냐컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� +-+-+-+-+-+-+-+-+ 栢栢栢栢昉께께굇굇굅같�|O|u|t|b|r|e|a|k|臍같굇굇굉께께栢栢栢� +-+-+-+-+-+-+-+-+ Issue #4 - Page 11 of 12 냐컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� It Doesn't Do What It Says On The Tin! ====================================== #include "the usual disclaimers.h" /* (please e-mail the author for a copy of the disclaimers) */ Someone kindly discovered a little loop hole that allows you to run .exe files from within an HTML page. With all the latest patches at the time of writing this article, Internet Explorer is now limited to only having this flaw when the HTML file is opened from the local hard drive. Here's a small example (note that the formatting here is specially done so that Norton Antivirus doesn't delete this article like it was doing on one of my previous ones). Copy and paste the following into an HTML page and open it in Internet Explorer. It should start the Calculator if you're using Windows NT, 2000 or XP. The first issue we have with this is that we have to hard code the entire path to the .exe file. So on Windows 95/98/Me the above would fail. But with a slight modification we can make it work on all version of Windows. Like this... What I've done is make it try both directories, and the correct one will run, and the other won't. The second issue is that this is pretty boring. You can't pass command line parameters to the program you're trying to run using this technique. So anything that you run will probably not do anything harmful, or will at least prompt the user first. The most damage you could do is fill up memory and desktop space with an annoying high amount of applications, and may cause the computer to crash from the overload. If you're trying to give someone a trojan (trojan debates are banned!), they will spot your .exe file a mile away. So, the third issue you'll encounter is trying to send someone your HTML file with an .exe file without them getting a slight bit suspicious. So, I played around a bit more and came up with a new trick that allowed me to run the .exe file no matter what its file name was! Soon I will explain how. Firstly, copy your calc.exe file to a file named example.jpg and put it into a folder of its own, eg. C:\workbench. Create an HTML file in the same folder called example.html which contains the following HTML code: Now, when you open the HTML file it currently FAILS to run the "example.jpg" file (which is really calc.exe with a different name, remember?). So I discovered that if you add a URL-type parameter "?.exe" to the file path then the browser thinks we're dealing with an .exe (lazy coders), but when the URL is actually parsed again for running the file, only the file name up to before the question mark is used. The remaining characters are discarded as they are assumed to be parameters as per correct URL formatting. The following will now work: This little coding oversight allows us to name the file whatever we like. I chose to use a JPEG file because you'd typically expect it to contain a whole lot of binary data - similar to what an .exe file might look like to the untrained eye - and that an HTML file will probably be accompanied by a JPEG or two. Most users will go to open the HTML file first to get the full effect before ever trying to open individual JPEGs. Besides, if they try to view the JPEG they will just get invalid file format errors, so they may be none the wiser about what it really is. The fourth issue you'll encounter is how do you get someone to open the HTML file locally? Simple. Zip up the two files. When they receive the zip file they have to extract the contents to the local hard drive before viewing them. The fifth issue you'll encounter now is guessing the directory they're going to unzip the files to. This is because we have to specify a complete path to the ".exe" file. So take what we did before and create objects that point to any kinds of folders you think a user might use on various operating systems. Here are a few examples to give you the idea: Note that we give the object a new name each time. We don't want any unexpected errors to stop us of course. Remember to keep the spacing around the equals signs ("=") because Norton Antivirus will stop you dead in your tracks if you don't. This was just a fun experiment. Don't use it to create havoc! That's naughty and bad and wastes system administrators' time and companies' money. However, you can use this against Osamu Bin Laden if you see him online. Well, that's all from me for now. I look forward to the next time. - Timeless 2002-04-18 PS. Greetz to all at #hackerzlair and #outbreakzine on DalNet, and to all my friends (you already know who you are). PPS. How to view an HTML file from now on... um, lol, DON'T! It doesn't really leave you with a warm fuzzy feeling does it?