Full Disclosure mailing list archives
Re: another filename bypass vulnerability - fromcmd.exe
From: barabas mutsonline <barbsie () gmail com>
Date: Fri, 18 Nov 2005 13:04:09 +0100
#MW> I think the OP was getting at this being an AV bypass vector for worms and #MW> other malware that can interact with cmd.exe . #TZ>Hmm ok, but how can it interact when it doesn't execute using explorer.exe ? Is #the user going under Dos to execute it? How does that fit in the #scenario ? Let's imagine there's an IE bug (quite hard to imagine, but ok) that allows cross-zone scripting....An attacker renames his evil payload adrianalima.gifinstead of blah.exe and puts it on his page. When the victim loads the page, the adrianalima.gif will end up in the temporary internet files...No download warning will be given cuz its a gif (css etc... will also prolly work). A script in the html (cuz its crosszone) can then search the temporary IE folders (using indexing service e.g.) for adrianlima.gif and execute it using wsscript shell object run cmd /c adrianalima.gif (in vbs e.g.) just a thought, haven't tested it nor have I written l33t PoC :p
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: another filename bypass vulnerability - fromcmd.exe barabas mutsonline (Nov 18)
- Re: Re: another filename bypass vulnerability - fromcmd.exe Thierry Zoller (Nov 18)