nullbyte Posted May 21, 2008 Report Share Posted May 21, 2008 Buna, recent am luat .bat-ul acela ce scoate reclamele din Yahoo! 8. M-am uitat la cod:@ECHO OFFTITLE Remove ads from Yahoo Messenger 8> %TEMP%.\noYMads.reg ECHO REGEDIT4>>%TEMP%.\noYMads.reg ECHO.>>%TEMP%.\noYMads.reg ECHO [HKEY_CURRENT_USER\Software\Yahoo\Pager\YUrl]>>%TEMP%.\noYMads.reg ECHO "Messenger Ad"="*">>%TEMP%.\noYMads.reg ECHO "Webcam Upload Ad"="*">>%TEMP%.\noYMads.reg ECHO "Webcam Viewer Ad"="*">>%TEMP%.\noYMads.reg ECHO "Webcam Viewer Ad Big"="*">>%TEMP%.\noYMads.reg ECHO "Webcam Viewer Ad Medium"="*">>%TEMP%.\noYMads.reg ECHO "Change Room Banner"="*">>%TEMP%.\noYMads.reg ECHO "Conf Adurl"="*">>%TEMP%.\noYMads.reg ECHO "Chat Adurl"="*">>%TEMP%.\noYMads.reg ECHO "Y Content"="*"REGEDIT /S %TEMP%.\noYMads.regDEL %TEMP%.\noYMads.regATTRIB -R "%PROGRAMFILES%\Yahoo!\Messenger\Cache\urls.xml"ECHO "" >"%PROGRAMFILES%\Yahoo!\Messenger\Cache\urls.xml" ATTRIB +R "%PROGRAMFILES%\Yahoo!\Messenger\Cache\urls.xml"M-am gandit: Yahoo navigheaza folosind Iexplorer undeva unde sunt reclamele... deci as putea sa fac messengerul sa se duca unde vreau eu. Salvati urmatorul cod in Notepad cu extensia .bat.@ECHO OFFTITLE Yahoo bug by nullbyte.taskkill /F /IM YahooMessenger.exe> %TEMP%.\noYMads.reg ECHO REGEDIT4>>%TEMP%.\noYMads.reg ECHO.>>%TEMP%.\noYMads.reg ECHO [HKEY_CURRENT_USER\Software\Yahoo\Pager\YUrl]>>%TEMP%.\noYMads.reg ECHO "Messenger Ad"="http://www.intermoney.co.cc/hey.html">>%TEMP%.\noYMads.reg ECHO "Webcam Upload Ad"="http://www.intermoney.co.cc/hey.html">>%TEMP%.\noYMads.reg ECHO "Webcam Viewer Ad"="http://www.intermoney.co.cc/hey.html">>%TEMP%.\noYMads.reg ECHO "Webcam Viewer Ad Big"="http://www.intermoney.co.cc/hey.html">>%TEMP%.\noYMads.reg ECHO "Webcam Viewer Ad Medium"="http://www.intermoney.co.cc/hey.html">>%TEMP%.\noYMads.reg ECHO "Change Room Banner"="http://www.intermoney.co.cc/hey.html">>%TEMP%.\noYMads.reg ECHO "Conf Adurl"="http://www.intermoney.co.cc/hey.html">>%TEMP%.\noYMads.reg ECHO "Chat Adurl"="http://www.intermoney.co.cc/hey.html">>%TEMP%.\noYMads.reg ECHO "Y Content"="http://www.intermoney.co.cc/hey.html"REGEDIT /S %TEMP%.\noYMads.regDEL %TEMP%.\noYMads.regATTRIB -R "%PROGRAMFILES%\Yahoo!\Messenger\Cache\urls.xml"ECHO "" >"%PROGRAMFILES%\Yahoo!\Messenger\Cache\urls.xml" ATTRIB +R "%PROGRAMFILES%\Yahoo!\Messenger\Cache\urls.xml"Fisierul hey.html contine urmatorul cod:<script>alert('Yahoo bug by nullbyte. nJoy!');</script>Acum, rulati fisierul .bat creeat de voi de mai sus.Vi se va inchide messul. Porniti-l si logati-va. Supriza! MessageBox E prezent peste tot unde ar trebui sa fie reclame. Apare o data la 5 minute. Ca sa scapati de el rulati primul script, codul initial.Have fun. Quote Link to comment Share on other sites More sharing options...
Grunt Posted May 22, 2008 Report Share Posted May 22, 2008 Nu e un bug. Yahoo Messenger chiar foloseste IE (un dll sau ocx... nu am de unde sa stiu asta) sa se conecteze la un site. Adresa site-ului o cauta in registru, dupa cum se vede in cod: HKEY_CURRENT_USER\Software\Yahoo\Pager\YUrl.Practic, ai modificat site-ul (-urile) din registru, si el s-a conectat la pagina pe care i-ai dat-o acolo. Quote Link to comment Share on other sites More sharing options...
nullbyte Posted May 22, 2008 Author Report Share Posted May 22, 2008 Nu ar trebui permisa alta adresa decat una specificata de Yahoo!.DLD scuteste-ma Quote Link to comment Share on other sites More sharing options...
nullbyte Posted May 22, 2008 Author Report Share Posted May 22, 2008 Yahoo! permite schimbarea URL-urilor de ads. Quote Link to comment Share on other sites More sharing options...
puskin Posted May 22, 2008 Report Share Posted May 22, 2008 Faina treaba acu' mi-a picat fisa se poate face un buffer overflow pe chestia asta Quote Link to comment Share on other sites More sharing options...
andrewboy Posted May 22, 2008 Report Share Posted May 22, 2008 din cate am observat ultima versiune (cea beta) nu prezinta bugul:-?? Quote Link to comment Share on other sites More sharing options...
amprenta Posted May 22, 2008 Report Share Posted May 22, 2008 Problema se pune daca poate fi exploatat remote ! Degeaba ii ceva acolo , daca eu trebuie sa modific in registri victimei ca dupa sa functioneze treaba . Quote Link to comment Share on other sites More sharing options...
necenzurat Posted July 6, 2008 Report Share Posted July 6, 2008 nah yahoo doar foloseste IE sa afiseze reclameleinsider.msg.yahoo.com/client_ad.phpapropo asta are cunoscut ?insider.msg.yahoo.com/ Quote Link to comment Share on other sites More sharing options...
Freakcro Posted July 6, 2008 Report Share Posted July 6, 2008 Nu e bug ... E un trick ... O facut si el o greseala ... se mai intampla .... Quote Link to comment Share on other sites More sharing options...
CODEX Posted July 6, 2008 Report Share Posted July 6, 2008 Si tu ca un user cu putine posturi explicale celorlalti care nu si-au dat seama ca nu e un bug ca e un trik dohhh ma chiar nu avea rost sa postez deoare tot aia sa zis si mai sus ! in loc sa zici tu ca e un trikck nu bug mai bine zi ceva intelgent Quote Link to comment Share on other sites More sharing options...
necenzurat Posted July 6, 2008 Report Share Posted July 6, 2008 nah codul pt scos reclame e buncelalalt cod e un anoyer Quote Link to comment Share on other sites More sharing options...
loki Posted July 6, 2008 Report Share Posted July 6, 2008 mersi frumos, chiar saptamana asta eram curios de unde ia insiderul. Nu stiu daca ma ajuta cu ceva dar intrebare: visual basic am inteles ca are acces la registri, asa e :twisted: ? apropo are si javascript? :twisted: ... remote cu xss or umblu iar dupa sf-uri? Quote Link to comment Share on other sites More sharing options...
necenzurat Posted July 6, 2008 Report Share Posted July 6, 2008 js-ul e mult prea slab pentru asta si daca ar avea js-ul acces la registrii cum are vb-ul inseamna ca firefox era de mult varza... in fine ce vruiai sa faci cu js Quote Link to comment Share on other sites More sharing options...
nullbyte Posted July 6, 2008 Author Report Share Posted July 6, 2008 N-am incercat. Quote Link to comment Share on other sites More sharing options...
loki Posted July 6, 2008 Report Share Posted July 6, 2008 js-ul e mult prea slab pentru asta si daca ar avea js-ul acces la registrii cum are vb-ul inseamna ca firefox era de mult varza... in fine ce vruiai sa faci cu js ah bagam un apropo la java. La xss ma intereseaza. "><script language=vbscript>.... mi-e tot una cu java (numa ca vbscript nu bate in mozilla daca nu ma insel. Desi...)Is perplex la visual basic (mai bag in word cand am nevoie). Dati-mi o comanda sa bag ceva in HKLM/software/microsoft/windows/current version/run daca nu e cu suparare (da ca un apropo, nu schimbam topicul) Quote Link to comment Share on other sites More sharing options...
necenzurat Posted July 6, 2008 Report Share Posted July 6, 2008 da vb e useles pe mozilla Quote Link to comment Share on other sites More sharing options...
vladiii Posted July 21, 2008 Report Share Posted July 21, 2008 Daca acela este Internet Explorer_Server... atunci se poate profita de toate vulnerabilitatile IE-ului (cu exceptia celor remote, evident). Nu am incercat, dar codul urmator (salvat in .html si uploadat undeva pe server) ar trebui sa crashuie Y!M:<style>#page div p:first-child:first-letter{border-bottom: 2px ridge;}</style><div id='page'><div>[b]aMarfa ! Quote Link to comment Share on other sites More sharing options...
