full-disclosure - WMF Exploit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <200601041752.38132.fdlist@digitaloffense.net>
Date: Thu Jan  5 00:20:48 2006
From: fdlist at digitaloffense.net (H D Moore)
Subject: WMF Exploit

>From my experience on XP/2003, IE will only render WMF files as images if 
the "placeable" header has been added before the WMF header. The addition 
of the "placeable" header prevents the SetAbortProc from being reached in 
the Escape() function, due to a check on the device context (credits to 
mr. anonymous for that gem, I spent an hour beating my head on it).

I will try to publish an "exploit faq" later tonight, seems to be way too 
much confusion about this flaw...

-HD

On Wednesday 04 January 2006 17:27, Crist J. Clark wrote:
> IE 6 displayed WMF files on a test Win98 system just fine for
> me.
>
> Remember, just because when you double-click on a WMF file
> Windows Explorer doesn't know what to do with it does NOT mean
> that when presented to IE in an <img> tag, it won't. Even trying
> to open the file with IE doesn't mean anything. You need to
> try it in a webpage.