full-disclosure - [Fwd: COELACANTH: Phreak Phishing Expedition]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <FCAD9F541A8E8A44881527A6792F892C10CD81@owa.eeye.com>
From: dcopley at eEye.com (Drew Copley)
Subject: [Fwd: COELACANTH: Phreak Phishing Expedition]



> Subject: [Full-Disclosure] COELACANTH: Phreak Phishing Expedition
> From:    "http-equiv@...ite.com" <1@...ware.com>
> Date:    Thu, June 10, 2004 12:35 pm
> To:      full-disclosure@...ts.netsys.com
> --------------------------------------------------------------
> ------------
> 
> 
> 
> Thursday, June 10, 2004
> 
> The following was presented by 'bitlance winter' of Japan today:
> 
> <a href="http://www.microsoft.com%2F redir=www.e-
> gold.com">test</a>
> 
> Quite inexplicable from these quarters. Perhaps someone with
> server 'knowledge' can examine it.
> 
> It carries over the address into the address bar:
> 
> [screen shot: http://www.malware.com/gosh.png 72KB]
> 
> while redirecting to egold. The key being %2F without that it
> fails. The big question is where is the 'redir' and why is it
> only applicable [so far] to e-gold. Other sites don't work and e-
> gold is running an old Microsoft-IIS/4.0.


IE makes this into a connection with e-gold.com like so:

GET / HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,
application/vnd.ms-excel, application/vnd.ms-powerpoint,
application/msword, application/x-shockwave-flash, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR
1.1.4322; .NET CLR 1.0.3705)
Host: www.microsoft.com/ redir=www.e-gold.com
Connection: Keep-Alive

It never touches microsoft.com.

What is interesting, though, is IE spoofs the zone. If you change
www.microsoft.com
in there to a site in your trusted zone, you will see e-gold read as
your
trusted zone.

So, you should be able to bounce from any trusted zone and theoritically
from
local zone -- and with adodb still being open, you should be able to
run code because of the open adodb issue.

IE doesn't talk to e-gold first. It connects to it. It sends the GET
request,
it receives the first page. 

But, can't replicate with other servers. It requires some more research.


> 
> Working Example:
> 
> http://www.malware.com/golly.html
> 
> 
> credit: 'bitlance winter'
> 
> 
> End Call
> 
> -- 
> http://www.malware.com
> 
> 
> 
> 
> 
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
> 
> 
>