[Full-Disclosure] Test your windows OS

From: Berend-Jan Wever (skylined_at_edup.tudelft.nl)
Date: 10/04/04

  • Next message: Mark Shirley: "Re: [Full-Disclosure] Spyware installs with no interaction in IE on fully patched XP SP2 box" 
    To: <full-disclosure@lists.netsys.com>
Date: Mon, 4 Oct 2004 17:39:06 +0200

    Hi all,

    Wanna do a quick test to see if the programmers that wrote your windows operating system have any clue as to what there doing ? Run these commands from cmd.exe in the system32 directory:

    for %i in (*.exe) do start %i %n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n
    for %i in (*.exe) do start %i AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.... (type as much "A"-s as cmd.exe allows on one line.)

    Each command will execute every program in your system32 directory, most of them will either ignore the parameter or report an error because the parameter doesn't make sence... But on my win2k system I found 6 programs vulnerable to these very simple formatsting and BoF tests.... grpconv even gives EIP 0x00410041, can it be any easier?

    These are not vulnerabilities in itself: you cannot gain access or elevate priviledges but I just wanted to let you know that these programmers did a sloppy job.

    Cheers,
    SkyLined

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: Mark Shirley: "Re: [Full-Disclosure] Spyware installs with no interaction in IE on fully patched XP SP2 box"

    Relevant Pages

    • Test your windows OS
      ... Wanna do a quick test to see if the programmers that wrote your windows operating system have any clue as to what there doing? ... These are not vulnerabilities in itself: you cannot gain access or elevate priviledges but I just wanted to let you know that these programmers did a sloppy job. ...
      (Bugtraq)
    • .NET observations
      ... The front page of this site had nearly 600 HTML validation errors (and they ... This platform seems to exist solely to shield developers from HTML tags, ... just as VB and data-bound grids exist to shield "programmers" from coding. ... haven't a clue about HTML, email, JavaScript or anything else Web-related. ...
      (microsoft.public.dotnet.framework.aspnet)
    • Re: Jobs using C
      ... > I was wondering what the current job opportunities in C are these days. ... > What jobs do C programmers hold? ... Erik de Castro Lopo nospam@mega-nerd.com ... Microsoft is finally bringing all of its Windows operating system families ...
      (comp.lang.c)
    • thanks
      ... i just wanna say that free bsd rocks ... and that the programmers of this operatings system and all ...
      (freebsd-questions)
    • Re: Native Code vs PCode OT
      ... >>I really miss the old days when most 'programmers' did not have a clue ... > Some would call that the very definition of "cowboy coder" ... Yeeeha! ...
      (microsoft.public.vb.general.discussion)