bugtraq - RE: Win32hlp exploit for : ":LINK overflow"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <001001c2e7d6$66b21680$3200000a@roguenet.home>
Date: Tue, 11 Mar 2003 08:59:14 -0500
From: "Rob Shein" <shoten@...rpower.net>
To: "'descript'" <descript@...8.s0h.cc>,
	<vuln-dev@...urityfocus.com>, <bugtraq@...urityfocus.com>
Subject: RE: Win32hlp exploit for : ":LINK overflow"


I'm not entirely sure I get how serious this is.  If I understand correctly,
you're modifying a .cnt file so that when it's called (by using it's
corresponding .hlp file) it will go out and download/execute a program from
a predetermined site.  When you're at the stage where you can modify files
on the target machine, how much of a difference does it make to be able to
get a .cnt file to do your bidding, as opposed to any executable that could
have another executable bound to it, for example?  Perhaps I'm missing
something...

> -----Original Message-----
> From: descript [mailto:descript@...8.s0h.cc] 
> Sent: Saturday, March 08, 2003 7:38 PM
> To: vuln-dev@...urityfocus.com; bugtraq@...urityfocus.com
> Subject: Win32hlp exploit for : ":LINK overflow"
> 
> 
> hi list,
> 
> In date Sunday, 9 March, 2003 1:00 AM s0h released an exploit 
> : Win32hlp exploit for : ":LINK overflow"
> 
> Source : http://s0h.cc/exploit/s0h_Win32hlp.c
> Binary : http://s0h.cc/exploit/s0h_Win32hlp.exe
> 
> Discovered by ThreaT <threat@....cc>.
> Coded by ThreaT <threat@....cc>
> Hompage : http://s0h.cc/~threat/
> 
> This exploit can trap a .CNT file (file with .HLP files) with 
> the arbitrary code who can download and execute a trojan 
> without user ask.
> 
> This exploit was tested on :
> 	- Windows 2000 PRO/SERVER (fr) SP0
> 	- Windows 2000 PRO/SERVER (fr) SP1
> 	- Windows 2000 PRO/SERVER (fr) SP2
> 
> 
> Best regards,
> descript <descript@....cc>
> s0h - Skin of humanity
> http://s0h.cc
>