Re: [Full-Disclosure] Test your windows OS

From: KF_lists (kf_lists_at_secnetops.com)
Date: 10/04/04

  • Next message: Gossi The Dog: "RE: [Full-Disclosure] Spyware installs with no interaction in IE on fully patched XP SP2 box" 
    To: Berend-Jan Wever <skylined@edup.tudelft.nl>
Date: Mon, 04 Oct 2004 12:02:11 -0400

    On my win2k box with SP4
    atmadm.exe crashed with the format string test.

    csvde.exe ipconfig.exe ldifde.exe sort.exe all crashed on the bof test.
    -KF

    Berend-Jan Wever wrote:
    > Hi all,
    >
    > Wanna do a quick test to see if the programmers that wrote your windows operating system have any clue as to what there doing ? Run these commands from cmd.exe in the system32 directory:
    >
    > for %i in (*.exe) do start %i %n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n
    > for %i in (*.exe) do start %i AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.... (type as much "A"-s as cmd.exe allows on one line.)
    >
    > Each command will execute every program in your system32 directory, most of them will either ignore the parameter or report an error because the parameter doesn't make sence... But on my win2k system I found 6 programs vulnerable to these very simple formatsting and BoF tests.... grpconv even gives EIP 0x00410041, can it be any easier?
    >
    > These are not vulnerabilities in itself: you cannot gain access or elevate priviledges but I just wanted to let you know that these programmers did a sloppy job.
    >
    > Cheers,
    > SkyLined
    >
    > _______________________________________________
    > Full-Disclosure - We believe in it.
    > Charter: http://lists.netsys.com/full-disclosure-charter.html
    >

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: Gossi The Dog: "RE: [Full-Disclosure] Spyware installs with no interaction in IE on fully patched XP SP2 box"