new feature "download" and then execute
> > application. Also I use Wscript.Shell in Javascript instead of
> > Shell.Application.
> >
> > ________________________________
> >
> > Do you Yahoo!?
> > New and Improved Yahoo! Mail
> >
<http://us.rd.yahoo.com/mail_us/taglines/100/*http:/promotions.yahoo.com/n
> > ew_mail/static/efficiency.html> - 100MB free storage!
>
>
>