full-disclosure - UPDATED: the insider exploit( = the latest ie 0day which involves SHOWMODALDIALOG)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <41E37AE6.1060708@umbrella.name>
From: liudieyu at umbrella.name (Liu Die Yu)
Subject: UPDATED: the insider exploit( = the latest ie
 0day which involves SHOWMODALDIALOG)

the insider exploit( = the latest ie 0day involving SHOWMODALDIALOG) was 
verified to work on winxp-en-pro-sp1-ms04004(MS04-004 = Q832894 = 
KB832894), but it does not work on winxp-en-pro-sp1-noextrapatch.

jelmer's exploit is not perfect: URLs are hardcoded, and JSP is not 
popular. so i made this PHP version for copy-and-play:
http://0daymon.org/monitor/insider/dir.zip

=====
i got it while preparing my collection of applicable IE 0day and related 
original posts:
http://0daymon.org/monitor/
that exploit doesn't work without that IE patch - quite weired, right?

and those phishers and their tech support are not as wise as the media 
describes:
1. they should have removed their code immediately after 
THE-INSIDER(RAFI from IS) published those URLs. but they still  run 
their stuff to tell the whole world: "yes! we are criminals armed with 
0day!"
2. at that time most of home-user systems( = their targets) were not 
uptodate, which means most of them didn't have MS04-004 required for the 
exploit to successfully compromise themself.

first i test, then i post :-)))