So have we identified the sender of the list and banned him from the
From: full-disclosure-admin () lists netsys com
[mailto:full-disclosure-admin () lists netsys com] On Behalf Of Vincent
Sent: 04 November 2004 14:31
To: Ferdinand Klinzer
Cc: full-disclosure () lists netsys com
Subject: Re: [Full-disclosure] New REmote Windows Exploit (MS04-029)
On Thu, Nov 04, 2004 at 02:32:33PM +0100, Ferdinand Klinzer wrote:
It´s a simple perl script...
and i don´t think you can call it an remote exploit?
It's more subtle than you think.
The "exploit" is supposed to try to open a cmd tool on 31337 (eleet) on
a target Windows. It fails; the window system is secure... but
there's a perl IRC bot running in the background of *your* system.
It's not a remote exploit, it's a trojan targeting the readers of this