lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 26 Oct 2010 19:04:27 +0200
From: Jann Horn <jannhorn@...glemail.com>
To: "Thor (Hammer of God)" <thor@...merofgod.com>
Cc: "TBorland1@...il.com" <TBorland1@...il.com>,
	Full-Disclosure mailing list <full-disclosure@...ts.grok.org.uk>,
	"bugtraq@...urityfocus.com" <bugtraq@...urityfocus.com>
Subject: RE: RE: [Full-disclosure] Windows Vista/7 lpksetup dll hijack

Am Montag, den 25.10.2010, 22:56 +0000 schrieb Thor (Hammer of God):
> The main point is that you've got to get people to not only connect up
> to your remote share, but you've got to get them to execute the file,
> etc.  So I'm just wondering what makes this anything more than any
> other "put a malicious link here to make the user execute it" or email
> attachment business, particularly when you say "Remote Code
> Execution."

Err... as far as I know, the interesting part is having the current path
be set to something you can control (to make windows load evil dlls),
and if you just link to the file, that's not the case.

Jann

Download attachment "signature.asc" of type "application/pgp-signature" (198 bytes)

Powered by blists - more mailing lists