full-disclosure - Re: shell:windows

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <40F2A586.2040102@sdf.lonestar.org>
From: bkfsec at sdf.lonestar.org (Barry Fitzgerald)
Subject: Re: shell:windows

Nick Eoannidis wrote:

> Larry Seltzer
> eWEEK.com Security Center Editor --
>
> buddy, the shell:windows URI handler was disabled in IE ages ago!
> The fact it can be crafted into an exploit for Mozilla! is the issue
> here.
> Of course it wont work on your IE your probably patched to the max!
> Mozilla just forgot to disable access to this URI due to the fact
> that mozilla was first built for nix and not windoze.
> All versions of mozilla have been fixed now
>
>
Actually, that's not entirely accurate.

The shell:windows code does work in IE, the only difference being that 
it displays a dialogue box when referenced asking if the user wishes to 
open or save the file.  Combine that with a little social engineering 
and you've got a potential compromise.

Also, when the shell:windows reference is input into IE's address bar 
field, it executes the code without a a dialogue box...

I think that some of you may see where that's going...

             -Barry