Date: Sun, 12 Jun 2011 11:18:38 +1000
From: "-= Glowing Doom =-" <secn3t@...il.com>
To: Christian Sciberras <uuf6429@...il.com>, adam <adam@...sy.net>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: POC for a simple gmail/possible code
 injection into html wich can be executed in an email,
 i will make the PoC code and explain how here and now...

Anyhow, why is that even ALLOWED, defaming people, by the way of a hacker's
website... then calling me a hacker... i should then, be a moderator on that
kind of website eh ?
you know little, but say much. Very foolish operson.
Laters.


On 12 June 2011 11:16, -= Glowing Doom =- <secn3t@...il.com> wrote:

> Oh,
> regarding that ryan1918.com post... that is doctored.
>
> ryan1918, seems to hate me, and, that has reasons behind it..wich go back
> to long ago... sofar,all he had done, is make up crap about me, many times
> now, because he knows that i have papers here, wich show him as an
> infommant.. I guess you must like to visit federal sites.. and, why didnt i
> use this Poc, in those mailbombs..hell, that would have made it a REAL
> fact then.
>
> What happened to, people being normal on a forum... i guess that died in
> 1999.
>
> If you think that post, is actually 'mailbombing' then, you must be as
> stupid as ryan.Troll no.1 and, informant.
>
> Many people can vouch for that website, if it was such a target for me,
> then, why is is not nulled already ?
>
> I guess you just dug up come crap, and must be someone from an IRC channel
> on efnet :)
>
> As jeffrey showed in that link of the troll... it is a perfect example of
> it... and, even that forum backs it up 1005.
> Adam, your a classified-troll. :)
>
> think of the PoC and maybe, try to figure how it is being done.. i have
> tried to explain something, wich is VERY hard to explain without actually
> making a small video, of them 2 Pocs...
> I apologise, next time, i will send you a .mov of 200meg in slowmo, maybe
> then you can figure wth it is doing and why the rich text editor dll, is
> allowing this kinda crap to be added to any email....
>
> Laters...
>
>
>
> On 12 June 2011 11:06, -= Glowing Doom =- <secn3t@...il.com> wrote:
>
>> This is why i was trying to say, it is hard to re make it and explain it ,
>> in the first post.
>> It is now, over 1yr old atleast and exists in riched20.dll.
>> This PoC info is over for me also.
>> I do not think I will be posting anything to this list, ill watch and
>> learnm from those who seem to have the knowledge about this and could help
>> with it... It does exist, and, it is a client side problem, however, it
>> seems to be accepted by gmail... I used gmail, as the PoC mail-to.
>> Sorry for sharing :s sheesh.
>>
>>
>>
>> On 12 June 2011 11:04, Christian Sciberras <uuf6429@...il.com> wrote:
>>
>>> As Adam said, I'll actually read this when it's been properly analysed.
>>> If it actually does exist, eventually someone will explain it more
>>> formally.
>>> Until that time, the discussion ends here for me.
>>>
>>>
>>>
>>>
>>> On Sun, Jun 12, 2011 at 2:59 AM, -= Glowing Doom =- <secn3t@...il.com>wrote:
>>>
>>>> Grow up? Jesus fucking christ you think people here care about some
>>>> half-assed crap you think you just dug up?
>>>>
>>>> Just dug up ?? I doubt it.. more like, new to the list.
>>>>
>>>> And finally, how does Thunderbird, Outlook relate to Gmail?
>>>> Regarding the dll, so it's first a dll-hunt in those 20+ dlls each of
>>>> those programs load up and now it's all about an RTF editing dll?
>>>> Then let's get back to the POC, which happens to be two crappy links,
>>>> which for some reason you'd believe wouldn't normally show up in an
>>>> email....?
>>>>
>>>> Gmail, was the example mailing system i used.. as ive stated the bug is
>>>> a DLL problem.
>>>> have a nice day sir!
>>>>
>>>>
>>>>
>>>> On 12 June 2011 10:56, Christian Sciberras <uuf6429@...il.com> wrote:
>>>>
>>>>> Grow up? Jesus fucking christ you think people here care about some
>>>>> half-assed crap you think you just dug up?
>>>>> We're all busy and you expect some one would go out of his way
>>>>> verifying (or not) what you think you've found?
>>>>>
>>>>> Here's a crazy though, grow up yourself and put your findings in a well
>>>>> written format, English or not.
>>>>> If you can't help your spelling mistakes get a decent browser and stop
>>>>> using lynx for the lulz.
>>>>>
>>>>> And finally, how does Thunderbird, Outlook relate to Gmail?
>>>>> Regarding the dll, so it's first a dll-hunt in those 20+ dlls each of
>>>>> those programs load up and now it's all about an RTF editing dll?
>>>>>
>>>>> Then let's get back to the POC, which happens to be two crappy links,
>>>>> which for some reason you'd believe wouldn't normally show up in an
>>>>> email....?
>>>>>
>>>>>
>>>>> On Sun, Jun 12, 2011 at 2:49 AM, Jeffrey Walton <noloader@...il.com>wrote:
>>>>>
>>>>>> On Sat, Jun 11, 2011 at 8:45 PM, adam <adam@...sy.net> wrote:
>>>>>> > Somehow, I seriously doubt that.
>>>>>> > The point is, broken English or not - this has to be the most
>>>>>> laughable PoC
>>>>>> > I've ever seen. He originally insists that this is a problem related
>>>>>> to (web
>>>>>> > based?) mail providers (which would lead anyone to believe is server
>>>>>> > related) and then turns around and begins referencing external
>>>>>> libraries
>>>>>> > (that he can't even name?).
>>>>>> > Lastly, before diving face first into his ass - you should have
>>>>>> probably
>>>>>> > performed a Google search. I'll give you a hint, he's not located in
>>>>>> some
>>>>>> > third world country.
>>>>>> Too funny.... Location is distinct from native tongue.
>>>>>> http://www.collegehumor.com/video/5817726/internet-bridge-troll
>>>>>>
>>>>>> Jeff
>>>>>>
>>>>>> > On Sat, Jun 11, 2011 at 7:30 PM, Jeffrey Walton <noloader@...il.com>
>>>>>> wrote:
>>>>>> >>
>>>>>> >> On Sat, Jun 11, 2011 at 8:13 PM, adam <adam@...sy.net> wrote:
>>>>>> >> > When the English version becomes available, please let me know.
>>>>>> >> I'd bet secn3t's english is better than your speaking his native
>>>>>> >> tongue....
>>>>>> >>
>>>>>> >> > On Sat, Jun 11, 2011 at 7:02 PM, -= Glowing Doom =- <
>>>>>> secn3t@...il.com>
>>>>>> >> > wrote:
>>>>>> >> >>
>>>>>> >> >> Systems wich appear vulnerable: EVERY single one i have tried...
>>>>>> >> >>
>>>>>> >> >> How:
>>>>>> >> >>
>>>>>> >> >> I wrote that sentecne, then, i backspaced it and blacked it over
>>>>>> with
>>>>>> >> >> copy
>>>>>> >> >> , then, enter url to wherver i want...
>>>>>> >> >> There is 3 ways i have found todo this, when i dissected one of
>>>>>> them,
>>>>>> >> >> the
>>>>>> >> >> URL/Sentence, was gfull of x41\x41\x41 , very strange... because
>>>>>> it is
>>>>>> >> >> still
>>>>>> >> >> able to be done 3 ways, and the simplest way does NOT require
>>>>>> even html
>>>>>> >> >> 'link' to section, wich is what MST be done, altho on older
>>>>>> emailer
>>>>>> >> >> systems,
>>>>>> >> >> I see that it is simple as backspace over the sentence,then type
>>>>>> the
>>>>>> >> >> url, it
>>>>>> >> >> a'appears' at first , to be a normal deleted sentence, but when
>>>>>> I open
>>>>>> >> >> and
>>>>>> >> >> dissect, it shows URL/41/41/41 then all over the email page,
>>>>>> same thing
>>>>>> >> >> ...
>>>>>> >> >> I know this might be confusing,  I traced the problem to a dll
>>>>>> or lib
>>>>>> >> >> wich
>>>>>> >> >> is for text editing , and that dll is a VERY common one on any
>>>>>> system,
>>>>>> >> >> sofar
>>>>>> >> >> not one mailing system, has NOT had this vuln... yet, i have
>>>>>> seen
>>>>>> >> >> another
>>>>>> >> >> 'version' of this attack type, but, they can ONLY spoof a URL...
>>>>>> This
>>>>>> >> >> one,
>>>>>> >> >> you can make the whole email, a url... i will do this right
>>>>>> now..
>>>>>> >> >>
>>>>>> >> >> [SNIP]
>>>>>> >>
>>>>>> >> _______________________________________________
>>>>>> >> Full-Disclosure - We believe in it.
>>>>>> >> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>>>>>> >> Hosted and sponsored by Secunia - http://secunia.com/
>>>>>> >
>>>>>> >
>>>>>>
>>>>>> _______________________________________________
>>>>>> Full-Disclosure - We believe in it.
>>>>>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>>>>>> Hosted and sponsored by Secunia - http://secunia.com/
>>>>>>
>>>>>
>>>>>
>>>>> _______________________________________________
>>>>> Full-Disclosure - We believe in it.
>>>>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>>>>> Hosted and sponsored by Secunia - http://secunia.com/
>>>>>
>>>>
>>>>
>>>
>>
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists