With all due respect to Alex.<br>It's still not the Mother.<br>You have to install DAV support for some Windows.<br><br>And Windows can read other DLL's from the network, if you set the path to point there... of course, it's not the same case,
<br>but it's also possible.<br><br><div><span class="gmail_quote">On 11/8/06, <b class="gmail_sendername">Gadi Evron</b> <<a href="mailto:ge@linuxbox.org">ge@linuxbox.org</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
On Wed, 8 Nov 2006, onisan wrote:<br>> One thing is in this makes it even more interesting, most of the firewalls<br>> do not block this download, so it's smallest and most dangerous downloader<br>> at the same time :o
<br><br>What Alex did is very impressive! Matthew Murphy came up with the idea<br>originally, I think, but it doesn't take from this amazing work in any<br>way.<br>*awe struck*<br><br>I'd say more though, it's a vulnerability.
<br><br>If you can load a library remotely, and do so with no problems, it's a<br>vulnerability in Windows. I am not sure of what kind quite yet.<br><br>The mother of all downloaders.<br><br>"The Zone has a new King!" <we're not worthy x3>
<br> -- Jeff, Coupling (BBC, UK).<br><br> Gadi.<br><br>> -- G<br>><br>> 2006/11/8, Solar Eclipse <<a href="mailto:solareclipse@phreedom.org">solareclipse@phreedom.org</a>>:<br>> ><br>> > On Tue, Nov 07, 2006 at 10:56:42AM -0800, Peter Ferrie wrote:
<br>> > > Why is the idata size present? AFAIK, no Windows version checks it.<br>> > > Four bytes shorter, then (stop at the idata rva non-zero byte)?<br>> ><br>> > You're right, you can remove the last field and bring the file size down
<br>> > to 133 bytes. That's what I get for claiming that the size can't be<br>> > improved :-)<br>> ><br>> > Solar<br>> > _______________________________________________<br>> > Code-Crunchers mailing list
<br>> > <a href="mailto:Code-Crunchers@whitestar.linuxbox.org">Code-Crunchers@whitestar.linuxbox.org</a><br>> > <a href="http://whitestar.linuxbox.org/mailman/listinfo/code-crunchers">http://whitestar.linuxbox.org/mailman/listinfo/code-crunchers
</a><br><br>_______________________________________________<br>Code-Crunchers mailing list<br><a href="mailto:Code-Crunchers@whitestar.linuxbox.org">Code-Crunchers@whitestar.linuxbox.org</a><br><a href="http://whitestar.linuxbox.org/mailman/listinfo/code-crunchers">
http://whitestar.linuxbox.org/mailman/listinfo/code-crunchers</a><br></blockquote></div><br>