[Full-disclosure] Re: another filename bypass vulnerability - fromcmd.exe

From: barabas mutsonline (barbsie_at_gmail.com)
Date: 11/18/05

  • Next message: Thierry Zoller: "Re: [Full-disclosure] Re: another filename bypass vulnerability - fromcmd.exe" 
    Date: Fri, 18 Nov 2005 13:04:09 +0100
To: full-disclosure@lists.grok.org.uk

    #MW> I think the OP was getting at this being an AV bypass vector for worms
    and
    #MW> other malware that can interact with cmd.exe .
    #TZ>Hmm ok, but how can it interact when it doesn't execute using
    explorer.exe ? Is
    #the user going under Dos to execute it? How does that fit in the
    #scenario ?
     Let's imagine there's an IE bug (quite hard to imagine, but ok) that allows
    cross-zone scripting....An attacker renames his evil payload
    adrianalima.gifinstead of
    blah.exe and puts it on his page. When the victim loads the page, the
    adrianalima.gif will end up in the temporary internet files...No download
    warning will be given cuz its a gif (css etc... will also prolly work). A
    script in the html (cuz its crosszone) can then search the temporary IE
    folders (using indexing service e.g.) for adrianlima.gif and execute it
    using wsscript shell object run cmd /c adrianalima.gif (in vbs e.g.)
     just a thought, haven't tested it nor have I written l33t PoC :p

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.grok.org.uk/full-disclosure-charter.html
    Hosted and sponsored by Secunia - http://secunia.com/

  • Next message: Thierry Zoller: "Re: [Full-disclosure] Re: another filename bypass vulnerability - fromcmd.exe"

    Relevant Pages

    • Re: Reading my own bashrc in a remote ssh host
      ... to make any change to the remote system. ... The script will execute ... One could write script that reads the .bashrc file and create ...
      (comp.os.linux.misc)
    • Dynamic method execution problem
      ... I have been trying to figure out a way to execute a series of methods, ... only 1 of which is expected to actually run without exception, ... with argument passing, calling the right method, and so on.) ... information, I'm using the Watir test library, and I want to interact ...
      (comp.lang.ruby)
    • Unexpected behaviour of methods when executed.
      ... I have referenced a COM dll in my .NET assembly. ... When I execute functions that interact with the ... database, the insertions into database are unpredictable. ... still keep the queries in queue and execute it when there is enough memory. ...
      (microsoft.public.dotnet.framework.interop)
    • Re: how to write this program
      ... You can simply execute the program from the Windows Scheduler every 15 ... what else the task needs to interact with and ...
      (microsoft.public.dotnet.languages.csharp)
    • Quantcast