Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Re: Windows Vista/7 lpksetup dll hijack
From: Jann Horn <jannhorn () googlemail com>
Date: Tue, 26 Oct 2010 19:04:27 +0200

Am Montag, den 25.10.2010, 22:56 +0000 schrieb Thor (Hammer of God):
The main point is that you've got to get people to not only connect up
to your remote share, but you've got to get them to execute the file,
etc.  So I'm just wondering what makes this anything more than any
other "put a malicious link here to make the user execute it" or email
attachment business, particularly when you say "Remote Code
Execution."

Err... as far as I know, the interesting part is having the current path
be set to something you can control (to make windows load evil dlls),
and if you just link to the file, that's not the case.

Jann

Attachment: signature.asc
Description: Dies ist ein digital signierter Nachrichtenteil

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault