Re: Crashing Win9x with smbclient

[drew () MAGE OZNETCOM COM AU (Drew)]

At 05:51  13/3/00 -0500, you wrote:

--[ snip ]--

> After reading the thread about the 'con\con' bug, I decided
> to do a little experimenting. Here's what I found
> (displayed information is skewed):

Call me slack but I haven't been reading alot lately and this was the first
I'd seen of the con\con bug.. so I got curious and wanted to see what it does.
So off I went to start, run, keyd in \con\con and boom... blue screen.

--[ snip ]--

> This bug probably won't have any affect on our network, since we're
> running
> IP masquerading on our router and nothing can come in. The only way I've
> exploited it remotely is by using smbclient on a Windows machine (my
> Linux box is the only one in the school).

Thats where you are wrong... I started thinking after I rebooted my machine
and this can be remotely exploited via www pages,
simply do a meta refresh (code attached) and it'll blue screen... but this
seems to be browser dependant, IE will change the \ to / and just complain
that the file cannot be found, on the other hand netscape will happily try
to execute the code.

Drew.

<HR NOSHADE>
<UL>
<LI>text/html attachment: index.html
</UL>