Vulnerability Development mailing list archives
RE: Win32hlp exploit for : ":LINK overflow"
From: "Rob Shein" <shoten () starpower net>
Date: Tue, 11 Mar 2003 08:59:14 -0500
I'm not entirely sure I get how serious this is. If I understand correctly, you're modifying a .cnt file so that when it's called (by using it's corresponding .hlp file) it will go out and download/execute a program from a predetermined site. When you're at the stage where you can modify files on the target machine, how much of a difference does it make to be able to get a .cnt file to do your bidding, as opposed to any executable that could have another executable bound to it, for example? Perhaps I'm missing something...
-----Original Message----- From: descript [mailto:descript () sv98 s0h cc] Sent: Saturday, March 08, 2003 7:38 PM To: vuln-dev () securityfocus com; bugtraq () securityfocus com Subject: Win32hlp exploit for : ":LINK overflow" hi list, In date Sunday, 9 March, 2003 1:00 AM s0h released an exploit : Win32hlp exploit for : ":LINK overflow" Source : http://s0h.cc/exploit/s0h_Win32hlp.c Binary : http://s0h.cc/exploit/s0h_Win32hlp.exe Discovered by ThreaT <threat () s0h cc>. Coded by ThreaT <threat () s0h cc> Hompage : http://s0h.cc/~threat/ This exploit can trap a .CNT file (file with .HLP files) with the arbitrary code who can download and execute a trojan without user ask. This exploit was tested on : - Windows 2000 PRO/SERVER (fr) SP0 - Windows 2000 PRO/SERVER (fr) SP1 - Windows 2000 PRO/SERVER (fr) SP2 Best regards, descript <descript () s0h cc> s0h - Skin of humanity http://s0h.cc
Current thread:
- Win32hlp exploit for : ":LINK overflow" descript (Mar 10)
- RE: Win32hlp exploit for : ":LINK overflow" Rob Shein (Mar 11)
- RE: Win32hlp exploit for : ":LINK overflow" Josh Gilmour (Mar 13)
- RE: Win32hlp exploit for : ":LINK overflow" Rob Shein (Mar 13)
- RE: Win32hlp exploit for : ":LINK overflow" Rob Shein (Mar 13)
- RE: Win32hlp exploit for : ":LINK overflow" Josh Gilmour (Mar 13)
- RE: Win32hlp exploit for : ":LINK overflow" Josh Gilmour (Mar 13)
- RE: Win32hlp exploit for : ":LINK overflow" Rob Shein (Mar 11)