Re: RDP, can it be done safely?

[musnt live <musntlive () gmail com>]

Hello Full Disclosure, I'd like to warn you about a bonehead group of
software developers.

One group of boneheads are in complex in state in US is that called in
Redmond. With exploit in hand to be released in future I give you to PoC:

arg1="%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s"

0:004> !exploitable
Exploitability Classification: EXPLOITABLE
Recommended Bug Title: Exploitable - Data Execution Prevention Violation
starting at Unknown Symbol @ (NO MO FREE BUGS UNTIL THE FUTURE) called from
<Unloaded_2.DLL>+0xISAIDNOFREEBUGS
(Hash=0x485afe60.0x4f3dfe60)

0:004> g
(1ea4.1f42): Access violation - code c0000005 (!!! second chance !!!)
eax=NO ebx=FREE ecx=MORE edx=BUGS esi=NO edi=FREE
eip=deadbabe esp=BUGS ebp=MORE iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000206
deadbabe ?? ???


This exploit for sale affects all. I give you worky worky remote shell.
Starting price of $50,000.00

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/