Content-Type: TEXT/PLAIN; CHARSET=us-ascii Content-ID: http://www.cybersnot.com/iebug.html Aleph One / aleph1@dfw.net http://underground.org/ KeyID 1024/948FD6B5 Fingerprint EE C9 E8 AA CB AF 09 61 8C 39 EA 47 A8 6A B8 01 Content-Type: TEXT/HTML; CHARSET=us-ascii; NAME="iebug.html" Content-ID: Content-Description: Internet Explorer Bug
Cybersnot Industries
Internet Explorer Bug


Internet Explorer Bug 2/27/97 (Version 3.0 (4.70.1155))
Microsoft Internet Explorer v3.01 (and earlier?) has a serious bug which allows web page writers to use ".LNK" and ".URL" files to run programs on a remote computer. This bug is particularly damaging because it uses NO ActiveX, and works even when Internet Explorer is set to its highest security level. It was tested on Microsoft Internet Explorer Version 3.0 (4.70.1155) running Windows 95. This demo assumes that Windows is installed in "C:\WINDOWS". Windows 95 DOES NOT PROMPT BEFORE EXECUTING THESE FILES.

.URL files are WORSE than .LNK files because .URLs work in both Windows 95 and Windows NT 4.0 (.LNK's only work in Windows 95). .URL files present a possibly greater danger because they can be easily created by server side scripts to meet the specific settings of a user's system. We will provide .URL files for execution in the next day or so.

The "shortcuts" can be set to be minimized during execution which means that users may not even be aware that a program has been started. Microsoft's implementation of shortcuts becomes a serious concern if a webpage can tell Internet Explorer to refresh to an executable. Or worse, client side scripts (Java, JavaScript, or VBScript) can use the Explorer object to transfer a BATCH file to the target machine and then META REFRESH to that BATCH file to execute the rogue command in that file.

The following table outlines which areas and users each shortcut type effects:

File Type Windows 95 Windows NT Execute Apps Command Line Args Allowed Searches Path
.LNK Yes No Yes Yes No
.URL Yes Yes Yes No Yes
Security Comparision .URL vs .LNK

Naturally, the files must exist on the remote machine to be properly executed. But, Windows 95 comes with a variety of potentially damaging programs which can easily be executed. The following link will start the standard calculator which comes with Windows 95.

Windows Calculator (.lnk).
Windows Calculator (.url).

This bug can be used to wreak havoc on a remote user's machine. The following links will create and delete some directories.

Create a directory "C:\HAHAHA".
Open "C:\HAHAHA"
Remove the directory "C:\HAHAHA"

The META REFRESH tag can be used to execute multiple commands in sequence.


Internet Explorer Bug
Discovered By Paul Greene
Page and Examples by Geoffrey Elliott & Brian Morin