Cuartango Window
http://pages.whowhere.com/computers/cuartangojc/cuartangow1.html
Affected software
Microsoft Internet Explorer 4
Risks
Your computer is at risk a malicious VBScript can get full control over your system.
The VBScript can de everything : delete files, install viruses, read your files ...
Technical description
When Microsoft Internet Explorer detects that a Visual Basic Script included in an HTML page will
create an object ("CreateObject" sentence) your file system a security alert dialog is displayed :
Nobody with a minimum knowledge about ActiveX and VB Scripts would accept this dialog. If you click
the "yes" button your have given FULL CONTROL of your machine to the VB Script code.
The vulnerability comes from the fact that is possibleto hide this dialog box and get FULL CONTROL
over the victim machine.
The key idea is very simple : just display a window over the security alert hiding the message and
replacing it by another friendly message but keeping visible the buttons of the original message.
I will show you how the malicious script will work :
First we open a friendly window (The Cuartango Window) :
set wcover = window.open ("welcome.htm", "Welcome . . . )
Next instruction will generate the security alert because we are accesing the file system this
prompt will be behind the welcome window !!!
Set fs = CreateObject("Scripting.FileSystemObject")
At this moment instead of the alert shown above what we see is :
If the YES button is clicked the script has FULL CONTROL. The welcome window in no longer needed and
we close it
wcover.close
At this point we are the script owns the machine as an, example I will get the autoexec.bat file
and display it in a text box. But the script could do everything on your machine, delete all your
files, install a virus ...
Set myfile = fs.OpenTextFile("c:\config.sys")
content = myfile.readall
myfile.Close
document.form1.s1.value = content
----------exploit code example----------
Cuartango Window demo
Cuartango Window Demo
This example shows you how ActiveX could destroy your system.
As an example I have read your config.sys file
Back to Cuartango Window Page