full-disclosure - Re: RDP, can it be done safely?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Thu, 10 Jun 2010 09:39:36 -0400
From: musnt live <musntlive@...il.com>
To: Daniel Sichel <daniels@...derosatel.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: RDP, can it be done safely?

Hello Full Disclosure, I'd like to warn you about a bonehead group of
software developers.

One group of boneheads are in complex in state in US is that called in
Redmond. With exploit in hand to be released in future I give you to PoC:

arg1="%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s"

0:004> !exploitable
Exploitability Classification: EXPLOITABLE
Recommended Bug Title: Exploitable - Data Execution Prevention Violation
starting at Unknown Symbol @ (NO MO FREE BUGS UNTIL THE FUTURE) called from
<Unloaded_2.DLL>+0xISAIDNOFREEBUGS
(Hash=0x485afe60.0x4f3dfe60)

0:004> g
(1ea4.1f42): Access violation - code c0000005 (!!! second chance !!!)
eax=NO ebx=FREE ecx=MORE edx=BUGS esi=NO edi=FREE
eip=deadbabe esp=BUGS ebp=MORE iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000206
deadbabe ?? ???

This exploit for sale affects all. I give you worky worky remote shell.
Starting price of $50,000.00

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/