Playing with IE11 ActiveX 0days

29 Pages·2017·1.56 MB·English

Playing with IE11 ActiveX 0days
About Me
• James Lee
• Math geek
• Passionate about Security vulnerability research
Agenda

• The ways to render HTML in Internet Explorer 11
• IE11 Information disclosure and Content spoofing
• HTML Help viewer
• Local file detection and Top frame issue
The ways to render HTML in IE11

• IFRAME, OBJECT and even an EMBED tag.
• implementation.createDocument,
implementation.createHTMLDocument and XMLHttpRequest
• ActiveXObject
The ways to render HTML in IE11

• implementation.createDocument,
implementation.createHTMLDocument and XMLHttpRequest
return a document object instead of text/xml
• These documents have their limitations, they miss methods like
window.open and more
• ActiveXObject has limitations also, but it's capable of running
scripts.
The ways to render HTML in IE11

• You can logically render invisible scripts by instantiating an
htmlFile with ActiveXObject.
• test = new ActiveXObject("htmlFile");
• This ActiveXObject returns a reference to its document object.
IE11 Information disclosure and Content spoofing
• Local file detection issue
• 16 == RT_VERSION (Source: https://msdn.microsoft.com/en-
us/library/windows/desktop/ms648009(v=vs.85).aspx )
• 16”\\”e0 == 16e0 == 16*e^0 == 16
IE11 Information disclosure and Content spoofing
• Create a htmlFile from an IFRAME
• Destroy the contents of the IFRAME, while keeping wut1 alive,
(because we have a reference to it outside the IFRAME itself)
IE11 Information disclosure and Content spoofing
• Create a new htmlFile inside the previous one
• Create another htmlFile from an IFRAME
• Done, its window.open method can't be seen
• Now we can throw Pop-ups with no restrictions while the user is navigating
on any site
IE11 Information disclosure and Content spoofing