Here are some pretty generic things.. Bind shell, connect back shell. have it download a file an execute it. Those are just a few ideas...<br><br><div><span class="gmail_quote">On 7/7/06, <b class="gmail_sendername">ima cow
</b> <<a href="mailto:i-am-cow@rogers.com">i-am-cow@rogers.com</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div>
<div><div style="font-family: times new roman,new york,times,serif; font-size: 12pt;"><div>i understand that this is "full disclosure", but before i actually spill the beans on the exact nature of the exploit i've found, i'd like to make it actually do something.
<br>for now, know that it affects a popular plugin for a popular messaging program.<br>i'm at the stage where i can run any command on the remote user's computer (just like start > run...), or have them request remote assistance.
<br>other than showing them goatse, what can i do with this?<br></div></div></div>
</div><br>_______________________________________________<br>Full-Disclosure - We believe in it.<br>Charter: <a onclick="return top.js.OpenExtLink(window,event,this)" href="http://lists.grok.org.uk/full-disclosure-charter.html" target="_blank">
http://lists.grok.org.uk/full-disclosure-charter.html</a><br>Hosted and sponsored by Secunia - <a onclick="return top.js.OpenExtLink(window,event,this)" href="http://secunia.com/" target="_blank">http://secunia.com/</a><br>
<br></blockquote></div><br><br clear="all"><br>-- <br>-- h0 h0 h0 --<br><a href="http://www.nopsled.net">www.nopsled.net</a>