Full Disclosure mailing list archives
Re: WMF Exploit
From: H D Moore <fdlist () digitaloffense net>
Date: Wed, 4 Jan 2006 17:52:38 -0600
From my experience on XP/2003, IE will only render WMF files as images if the "placeable" header has been added before the WMF header. The addition of the "placeable" header prevents the SetAbortProc from being reached in the Escape() function, due to a check on the device context (credits to mr. anonymous for that gem, I spent an hour beating my head on it). I will try to publish an "exploit faq" later tonight, seems to be way too much confusion about this flaw... -HD On Wednesday 04 January 2006 17:27, Crist J. Clark wrote:
IE 6 displayed WMF files on a test Win98 system just fine for me. Remember, just because when you double-click on a WMF file Windows Explorer doesn't know what to do with it does NOT mean that when presented to IE in an <img> tag, it won't. Even trying to open the file with IE doesn't mean anything. You need to try it in a webpage.
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- WMF Exploit Colin Copley (Jan 03)
- Re: WMF Exploit Technica Forensis (Jan 04)
- Re: WMF Exploit ad () heapoverflow com (Jan 04)
- <Possible follow-ups>
- RE: WMF Exploit Todd Towles (Jan 04)
- Re: WMF Exploit Georgi Guninski (Jan 04)
- Re: WMF Exploit Crist J. Clark (Jan 04)
- Re: WMF Exploit H D Moore (Jan 04)
- RE: WMF Exploit Todd Towles (Jan 04)
- Re: WMF Exploit wac (Jan 11)
- RE: WMF Exploit Lauro, John (Jan 05)
- Re: WMF Exploit Georgi Guninski (Jan 04)
- Re: WMF Exploit Technica Forensis (Jan 04)