On Wednesday 15 August 2007 18:27, v9@xxxxxxxxxxx wrote:
> I may be rusty with knowledge about mirc (say almost 10 years out of
> date)...but, in what situation would the pipe ('|') ever be processed from
> a variable, even if it was read from a mp3 ID3?
It gets processed before it ends up in an mirc variable. The plugin to link
your media player to mirc sends something like:
"/set %songname <insert song name here>"
And it's when executing that command that it goes wrong already, not in the
command that's using the variable. That's why it's easier to exploit: the
user only needs to play the song, he doesn't need to do anything in mirc.
In my old notes, I found that at least these plugins have this problem:
* Nullsoft mIRC Control Plug-in v0.6 (gen_mirc.dll) and other versions
* mIRC Control EX Plug-In V 2.00 (gen_ircex.dll) and other versions
* mIRCPlug v1.0,1.2 (gen_mircplug.dll)
Those are all old plugins. I don't know if they're still used a lot, or what
the currently popular plugins for this are, and if they're vulnerable or not.
On Wednesday 15 August 2007 19:34, Michael Tharp wrote:
> This is probably a bigger concern for *nix scripts, especially of the
> homebrew variety
I haven't found any public script for a *nix client that allows arbitrary
command execution like this (they only allow sending IRC commands to the
server).
Wouter.
