lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu Nov 17 19:47:38 2005 From: hracciatti at gmail.com (HernĂ¡n M. Racciatti) Subject: another filename bypass vulnerability - from cmd.exe On 11/16/05, Aditya Deshmukh <aditya.deshmukh@...ine.gateway.strangled.net> wrote: > Was doing some testing [xfocus-AD-051115] > The system is windows 2000 sp4 srp5 with > all other patches upto date. > At the command prompt cmd.exe execute > the following with the results. > > E:\TEMP>cd test > E:\TEMP\test>copy %windir%\system32\calc.exe > 1 file(s) copied. > E:\TEMP\test>ren calc.exe calc.exe.zip > E:\TEMP\test>dir /b > calc.exe.zip > E:\TEMP\test>calc.exe.zip > E:\TEMP\test> > ------------------------------------------------------------------- > This bring up the calc.exe on the screen. Hi guys, check this... Windows XP SP 2 D:\test>copy %windir%\system32\calc.exe 1 file(s) copied. D:\test>ren calc.exe anything.calc.exe.zip D:\test>anything.calc.exe.zip D:\test> ------------------------------------------------------------------- This bring up the calc.exe on the screen too ------------------------------------------------------------------- D:\test>ren anything.calc.exe.zip anything.old D:\test>ren anything.old ------------------------------------------------------------------- bring up again, Bye. -- Hern?n Marcelo Racciatti Core Team Member ISECOM (Institute for Security and Open Methodologies) Coordinator OISSG, Argentina (Open Information System Security Group) [mailto:hracciatti@...il.com] [http://www.hernanracciatti.com.ar]
Powered by blists - more mailing lists