|
|
|
|
| |
Credit:
The information has been provided by ned.
To keep updated with the tool visit the project's homepage at: http://felinemenace.org/~nd/htmler.py and http://freshmeat.net/projects/mangleme/
|
| |
HTMLer is a Python port of the original mangleme (an automated broken HTML generator to test browsers) with added quirks such as MIME types (file extensions) and URL types.
HTMLer is a command line driven application, unlike the original mangleme. It will create a plethora of broken HTML pages in a subdirectory under the directory in which it is run from. The files are linked in the sense that opening one in a browser will cause the browser to open the next one automatically using HTML refresh.
One test scenario found by Berend-Jan Wever is an exploitable buffer overflow in Internet Explorer when parsing an IFRAME tag in a broken HTML file named 2446.html. A small excerpt follows:
<IFRAME SRC=AAAAAAAAAAAA.... NAME="BBBBBBBBBBB....">
It allows the crafter of the HTML to control EAX, afterwhich the following code gets executed:
7178EC02 8B08 MOV ECX, DWORD PTR [EAX]
7178EC04 68847B7071 PUSH SHDOCVW.71707B84
7178EC09 50 PUSH EAX
7178EC0A FF11 CALL NEAR DWORD PTR [ECX]
Control over EAX leads to control over ECX which you can use to control EIP, hence paving the way to remote command execution.
The tool's source can be downloaded from the author's site and is pasted here for convenience.
Source Code
# jumped in a river what did i see?
# black-eyed angels swimming with me
# SHAMELESS PORT OF LCAMTUF'S MANGELME
# nd@felinemenace.org - (c) 1984
# with a few extra hacks, finds elusive IE bugs ;)
import random
types = []
data = {}
data["A"] = ["NAME", "HREF", "REF", "REV", "TITLE", "TARGET", "SHAPE", "onLoad", "STYLE"]
data["APPLET"] = ["CODEBASE", "CODE", "NAME", "ALIGN", "ALT", "HEIGHT", "WIDTH", "HSPACE", "VSPACE", "DOWNLOAD", "HEIGHT", "NAME", "TITLE", "onLoad", "STYLE"]
data["AREA"] = ["SHAPE", "ALT", "CO-ORDS", "HREF", "onLoad", "STYLE"]
data["B"] = ["onLoad", "STYLE"]
data["BANNER"] = ["onLoad", "STYLE"]
data["BASE"] = ["HREF", "TARGET", "onLoad", "STYLE"]
data["BASEFONT"] = ["SIZE", "onLoad", "STYLE"]
data["BGSOUND"] = ["SRC", "LOOP", "onLoad", "STYLE"]
data["BQ"] = ["CLEAR", "NOWRAP", "onLoad", "STYLE"]
data["BODY"] = ["BACKGROUND", "BGCOLOR", "TEXT", "LINK", "ALINK", "VLINK", "LEFTMARGIN", "TOPMARGIN", "BGPROPERTIES", "onLoad", "STYLE"]
data["CAPTION"] = ["ALIGN", "VALIGN", "onLoad", "STYLE"]
data["CENTER"] = ["onLoad", "STYLE"]
data["COL"] = ["ALIGN", "SPAN", "onLoad", "STYLE"]
data["COLGROUP"] = ["ALIGN", "VALIGN", "HALIGN", "WIDTH", "SPAN", "onLoad", "STYLE"]
data["DIV"] = ["ALIGN", "CLASS", "LANG", "onLoad", "STYLE"]
data["EMBED"] = ["SRC", "HEIGHT", "WIDTH", "UNITS", "NAME", "PALETTE", "onLoad", "STYLE"]
data["FIG"] = ["SRC", "ALIGN", "HEIGHT", "WIDTH", "UNITS", "IMAGEMAP", "onLoad", "STYLE"]
data["FN"] = ["ID", "onLoad", "STYLE"]
data["FONT"] = ["SIZE", "COLOR", "FACE", "onLoad", "STYLE"]
data["FORM"] = ["ACTION", "METHOD", "ENCTYPE", "TARGET", "SCRIPT", "onLoad", "STYLE"]
data["FRAME"] = ["SRC", "NAME", "MARGINWIDTH", "MARGINHEIGHT", "SCROLLING", "FRAMESPACING", "onLoad", "STYLE"]
data["FRAMESET"] = ["ROWS", "COLS", "onLoad", "STYLE"]
data["H1"] = ["SRC", "DINGBAT", "onLoad", "STYLE"]
data["HEAD"] = ["onLoad", "STYLE"]
data["HR"] = ["SRC", "SIZE", "WIDTH", "ALIGN", "COLOR", "onLoad", "STYLE"]
data["HTML"] = ["onLoad", "STYLE"]
data["IFRAME"] = ["ALIGN", "FRAMEBORDER", "HEIGHT", "MARGINHEIGHT", "MARGINWIDTH", "NAME", "SCROLLING", "SRC", "ADDRESS", "WIDTH", "onLoad", "STYLE"]
data["IMG"] = ["ALIGN", "ALT", "SRC", "BORDER", "DYNSRC", "HEIGHT", "HSPACE", "ISMAP", "LOOP", "LOWSRC", "START", "UNITS", "USEMAP", "WIDTH", "VSPACE", "onLoad", "STYLE"]
data["INPUT"] = ["TYPE", "NAME", "VALUE", "onLoad", "STYLE"]
data["ISINDEX"] = ["HREF", "PROMPT", "onLoad", "STYLE"]
data["LI"] = ["SRC", "DINGBAT", "SKIP", "TYPE", "VALUE", "onLoad", "STYLE"]
data["LINK"] = ["REL", "REV", "HREF", "TITLE", "onLoad", "STYLE"]
data["MAP"] = ["NAME", "onLoad", "STYLE"]
data["MARQUEE"] = ["ALIGN", "BEHAVIOR", "BGCOLOR", "DIRECTION", "HEIGHT", "HSPACE", "LOOP", "SCROLLAMOUNT", "SCROLLDELAY", "WIDTH", "VSPACE", "onLoad", "STYLE"]
data["MENU"] = ["onLoad", "STYLE"]
data["META"] = ["HTTP-EQUIV", "CONTENT", "NAME", "onLoad", "STYLE"]
data["MULTICOL"] = ["COLS", "GUTTER", "WIDTH", "onLoad", "STYLE"]
data["NOFRAMES"] = ["onLoad", "STYLE"]
data["NOTE"] = ["CLASS", "SRC", "onLoad", "STYLE"]
data["OVERLAY"] = ["SRC", "X", "Y", "HEIGHT", "WIDTH", "UNITS", "IMAGEMAP", "onLoad", "STYLE"]
data["PARAM"] = ["NAME", "VALUE", "onLoad", "STYLE"]
data["RANGE"] = ["FROM", "UNTIL", "onLoad", "STYLE"]
data["SCRIPT"] = ["LANGUAGE", "onLoad", "STYLE"]
data["SELECT"] = ["NAME", "SIZE", "MULTIPLE", "WIDTH", "HEIGHT", "UNITS", "onLoad", "STYLE"]
data["OPTION"] = ["VALUE", "SHAPE", "onLoad", "STYLE"]
data["SPACER"] = ["TYPE", "SIZE", "WIDTH", "HEIGHT", "ALIGN", "onLoad", "STYLE"]
data["SPOT"] = ["ID", "onLoad", "STYLE"]
data["TAB"] = ["INDENT", "TO", "ALIGN", "DP", "onLoad", "STYLE"]
data["TABLE"] = ["ALIGN", "WIDTH", "BORDER", "CELLPADDING", "CELLSPACING", "BGCOLOR", "VALIGN", "COLSPEC", "UNITS", "DP", "onLoad", "STYLE"]
data["TBODY"] = ["CLASS", "ID", "onLoad", "STYLE"]
data["TD"] = ["COLSPAN", "ROWSPAN", "ALIGN", "VALIGN", "BGCOLOR", "onLoad", "STYLE"]
data["TEXTAREA"] = ["NAME", "COLS", "ROWS", "onLoad", "STYLE"]
data["TEXTFLOW"] = ["CLASS", "ID", "onLoad", "STYLE"]
data["TFOOT"] = ["COLSPAN", "ROWSPAN", "ALIGN", "VALIGN", "BGCOLOR", "onLoad", "STYLE"]
data["TH"] = ["ALIGN", "CLASS", "ID", "onLoad", "STYLE"]
data["TITLE"] = ["onLoad", "STYLE"]
data["TR"] = ["ALIGN", "VALIGN", "BGCOLOR", "CLASS", "onLoad", "STYLE"]
data["UL"] = ["SRC", "DINGBAT", "WRAP", "TYPE", "PLAIN", "onLoad", "STYLE"]
for x in data.keys():
types.append(x)
ext = [".jar",".class",".jpg",".htm",".css",".gif",".png",".eml",".mpg",".wav",".mp3",".swf"]
pre = ["http:","https:","url:","about:","file:","mk:"]
other = ["&","=",":","?","\"","\n","%n%n%n%n%n%n%n%n%n%n%n%n","\\"]
ints = ["0","-1","127","7897","89000","808080","90928345","74326794236234","0xfffffff","ffff"]
class htmler:
maxparams = 20
maxtypes = 20
def __init__(self):
pass
def randnum(self,finish,start=0):
return random.randint(start,finish)
def randstring(self):
char = chr(self.randnum(255))
length = self.randnum(300)
thestring = char * length
what = self.randnum(1)
if what == 0:
which = self.randnum(len(ext) - 1)
thestring += ext[which]
elif what == 1:
which = self.randnum(len(pre) - 1)
thestring = pre[which] + thestring
else:
return
return thestring
def makestring(self):
what = self.randnum(2)
if what == 0:
return self.randstring()
elif what == 1:
return ints[self.randnum(len(ints) - 1)]
elif what == 2:
return other[self.randnum(len(other) - 1)]
def loop(self):
string = ""
i = self.randnum(len(types) - 1)
t = types[i]
arr = data[t]
string += "<%s " % types[i]
z = 0
for z in range(0,self.maxparams):
badparam = arr[self.randnum(len(arr) - 1)]
badstring = self.makestring()
string += "%s=%s " % (badparam,badstring)
string += ">\n"
return string
def main(self):
page = ""
for k in range(0,self.maxtypes):
page += self.loop()
return page
if __name__ == '__main__':
h = htmler()
count = 0
while 1:
shiz = "<HEAD>\n<META HTTP-EQUIV=\"Refresh\" content=\"0;URL=%d.html\">\n" % (count + 1)
hehe = h.main()
shiz += hehe
print "count -> %d" % count
file = open("html1/%d.html" % count,"w")
file.write(shiz)
file.close()
count += 1
|
|
|
|
|
|
|
