RE: Win32hlp exploit for : ":LINK overflow"

From: Rob Shein (shoten@starpower.net)
Date: 03/11/03

  • Next message: Ivan Aleksandrov: "su core dumped with signal 3. BSD/OS 3.0, 3.1" 
    From: "Rob Shein" <shoten@starpower.net>
To: "'descript'" <descript@sv98.s0h.cc>, <vuln-dev@securityfocus.com>, <bugtraq@securityfocus.com>
Date: Tue, 11 Mar 2003 08:59:14 -0500

    I'm not entirely sure I get how serious this is. If I understand correctly,
    you're modifying a .cnt file so that when it's called (by using it's
    corresponding .hlp file) it will go out and download/execute a program from
    a predetermined site. When you're at the stage where you can modify files
    on the target machine, how much of a difference does it make to be able to
    get a .cnt file to do your bidding, as opposed to any executable that could
    have another executable bound to it, for example? Perhaps I'm missing
    something...

    > -----Original Message-----
    > From: descript [mailto:descript@sv98.s0h.cc]
    > Sent: Saturday, March 08, 2003 7:38 PM
    > To: vuln-dev@securityfocus.com; bugtraq@securityfocus.com
    > Subject: Win32hlp exploit for : ":LINK overflow"
    >
    >
    > hi list,
    >
    > In date Sunday, 9 March, 2003 1:00 AM s0h released an exploit
    > : Win32hlp exploit for : ":LINK overflow"
    >
    > Source : http://s0h.cc/exploit/s0h_Win32hlp.c
    > Binary : http://s0h.cc/exploit/s0h_Win32hlp.exe
    >
    > Discovered by ThreaT <threat@s0h.cc>.
    > Coded by ThreaT <threat@s0h.cc>
    > Hompage : http://s0h.cc/~threat/
    >
    > This exploit can trap a .CNT file (file with .HLP files) with
    > the arbitrary code who can download and execute a trojan
    > without user ask.
    >
    > This exploit was tested on :
    > - Windows 2000 PRO/SERVER (fr) SP0
    > - Windows 2000 PRO/SERVER (fr) SP1
    > - Windows 2000 PRO/SERVER (fr) SP2
    >
    >
    > Best regards,
    > descript <descript@s0h.cc>
    > s0h - Skin of humanity
    > http://s0h.cc
    >

  • Next message: Ivan Aleksandrov: "su core dumped with signal 3. BSD/OS 3.0, 3.1"

    Relevant Pages

    • RE: Win32hlp exploit for : ":LINK overflow"
      ... But the .cnt file isn't directly executable; it gets called from the .hlp ... > download or open .exe's due to viruses, ... > modify files on the target machine, ... >> the arbitrary code who can download and execute a trojan ...
      (Vuln-Dev)
    • RE: Win32hlp exploit for : ":LINK overflow"
      ... YOU CANNOT RUN A .CNT FILE. ... > download or open .exe's due to viruses, ... > modify files on the target machine, ... >> the arbitrary code who can download and execute a trojan ...
      (Vuln-Dev)