Re: Re: RE: playing for fun with <=IE7
Hi there
Nop it wont work.
http://dams083.free.fr/tmp/putty.exe?explorer.exe
the first .exe extension will be overwriten by
the second one . then it will be putty.exe anyways.
"avivra" did mention that he was able to use this bypass to automate the PDF attack vector
found by GNUCitizen's pdp
http://aviv.raffon.net/2007/10/15/BackFromTheDead.aspx
he also did mention that cyber_flash found the same kind of vuln on IE6 sp2 3 years ago.
thanks to him for theses precisions.
i was also able to reproduce the pdp(gnucitizen) pdf 0days remotly without any promt with IE7
using the avivra idea/exemple showed on his video
here's a live exemple:
http://dams083.free.fr/pdf_poc.exe?1.pdf
pdf is open , calc.exe is launched no promt .
we can imagine the impact with a:
-permanent Xss
-malicious webpage
-worm
-etc
regards laurent gaffi
//sorry for the delay.
討論串 (同標題文章)
完整討論串 (本文為第 4 之 4 篇)：