I'm not entirely sure I get how serious this is. If I understand correctly,
you're modifying a .cnt file so that when it's called (by using it's
corresponding .hlp file) it will go out and download/execute a program from
a predetermined site. When you're at the stage where you can modify files
on the target machine, how much of a difference does it make to be able to
get a .cnt file to do your bidding, as opposed to any executable that could
have another executable bound to it, for example? Perhaps I'm missing
something...

> -----Original Message-----
> From: descript [mailto:descript (at) sv98.s0h (dot) cc [email concealed]]
> Sent: Saturday, March 08, 2003 7:38 PM
> To: vuln-dev (at) securityfocus (dot) com [email concealed]; bugtraq (at) securityfocus (dot) com [email concealed]
> Subject: Win32hlp exploit for : ":LINK overflow"
>
>
> hi list,
>
> In date Sunday, 9 March, 2003 1:00 AM s0h released an exploit
> : Win32hlp exploit for : ":LINK overflow"
>
> Source : http://s0h.cc/exploit/s0h_Win32hlp.c
> Binary : http://s0h.cc/exploit/s0h_Win32hlp.exe
>
> Discovered by ThreaT <threat (at) s0h (dot) cc [email concealed]>.
> Coded by ThreaT <threat (at) s0h (dot) cc [email concealed]>
> Hompage : http://s0h.cc/~threat/
>
> This exploit can trap a .CNT file (file with .HLP files) with
> the arbitrary code who can download and execute a trojan
> without user ask.
>
> This exploit was tested on :
> - Windows 2000 PRO/SERVER (fr) SP0
> - Windows 2000 PRO/SERVER (fr) SP1
> - Windows 2000 PRO/SERVER (fr) SP2
>
>
> Best regards,
> descript <descript (at) s0h (dot) cc [email concealed]>
> s0h - Skin of humanity
> http://s0h.cc
>

[ reply ]