mailing list archives
From: "http-equiv () excite com" <http-equiv () excite com>
Date: Mon, 28 May 2001 19:48:42 -0700 (PDT)
Monday, May 28, 2001
Silent delivery and installation of an executable on a target computer. This
can be accomplished with the default installation of the mail client Eudora
'allow executables in HTML content' DISABLED
'use Microsoft viewer' ENABLED
The manufacturer http://www.eudora.com has done a tremendous job of shutting
down all possibilities of scripting and all other necessaries to achieve the
following result. See:
However there still remains a number of good possibilities. One of which is
the following that we find to be quite interesting.
1. Using the POWAH! of Internet Explorer, we create yet another HTML mail
message as follows:
<FORM action="cid:master.malware.com" method=post target=new><button
<img SRC="cid:master.malware.com" height=1 width=1><img
SRC="cid:http://www.malware.com" height=1 width=1>
Where our first image is our executable. Our second image comprises a simple
What happens is, once the mail message is opened in Eudora 5.1, the two
'embedded' images are silently and instantly transferred to the 'Embedded'
What we then do is create a simple html form and button. Owing to the POWAH!
of Internet Explorer, we are able to create this button with a transparent
background. In addition, we are able to dispose of the border of this
button, which combined with the transparent background gives us nothing.
That is, we have a fully functional form and button but we are not able to
see it. We then create a fake link and incorporate that into our invisible
invisible button and fire it off to our target computer:
(screen shot: http://www.malware.com/heydora.jpg 62KB)
(screen shot: http://www.malware.com/hey!dora.jpg 62KB)
The recipient is then lulled into clicking on the "link". What that does is
out of the embedded folder and into a new Internet Explorer Window.
the same folder [the so-called "Embedded' folder], and because it is
automatically opened in our new Internet Explorer Window, everything is
No warnings. No nothing.
The *.exe is executed instantly.
2. Working Example. Harmless *.exe. incorporated. Tested on win98, with
IE5.5 (all of its patches and so-called service packs), default Eudora 5.1
with 'use Microsoft viewer' ENABLED and 'allow executables in HTML content'
The following is in plaintext. We are unable to figure out how to import a
single message into Eudora's inbox. Perhaps some bright spark knows.
Otherwise, incorporate the text sample into a telnet session or other and
fire off to your Eudora inbox:
Notes: disable 'use Microsoft viewer'
Send a cool gift with your E-Card
- feeble.hey!dora.exploit part.II http-equiv () excite com (May 29)