|
Note: This vulnerability as well as several more can be found at http://www.greyhats.cjb.net
HijackClick 3!!!
Took the name from Liu Die Yu :)
[Tested]
IEXPLORE.EXE file version 6.0.2800.1106
MSHTML.DLL file version 6.00.2800.1400
Microsoft Windows XP sp2
[Discussion]
The HijackClick series have been used to force a drag and drop event simply from the user
clicking a something. This is done by moving the window when onmousedown fires. Previously,
window.moveBy/To has been used. This has been patched. Apparently, window.resizeBy/To would work
too because it gives access denied if it tries to execute when onmousedown fires. Microsoft just
disabled those functions from being called when the mouse button is down and called it patched.
No more hijackclick, right?
Wrong.
Popup.show() allows you to show a popup with desired left, top, height, and width values. The
show() function doesnt give access denied when we call it on mousedown. Let's try it with a link
on a popup. I'll make show() move the popup off the screen. Does it work? Yes, it changes the
cursor. Good. A drag event just took place. With a little fine-tuning, we can make it show the
popup on loading of the main window, move the popup and show a favorites list on mousedown, and
set a timer to hide the favorites list and taunt the victim who just got tricked into adding a
link of our choice to their favorites list :).
[Example]
http://freehost07.websamba.com/greyhats/hijackclick3.htm
And when you patch this one, Microsoft, please remember to patch the show() function method
cache part, too. You don't want HijackClick4, do you? ;)
|
