Re: [Full-Disclosure] Test your windows OS

From: Steve Wray (steve_at_myself.gen.nz)
Date: 10/05/04

  • Next message: GuidoZ: "Re: [Full-Disclosure] Spyware installs with no interaction in IE on fully patched XP SP2 box" 
    To: full-disclosure@lists.netsys.com
Date: Tue, 05 Oct 2004 17:10:48 +1300

    Berend-Jan Wever wrote:
    > Hi all,
    >
    > Wanna do a quick test to see if the programmers that wrote your windows operating system have any clue as to what there doing ? Run these commands from cmd.exe in the system32 directory:
    >
    > for %i in (*.exe) do start %i %n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n
    > for %i in (*.exe) do start %i AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.... (type as much "A"-s as cmd.exe allows on one line.)
    >
    > Each command will execute every program in your system32 directory, most of them will either ignore the parameter or report an error because the parameter doesn't make sence... But on my win2k system I found 6 programs vulnerable to these very simple formatsting and BoF tests.... grpconv even gives EIP 0x00410041, can it be any easier?
    >
    > These are not vulnerabilities in itself: you cannot gain access or elevate priviledges but I just wanted to let you know that these programmers did a sloppy job.

    Fascinating; you've rediscovered one of the first vulnerability checks
    ever devised!
    :-)

    You (and the rest of the list; everyone who hasn't already) should read
    'The Unix Haters Handbook' (amusingly enough I find this online copy at
    Microsoft http://research.microsoft.com/~daniel/uhh-download.html but it
    is *not* a Microsoft book; its way older than MS (IIRC)).

     From O'Reilly& "Practical UNIX and Internet Security" chapter 27;

    "Recall that the first study by Professor Barton Miller, cited in
    Chapter 23, found that more than one-third of common programs supplied
    by several UNIX vendors crashed or hung when they were tested with a
    trivial program that generated random input. Five years later, he reran
    the tests. The results? Although most vendors had improved to where
    "only" one-fourth of the programs crashed, one vendor's software
    exhibited a 46% failure rate! This failure rate was despite wide
    circulation and publication of the report, and despite the fact that
    Miller's team made the test code available for free to vendors.

    Most frightening, the testing performed by Miller's group is one of the
    simplest, least-effective forms of testing that can be performed
    (random, black-box testing). Do vendors do any reasonable testing at all?"

    Oh in fact I can now do better than that;
    I found this snippet;

    http://www.llnl.gov/CASC/calendar/miller.061200.html

    where Miller says;
    "This year (2000), we took another stab at random testing, this time
    testing applications running on Windows/NT . Given valid random mouse
    and keyboard input streams, we could crash or hang 45% of these
    applications."

    So yeah, its a very valid technique you describe there, good results!

    > Cheers,
    > SkyLined
    >
    > _______________________________________________
    > Full-Disclosure - We believe in it.
    > Charter: http://lists.netsys.com/full-disclosure-charter.html
    >

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: GuidoZ: "Re: [Full-Disclosure] Spyware installs with no interaction in IE on fully patched XP SP2 box"

    Relevant Pages

    • Re: Towards a responsible vulnerability process
      ... To believe that vendors all behave the ... Microsoft has run the train off the tracks many times in the past. ... Getting a fix is ... security vulnerabilities, vulnerabilities that can be widely exploited, and ...
      (NT-Bugtraq)
    • RE: [Full-disclosure] Our Industry Is Seriously Ethics Impaired
      ... >The company is planning to reward security researchers who reveal ... >information on newly discovered vulnerabilities. ... >3Com will notify affected vendors of security flaws so they can ... >other security vendors prior to public disclosure. ...
      (Full-Disclosure)
    • Re: [Full-disclosure] Our Industry Is Seriously Ethics Impaired
      ... > The company is planning to reward security researchers who reveal ... > information on newly discovered vulnerabilities. ... > 3Com will notify affected vendors of security flaws so they can ... > other security vendors prior to public disclosure. ...
      (Full-Disclosure)
    • Re: [Full-disclosure] [Dailydave] Vulnerabilities Hashes DB needed
      ... vulnerabilities to the vendors, I'm not going to disclose the vendor's ... Reporting Contact DB/List'. ... list' where the researches comunity can send the hashes of the PoC files ...
      (Full-Disclosure)
    • Re: [Dailydave] Vulnerabilities Hashes DB needed
      ... vulnerabilities to the vendors, I'm not going to disclose the vendor's ... Reporting Contact DB/List'. ... list' where the researches comunity can send the hashes of the PoC files ...
      (Bugtraq)