Remote infection of XML documents
by Rajaat
Written in Januark 1900 ;-)
Intro
In the past month or so, I've been translating some Perl snippets I've
written to VBScript, to show some friend how to do some simple XML
parsing. After that he has written a VBScript virus that could be
jumpstarted from an XSL stylesheet (hi to Ruzz!). During writing these
little fragments of code an idea occured to me that VBScripters can
use to let their code be remotely executed by a XML or HTML document
using CSS or XSL. In this article I hope to present some techniques
that will force the AV to have web scanning capabilities into their
browser. Ideally, the VBScript will never leave your homepage, but
documents gets referenced to it.
Prerequisites
In the examples listed in this article you'll need to understand the
relations between XML and XSL, so I recommend you to take a look at
the web pages listed at the bottom of this article before even trying
to understand how it works. Some of the tricks only work with IE5,
since that is the only web browser known to me that currently supports
XSL.
Linking to VBScript from XML using XSL
If you load an XML document into IE5 it will normally be displayed in
tree form, of which the branches can be expanded or collapsed by
clicking at the [-] and [+] (like you would with the normal Windows
explorer working in Tree mode). A typical XML document looks like
this:
A simple appending COM infector, written in Sphinx C-- (written by
Peter Cellik).
A mcb tsr semi-stealth polymorphic fast-infecting appending COM & EXE
infector, of which the largest part is written in Borland C++ 3.1 (not
in Pascal, like Eugene Kaspersky assumes).
A standard bootsector virus with read/write stealth.
If you would cut and paste the above piece in a file using .XML for
extension and you would look at with with IE5 you will see the
aforementioned tree structure.
Now you can imagine XML would be a very nice way to store articles etc
for displaying on the World Wide Web, if it only could present itself
in a more readable way. The answer to this is XSL, a method to
transform XML documents. XSL stylesheets are normally not part of a
XML document, but are referred from it. With XSL you could choose to
write a HTML in which the first column shows the virus writers
handle, and the second contains a list of names of viruses he has
written (which you can click to take you to the AVP website for more
info). In fact, big companies use this technique is to format all
kinds of information. An XSL stylesheet may reside anywhere on the
internet, as long as the user that views the XML document that refers
to the XSL stylesheet can access it (must be online) it will be used.
This is where you come in play. What would happen if an XML document
refers to a XSL stylesheet that is on your homepage and - besides the
standard formatting HTML and XSL tags - also holds a piece of VBScript
code that will add a reference to itself to other XML documents that
can be found? The XML documents appear to be clean, as there is no
viral code included, but loaded from a browser it will get started.
Let's add such a reference to the example shown above. Insert the next
line right below the :
Now we must create a stylesheet in the same directory as we created
the XML document. In the example I will call this one vinfo.xsl.
A dull example
Virus Writer info
(mouseover this heading activates VBScript)
Now when you load the XML file into IE5, it will automagically use the
XSL stylesheet to format the data into a nice table. If you move with
the mouse over the heading tag, the VBScript gets executed and will
display a lame text.
Another nice touch is that people cannot simply look up the VBScript
code by right clicking on the page from within IE5, it disallows the
page to be viewed in source form if it is processed by a XSL
stylesheet.
Now try adding some of your own stuff in it, like running Outlook (but
where must it get the source from to mail it? You need to get it from
the web yourself) or using the FileSystem object to "infect" other XML
document by adding a reference to a XSL stylesheet that is on your
homepage. Be inventive, I am sure the AV will appreciate it :-)
Rajaat