Yahoo! Coder’s Cookbook Messenger Webcam ActiveX Exploit

Yahoo! Messenger Webcam ActiveX Exploit Demostration

On June 6, 2007 eEye (http://research.eeye.com/html/advisories/upcoming/20070605.html) security published a report stating the Yahoo! Messenger was susceptible to a buffer overflow. The next day a Yahoo! spokesperson let it slip that the problem was in the webcam ActiveX control that allows a user to display his webcam on a webpage. Shortly after that exploit code was published on the Full Disclosure mailing list (http://lists.grok.org.uk/pipermail/full-disclosure/2007-June/). There are actually two different components that can be exploited, ywcupl.dll (Webcam Upload) and Ywcvwr.dll (Webcam Download).

What to Expect

Here you can test to see if you are vulnerable to this particular exploit. Be warned that this may cause the following:

Crash of web browser
System becomes unstable
Antivirus screaming bloody murder

If you are vulnerable then your web browser should crash. I have found that it is more likely to happen in IE than Firefox.

Ywcvwr.dll Runs Calc.exe

This was the first proof of concept. It uses a fairly standard payload that starts the Windows calculator.

ywcupl.dll Runs Freecell.exe

The second proof of concept is certainly much more nasty. It will download a program from anywhere on the Internet and then run that program. In my example I download Free.exe and then run it. Free.exe simply opens a new process for the Free Cell Windows game. Free.exe is written in VB.NET so you will have to have the .NET Framework to run it. Certainly you could use your imagination and see that this is the ultimate exploit.

References