Full Disclosure mailing list archives
Re: another filename bypass vulnerability - from cmd.exe
From: Hernán M. Racciatti <hracciatti () gmail com>
Date: Thu, 17 Nov 2005 16:47:28 -0300
On 11/16/05, Aditya Deshmukh <aditya.deshmukh () online gateway strangled net> wrote:
Was doing some testing [xfocus-AD-051115] The system is windows 2000 sp4 srp5 with all other patches upto date. At the command prompt cmd.exe execute the following with the results. E:\TEMP>cd test E:\TEMP\test>copy %windir%\system32\calc.exe 1 file(s) copied. E:\TEMP\test>ren calc.exe calc.exe.zip E:\TEMP\test>dir /b calc.exe.zip E:\TEMP\test>calc.exe.zip E:\TEMP\test> ------------------------------------------------------------------- This bring up the calc.exe on the screen.
Hi guys, check this... Windows XP SP 2 D:\test>copy %windir%\system32\calc.exe 1 file(s) copied. D:\test>ren calc.exe anything.calc.exe.zip D:\test>anything.calc.exe.zip D:\test> ------------------------------------------------------------------- This bring up the calc.exe on the screen too ------------------------------------------------------------------- D:\test>ren anything.calc.exe.zip anything.old D:\test>ren anything.old ------------------------------------------------------------------- bring up again, Bye. -- Hernán Marcelo Racciatti Core Team Member ISECOM (Institute for Security and Open Methodologies) Coordinator OISSG, Argentina (Open Information System Security Group) [mailto:hracciatti () gmail com] [http://www.hernanracciatti.com.ar] _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- another filename bypass vulnerability - from cmd.exe Aditya Deshmukh (Nov 16)
- Re: another filename bypass vulnerability - from cmd.exe 6ackpace (Nov 16)
- Re: another filename bypass vulnerability - from cmd.exe Hernán M . Racciatti (Nov 17)