full-disclosure - Windows (XP SP2) Remote code executionwithparameters

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <BAY10-DAV188720E5D7ECD102E9378CD99A0@phx.gbl>
From: se_cur_ity at hotmail.com (morning_wood)
Subject: Windows (XP SP2) Remote code
	executionwithparameters

> hhctrl.ocx is not installed by default in all SP1s but is on all SP2.
> Therefore when the exploit page tries to create the object he cannot
> find it so it tries to install it. On SP2 it exists by default therefore
> created silently.

i replied to this because of this statement by the O.P..

"Any system running any Microsoft Windows XP edition with Internet Explorer
6
or higher, even with SP2 applied."
this suggests that all XP are affected by default, including sp2.

cheers,

m.w

p.s. I have noticed that the final pre-release of SP2 is much better ( in my
experience )
performance and security wise. ( and it retains raw sockets ). In SP2rc2,
IE6 popup
blocker stopped the PoC at default settings.