4 ms·
Executable file infector in JavaScript
- im3w1l 12y agovar objStream = new ActiveXObject("ADODB.Stream"); does this count as pure js?
- josteink 12y agoIf you run internet explorer I guess it does.
- methou 12y agoShouldn't that require user's consent to run "ActiveXObject"s?
- maxerickson 12y agoIn theory. That particular object was, I think, disabled in a fix that went out over Windows update: http://support.microsoft.com/kb/870669 http://support.microsoft.com/kb/870669 But I guess it might be enabled on lots of business desktops where the functionality was in use prior to that.
- TazeTSchnitzel 12y agoYes, it's pure JScript, maybe not JavaScript. Importantly, you can execute such a file merely by double-clicking it on Windows (hooray for the Windows Script Host!). So a .js file is far from harmless. It's equivalent to any other executable on Windows, since 98 onwards.
- pearjuice 12y agoSome clarification would be nice.
- sorokod 12y agoThe page clearly states that:"Думаю, комментарий излишен :)" (I think that a commentary is not needed)
- napoleond 12y agoIt looks like a malware injector implemented in browser JS (but requiring ActiveX, as pointed out in another comment). It shows that in certain systems it is possible to infect executables by having the visitor load this JS in their browser. In other words, a way of escaping the browser sandbox on systems with that "feature" of ActiveX enabled.
- ricardobeat 12y agonew ActiveXObject(...) ActiveX has been disabled by default since IE7. Victims of an attack like this are kind of asking for it (windows + IE + allowing ActiveX).