full-disclosure - Re: Microsoft Help Files (.CHM): 'Locked File' Feature Bypass

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 23 Jun 2010 20:12:24 +0000
From: "Thor (Hammer of God)" <Thor@...merofgod.com>
To: Paul Craig <paul.craig@...urity-assessment.com>,
	"full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: Re: Microsoft Help Files (.CHM): 'Locked File'
	Feature Bypass

Glad to hear it - my "preface settings" aren't  working right so pardon the top post.

I'm glad you replied with that info - that's good info... I can leverage the same thing in RDP sessions then (or it seems like).  I didn't get the full implications from the post as you noted.

RE the MSFT bit, that's why I asked... it wasn't clear what you were saying.  It didn't have the typical "sarcasm" feel, but it was kind of outside of the sentence structure so it seemed like you were trying to make different point.  The "AU" references were just in regard to the current buzz about AU requiring AV to connect to the internet, not anything about you :)  I know better than to bring up the "Australia" vs "New Zealand" bit.   Speaking of which, was there an "Old Zealand?" ;)
t

From: Paul Craig [mailto:paul.craig@...urity-assessment.com]
Sent: Wednesday, June 23, 2010 1:03 PM
To: Thor (Hammer of God); full-disclosure@...ts.grok.org.uk
Subject: Re: Microsoft Help Files (.CHM): 'Locked File' Feature Bypass

Hey Thor, everything is well mate.

Firstly I think you may have missed the context of this bug, which was not apparent from my first post.
I spend a lot of time working on the security of internet Kiosks, Citrix terminals and other thin-clients.
In these situations, users are often blocked from downloading file types from remote sites, however CHM files are typically not blocked.
I had been playing with using a malicious help file for a while, but found the "blocked" feature essentially stopped me from launching anything.

When this trick is combined into the mix, shells appear on many kiosk platforms.
Yes you have to Agree to the dialog box, but when you're the one on the Kiosk/Citrix this is hardly a problem.
This is not a typical attack vector, and likely one you didn't think of, but I didn't want to get into that in my first post and simply detail an interesting 'trick' I found.

As for Microsoft's response.
It was exactly as I expected, as simple as that, this is a low severity issue that does not warrant an immediate "stop the press" fix.
Why does everyone want to read sarcasm and back-handedness in every post ?

I also appreciate that you appear to know geography and mention Australia several times in your post, great one, but I am from New Zealand.
You might want to look it up on Gmaps some time, it's a separate country
How's the weather in Mexico anyway?
Paul

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/