bugtraq - Exploitation of Windows WMF on the web

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 27 Dec 2005 15:46:03 -0800
From: Daniel Bonekeeper <thehazard@...il.com>
To: bugtraq@...urityfocus.com
Subject: Exploitation of Windows WMF on the web

*** PAY ATENTION BEFORE CLICK ON ANY LINK ON THAT MESSAGE ***

I don't know if this thing is already known, but I just got this when
I was "navigating" on a certain website. It was a sucession of hidden
<frames> from diferent domains, ending on:

http://69.50.183.34/m.html

It will then call another frame, targeting to:

http://69.50.183.34/xpl.wmf

Which is the exploit itself. This WMF will download the file cj.exe on
the same server (http://69.50.183.34/cj.exe) and run. It worked with
me, and probably will work with a lot of people (hey, I just checked
the windows update site for updates, and seems that I'm fully
patched... even though, the exploit was triggered on me).
After exploitation, cj.exe will try to install some browser helper
objects (probably a spyware or something like that)

Just checked on www.virustotal.com and it seems that both files are
quite unknown.

--
# (perl -e "while (1) { print "\x90"; }") | dd of=/dev/evil