Re: New REmote Windows Exploit (MS04-029)

[Michael Riedel <mike () yakastonia com>]

Ok so I was dumb enough to run it.  Anyone else catch what commands they 
run/ know of a way to track.  I really don't feel like re-compiling gentoo.

-mike

Vincent Archer wrote:

> On Thu, Nov 04, 2004 at 02:32:33PM +0100, Ferdinand Klinzer wrote:
>  
>
> > It´s a simple perl script...
> >
> > and i don´t think you can call it an remote exploit?
> >    
>
> It's more subtle than you think.
>
> The "exploit" is supposed to try to open a cmd tool on 31337 (eleet) on
> a target Windows. It fails; the window system is secure... but meanwhile,
> there's a perl IRC bot running in the background of *your* system.
>
> It's not a remote exploit, it's a trojan targeting the readers of this
> list.
>
>  

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html