Changeset 1458

Timestamp:

11/29/07 22:50:11 (9 months ago)

Author:

jose

Message:

support the RealPLayer exploit out there better
- return a version property
- properly stub out the Import() function
- add a CVE ID
we pretent to be an en-us browser

Files:

• phoneyc/trunk/ActiveX.py (modified) (1 diff)
• phoneyc/trunk/honeyclient.py (modified) (1 diff)
• phoneyc/trunk/modules/jscript/RealPlayer.js (modified) (2 diffs)

phoneyc/trunk/ActiveX.py

@@ -35 +35 @@
-        self.clsname['PPlayer.XPPlayer.1'] = PPlayer()
-        self.clsname['IERPCTL.IERPCTL'] = RealPlayer()
+        self.clsname['IERPCTL.IERPCTL.1'] = RealPlayer()
-
-        # set up the pure JScript version

phoneyc/trunk/honeyclient.py

@@ -139 +139 @@
-navigator.appVersion="4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
-navigator.userAgent="Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
+navigator.userLanguage = 'en-us';
-var self = new object();
-var productVersion = '';

phoneyc/trunk/modules/jscript/RealPlayer.js

@@ -1 +1 @@
-// RealMedia RealPlayer Ierpplug.DLL ActiveX Control
-
+CVE-2007-5601
-
-function RealPlayer() {
@@ -12 +12 @@
-                        add_alert('RealPlayer 10.5 ierpplug.dll overflow in PlayerProperty()');
-                }
+                return("6.0.11.1");
-        }
-arg
-
+url, arg1, arg2, arg3
+1
-                        add_alert('RealPlayer 10.5 ierpplug.dll overflow in Import()');
-                }