Home page logo
/

bugtraq logo Bugtraq mailing list archives

Exploitation of Windows WMF on the web
From: Daniel Bonekeeper <thehazard () gmail com>
Date: Tue, 27 Dec 2005 15:46:03 -0800

*** PAY ATENTION BEFORE CLICK ON ANY LINK ON THAT MESSAGE ***

I don't know if this thing is already known, but I just got this when
I was "navigating" on a certain website. It was a sucession of hidden
<frames> from diferent domains, ending on:

http://69.50.183.34/m.html

It will then call another frame, targeting to:

http://69.50.183.34/xpl.wmf

Which is the exploit itself. This WMF will download the file cj.exe on
the same server (http://69.50.183.34/cj.exe) and run. It worked with
me, and probably will work with a lot of people (hey, I just checked
the windows update site for updates, and seems that I'm fully
patched... even though, the exploit was triggered on me).
After exploitation, cj.exe will try to install some browser helper
objects (probably a spyware or something like that)

Just checked on www.virustotal.com and it seems that both files are
quite unknown.

--
# (perl -e "while (1) { print "\x90"; }") | dd of=/dev/evil


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]