lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
From: smenard at (Steve Menard)
Subject: Re: AIM Password theft

windows 2000 professional  all patches

not only was wmplayer overwritten..with text..
but  IE 6  DIED   ..   then launched a command window

command prompt labelled 'C:\PROGRA~1\WINDOW~1\wmplayer.exe'
followed quickly by ...
--dialog box--
16-bit MS-DOS Subsystem
the NTVDM CPU has encountered an illegal instruction.
CS:0544 IP:01CC OP:63 68 65 2F 31 Choose 'Close' to terminate the 
[close] [ignore]

yikes wrote:
  Out of curiosity I followed that link which loaded start.html (attached).

Caution: off-site archives will and have already stored this as:

text/plain attachment: start.txt
Tested on neohapsis

Due to the 'never-addressed-mime-issue' of Internet Explorer reading 
even dog poo as html, opening start.txt will effect the exploit partialy.

  C:\Program Files\Windows Media Player\wmplayer.exe
will be overwritten by simply viewing the attached text file.

It is apparent the original intended payload .exe is no longer at the 
location, but the wmplayer.exe is still overwritten with a 1KB 
wmplayer.exe containing the following:

<TITLE>404 Not Found</TITLE>
<H1>Not Found</H1>
The requested URL /eg/1.exe was not found on this server.<P>
<ADDRESS>Apache/1.3.26 Server at Port 80</ADDRESS>

Powered by blists - more mailing lists