<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML xmlns="http://www.w3.org/TR/REC-html40" xmlns:o =
"urn:schemas-microsoft-com:office:office" xmlns:w =
"urn:schemas-microsoft-com:office:word" xmlns:st1 =
"urn:schemas-microsoft-com:office:smarttags"><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.2800.1479" name=GENERATOR><o:SmartTagType
namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="State"></o:SmartTagType><o:SmartTagType
namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="City"></o:SmartTagType><o:SmartTagType
namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="place"></o:SmartTagType><!--[if !mso]>
<STYLE>st1\:* {
BEHAVIOR: url(#default#ieooui)
}
</STYLE>
<![endif]-->
<STYLE>@page Section1 {size: 8.5in 11.0in; margin: 1.0in 1.25in 1.0in 1.25in; }
P.MsoNormal {
FONT-SIZE: 12pt; MARGIN: 0in 0in 0pt; FONT-FAMILY: "Times New Roman"
}
LI.MsoNormal {
FONT-SIZE: 12pt; MARGIN: 0in 0in 0pt; FONT-FAMILY: "Times New Roman"
}
DIV.MsoNormal {
FONT-SIZE: 12pt; MARGIN: 0in 0in 0pt; FONT-FAMILY: "Times New Roman"
}
A:link {
COLOR: blue; TEXT-DECORATION: underline
}
SPAN.MsoHyperlink {
COLOR: blue; TEXT-DECORATION: underline
}
A:visited {
COLOR: purple; TEXT-DECORATION: underline
}
SPAN.MsoHyperlinkFollowed {
COLOR: purple; TEXT-DECORATION: underline
}
P {
FONT-SIZE: 12pt; MARGIN-LEFT: 0in; MARGIN-RIGHT: 0in; FONT-FAMILY: "Times New Roman"; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto
}
SPAN.EmailStyle17 {
COLOR: windowtext; FONT-FAMILY: Arial; mso-style-type: personal-compose
}
DIV.Section1 {
page: Section1
}
</STYLE>
</HEAD>
<BODY lang=EN-US vLink=purple link=blue>
<DIV><SPAN class=312460802-26122004><FONT face=Arial color=#0000ff size=2>Hi
Aviv,</FONT></SPAN></DIV>
<DIV><SPAN class=312460802-26122004><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=312460802-26122004><FONT face=Arial color=#0000ff size=2>Not
sure what your issue is. This has been tested on many people, and it works
on everyone. Maybe its your pop up blocker? Maybe its your
AVP? </FONT></SPAN></DIV>
<DIV><SPAN class=312460802-26122004><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=312460802-26122004><FONT face=Arial color=#0000ff size=2>This
exploit is on Securityfocus and k-otik as they tested as well. Http equiv
verified before any post was made to FD.</FONT></SPAN></DIV>
<DIV><SPAN class=312460802-26122004><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=312460802-26122004><FONT face=Arial color=#0000ff size=2>In
either case we did not code around pop up blockers nor around known virus
strings. This PoC is not for blackhats kiddies.</FONT></SPAN></DIV>
<DIV><SPAN class=312460802-26122004><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=312460802-26122004><FONT face=Arial color=#0000ff
size=2>Mike</FONT></SPAN></DIV>
<DIV><SPAN class=312460802-26122004><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=312460802-26122004><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=312460802-26122004><FONT face=Arial color=#0000ff size=2><A
href="http://www.michaelevanchik.com">www.michaelevanchik.com</A></FONT></SPAN></DIV>
<DIV><SPAN class=312460802-26122004><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<BLOCKQUOTE>
<DIV class=OutlookMessageHeader dir=ltr align=left><FONT face=Tahoma
size=2>-----Original Message-----<BR><B>From:</B>
full-disclosure-bounces@lists.netsys.com
[mailto:full-disclosure-bounces@lists.netsys.com]<B>On Behalf Of </B>Aviv
Raff<BR><B>Sent:</B> Saturday, December 25, 2004 7:47 AM<BR><B>To:</B>
full-disclosure@lists.netsys.com; 'Michael Evanchik'<BR><B>Subject:</B> RE:
[Full-Disclosure] YEY AGAIN Automatic remote compromise ofInternetExplorer
Service Pack 2 XP SP2<BR><BR></FONT></DIV>
<DIV><SPAN class=093222812-25122004><FONT face=Arial color=#0000ff
size=2>Hi,</FONT></SPAN></DIV>
<DIV><SPAN class=093222812-25122004><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=093222812-25122004><FONT face=Arial color=#0000ff
size=2>Somehow the POC does not work on both of my WinXPSP2 pro
boxes.</FONT></SPAN></DIV>
<DIV><SPAN class=093222812-25122004><FONT face=Arial color=#0000ff size=2>Both
are fully patched, but one is hardened and the other is after a clean
install.</FONT></SPAN></DIV>
<DIV><SPAN class=093222812-25122004><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=093222812-25122004><FONT face=Arial color=#0000ff
size=2>After running the POC, the IE opens the Help window, but then freezes
for a couple of minutes. </FONT></SPAN></DIV>
<DIV><SPAN class=093222812-25122004><FONT face=Arial color=#0000ff
size=2>After IE stops freezing, there is no Microsoft Office.hta on the
startup folder.</FONT></SPAN></DIV>
<DIV><SPAN class=093222812-25122004><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=093222812-25122004><FONT face=Arial color=#0000ff size=2>And
yes, I'm running this on an Administrator account.</FONT></SPAN></DIV>
<DIV><SPAN class=093222812-25122004><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=093222812-25122004><FONT face=Arial color=#0000ff size=2>Can
anyone else confirm this?</FONT></SPAN></DIV>
<DIV><SPAN class=093222812-25122004><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=093222812-25122004><FONT face=Arial color=#0000ff size=2>--
Aviv Raff<BR>From "Zen and the Art of Why Linux Sucks": "Ahh.. Can
you smell the 'open source' zealots in the morning?".</FONT></SPAN></DIV>
<DIV><SPAN class=093222812-25122004><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=093222812-25122004><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV><FONT face=Arial color=#0000ff
size=2></FONT><FONT face=Arial color=#0000ff size=2></FONT><BR>
<DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B> full-disclosure-bounces@lists.netsys.com
[mailto:full-disclosure-bounces@lists.netsys.com] <B>On Behalf Of </B>Michael
Evanchik<BR><B>Sent:</B> Friday, December 24, 2004 6:11 PM<BR><B>To:</B>
full-disclosure@lists.netsys.com; bugtraq@securityfocus.com;
NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM; vuln@vulnwatch.org<BR><B>Subject:</B>
[Full-Disclosure] YEY AGAIN Automatic remote compromise of InternetExplorer
Service Pack 2 XP SP2<BR></FONT><BR></DIV>
<DIV></DIV>
<DIV class=Section1>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"><o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"><A
href="http://freehost07.websamba.com/greyhats/sp2rc-analysis.htm">http://freehost07.websamba.com/greyhats/sp2rc-analysis.htm</A><o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"><o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"><o:p></o:p></SPAN></FONT></P>
<P><FONT face="Times New Roman" size=3><SPAN style="FONT-SIZE: 12pt">Microsoft
Internet Explorer XP SP2 Fully Automated Remote
Compromise<o:p></o:p></SPAN></FONT></P>
<P><FONT face="Times New Roman" size=3><SPAN style="FONT-SIZE: 12pt">Dec, 21
2004<o:p></o:p></SPAN></FONT></P>
<P><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt">Vulnerable<BR>----------<BR>- Microsoft Internet
Explorer 6.0<BR>- Microsoft Windows XP Pro SP2<BR>- Microsoft Windows XP Home
SP2<o:p></o:p></SPAN></FONT></P>
<P><FONT face="Times New Roman" size=3><SPAN style="FONT-SIZE: 12pt">Not
Tested<BR>------------------------<BR>- Microsoft Windows 98<BR>- Microsoft
Internet Explorer 5.x<BR>- Microsoft Windows 2003
Server<o:p></o:p></SPAN></FONT></P>
<P><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"><o:p></o:p></SPAN></FONT></P>
<P><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt">Severity<BR>---------<BR>Critical - Remote code
execution, no user intervention<o:p></o:p></SPAN></FONT></P>
<P><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"></SPAN></FONT></P>
<P><FONT face="Times New Roman" size=3><SPAN style="FONT-SIZE: 12pt">Proof of
Concept?<BR>------------------<BR>- <A
href="http://freehost07.websamba.com/greyhats/sp2rc.htm">http://freehost07.websamba.com/greyhats/sp2rc.htm</A><o:p></o:p></SPAN></FONT></P>
<P><FONT face="Times New Roman" size=3><SPAN style="FONT-SIZE: 12pt">- If an
error is shown, press OK. This is normal.<o:p></o:p></SPAN></FONT></P>
<P><FONT face="Times New Roman" size=3><SPAN style="FONT-SIZE: 12pt">- Notice
in your startup menu a new file called Microsoft Office.hta. When run, this
file will download and launch a harmless executable (which includes a pretty
neat fire animation) <o:p></o:p></SPAN></FONT></P>
<P><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"><o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"><o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"><o:p> </o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">Michael
Evanchik</SPAN></FONT><o:p></o:p></P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">Relationship1</SPAN></FONT><o:p></o:p></P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">p:
914-921-4400</SPAN></FONT><o:p></o:p></P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">f:
914-921-6007</SPAN></FONT><o:p></o:p></P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"><A
href="mailto:mevanchik@relationship1.com">mailto:mevanchik@relationship1.com</A></SPAN></FONT><o:p></o:p></P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">web: <A
href="http://www.relationship1.com">http://www.relationship1.com</A></SPAN></FONT><o:p></o:p></P>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"> </SPAN><o:p></o:p></FONT></P>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"><o:p> </o:p></SPAN></FONT></P></DIV>
<TABLE>
<TBODY>
<TR>
<TD bgColor=#ffffff><FONT
color=#000000>#####################################################################################<BR>This
Mail Was Scanned by 012.net Anti Virus Service - Powered by TrendMicro
Interscan<BR></FONT></TD></TR></TBODY></TABLE></BLOCKQUOTE></BODY></HTML>