Onderwerp: MSIE Download Window Filename + Filetype Spoofing Vulnerability

Note: This vulnerability as well as several more can be found at http://www.greyhats.cjb.net

Download Window Filename + Filetype Spoofing Vulnerability

[Tested]
IEXPLORE.EXE file version 6.0.2800.1106
MSHTML.DLL file version 6.00.2800.1400
Microsoft Windows XP sp2

[Discussion]
When a webpage offers a file who's mime type can't be opened in a browser, Internet Explorer usually displays a download window with the filename and its type. Previous vulnerabilities have been used to spoof the filename so the victim thinks the file is
something it isn't. This is one of those vulnerabilities.

Window.createPopup() creates a popup that goes on top of every other window. This includes applications other than internet explorer. This doesn't seem like the greatest idea, but it could be useful if you want to get urgent information out to someone. By
placing the popup in a certain location, we can cover up the filename and its type in the download window and replace it with our own. One more thing, we need to set the popup's onoffload to open itself back up, because if the parent window is clicked af
ter a popup opens, the popup is closed.

The example tells internet explorer to download badfile.exe, which of course is an 'Application'. A popup is then opened covering up the filename and type and replaces it with 'sexycoeds.jpg' (GGW commercial was on when I was writing this which is a 'J
PEG Image'. The viewer should press 'open' to view the sexy coeds right away, which will download and run badfile.exe. If you want, you can name the executable sexycoeds.exe and change the icon so if the user presses 'save' windows should hide the extensi
on and it will still look like a jpg image.

[Example]
http://freehost07.websamba.com/greyhats/dlwinspoof.htm

Should you not be able to tile your gui any way you please?=20

Someone may be thinking that you could put an image in front of the =
security box in order to trick users into clicking on "open" without =
knowledge. I noticed that you cant click on the buttons when the image =
is in front of them.

Would you be able to have an insane speed at which the object moves over =
the buttons, or a pulse action to where the image would appear to be =
solid, but would still select "open" when pressed?

jp

-----Original Message-----
From: Drew Copley [mailto:dcopley@eEye.com]

=20

> -----Original Message-----
> From: Polazzo Justin [mailto:Justin.Polazzo@facilities.gatech.edu]=20
> Sent: Monday, July 12, 2004 12:22 PM
> To: Drew Copley
> Cc: bugtraq@securityfocus.com
> Subject: RE: MSIE Download Window Filename + Filetype=20
> Spoofing Vulnerability
>=20
> Should you not be able to tile your gui any way you please?=20

You can title your UI anyway you please.

>=20
> Someone may be thinking that you could put an image in front=20
> of the security box in order to trick users into clicking on=20
> "open" without knowledge. I noticed that you cant click on=20
> the buttons when the image is in front of them.
>=20

I haven't checked out the new demo, but it is inconsquential,
you can totally change the contents of the window so that "No"
becomes "yes", or "yes" becomes "no", or whatever else. [By
stating, "Do Not Run This App", for instance, turns the positive
into the negative.]

"Close this window"?

"Yes".

Boom.

There are countless variations on this as you can put in there,
around there, all around anything you want.

It is a pain to make a really good demo, though, this is
why no one has probably messed with it. And, it is likely
too old for the current wave of criminals to get a handle
on it.

Well, not anymore. But, thankfully, Microsoft fixed this in
SP 2. Hopefully everyone else will get this fix in their
IE as well.


> Would you be able to have an insane speed at which the object=20
> moves over the buttons, or a pulse action to where the image=20
> would appear to be solid, but would still select "open" when pressed?

Yeah, you can probably flicker it and hide it as well.

Really, the exploitation is for an artist...

>=20
> jp
>=20
> -----Original Message-----
> From: Drew Copley [mailto:dcopley@eEye.com]
>=20

The examples do not work on XP Sp2 version of IE. (6.0.2900.2149).

E.

-----Original Message-----
From: Drew Copley [mailto:dcopley@eEye.com]
Sent: Monday, July 12, 2004 11:21 AM
To: Paul; bugtraq@securityfocus.com
Subject: RE: MSIE Download Window Filename + Filetype Spoofing
Vulnerability


This is an open bug. (One which is rather disturbing, so I am
not sure why Microsoft has chosen to not fix it.)

Date: 21 October 2001=20
http://www.guninski.com/popspoof.html

"Demonstration:=20

Image moving over download/open dialog:=20
http://www.guninski.com/opf2.html "


=20

> -----Original Message-----
> From: Paul [mailtoaul@greyhats.cjb.net]=20
> Sent: Sunday, July 11, 2004 8:52 AM
> To: bugtraq@securityfocus.com
> Subject: MSIE Download Window Filename + Filetype Spoofing=20
> Vulnerability
>=20
>=20
>=20
> Note: This vulnerability as well as several more can be found=20
> at http://www.greyhats.cjb.net
>=20
>=20
>=20
> Download Window Filename + Filetype Spoofing Vulnerability=20
>=20
>=20
>=20
> [Tested]
>=20
> IEXPLORE.EXE file version 6.0.2800.1106
>=20
> MSHTML.DLL file version 6.00.2800.1400
>=20
> Microsoft Windows XP sp2=20
>=20
>=20
>=20
> [Discussion]
>=20
> When a webpage offers a file who's mime type can't be opened=20
> in a browser, Internet Explorer usually displays a download=20
> window with the filename and its type. Previous=20
> vulnerabilities have been used to spoof the filename so the=20
> victim thinks the file is something it isn't. This is one of=20
> those vulnerabilities.=20
>=20
>=20
>=20
> Window.createPopup() creates a popup that goes on top of=20
> every other window. This includes applications other than=20
> internet explorer. This doesn't seem like the greatest idea,=20
> but it could be useful if you want to get urgent information=20
> out to someone. By placing the popup in a certain location,=20
> we can cover up the filename and its type in the download=20
> window and replace it with our own. One more thing, we need=20
> to set the popup's onoffload to open itself back up, because=20
> if the parent window is clicked after a popup opens, the=20
> popup is closed.=20
>=20
>=20
>=20
> The example tells internet explorer to download badfile.exe,=20
> which of course is an 'Application'. A popup is then opened=20
> covering up the filename and type and replaces it with=20
> 'sexycoeds.jpg' (GGW commercial was on when I was writing=20
> this which is a 'JPEG Image'. The viewer should press=20
> 'open' to view the sexy coeds right away, which will download=20
> and run badfile.exe. If you want, you can name the executable=20
> sexycoeds.exe and change the icon so if the user presses=20
> 'save' windows should hide the extension and it will still=20
> look like a jpg image.=20
>=20
>=20
>=20
> [Example]
>=20
> http://freehost07.websamba.com/greyhats/dlwinspoof.htm
>=20