Metasploit mailing list archives

how to identify the pattern

From: suman.saini at ariosesoftware.com (Suman Saini)
Date: Thu, 13 Sep 2007 16:15:08 +0530

Hi all.. :)

I tried to test "ms06_001_wmf_setabortproc"  exploit and it was successfully tested, thanks for help. Now i m tryin to 
write a siganture for the detection of this attack but i m not able to identity the pattern as the wmf is gzipped. 

looking forward to some help :)

Thanks
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.metasploit.com/pipermail/framework/attachments/20070913/08ca57cd/attachment.htm>

Current thread:

Defcon Video, (continued)
- - Defcon Video marc_pascual at support.trendmicro.com (Sep 12)
    - Defcon Video Suman Saini (Sep 12)
    - Defcon Video Patrick Webster (Sep 12)
    - Defcon Video Suman Saini (Sep 12)
    - Defcon Video H D Moore (Sep 12)
- Defcon Video kellicot at umich.edu (Sep 12)
  - Defcon Video H D Moore (Sep 12)
    - Defcon Video kellicot at umich.edu (Sep 14)
    - Defcon Video Giorgio Casali (Sep 18)
- Defcon Video Hamid . K (Sep 12)
  - how to identify the pattern Suman Saini (Sep 13)
    - how to identify the pattern Rhys Kidd (Sep 13)
    - how to identify the pattern Suman Saini (Sep 13)