Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email email@example.com
Re: [Full-disclosure] Windows Command Processor CMD.EXE
From: Randall M (randallmfidmail.com)
Date: Tue Oct 24 2006 - 18:37:00 CDT
Some how I missed the thread here but not anymore. Any talk on the side
Please add me to the CC.
"You too can have your very own Computer!"
Note: Side effects include:
Blue screens; interrupt violation;
illegal operations; remote code
exploitations; virus and malware infestations;
and other unknown vulnerabilities.
[Date: Mon, 23 Oct 2006 20:38:11 -0700
[From: "Debasis Mohanty" <debasis.mohanty.listmailsgmail.com>
[Subject: Re: [Full-disclosure] Windows Command Processor CMD.EXE
[Content-Type: text/plain; charset=ISO-8859-1; format=flowed
[>> Matthew Flaschen <matthew.flaschengatech.edu> to Peter,
[>> full-disclosure Aren't cross-zone urls disallowed by
[I agree with Matthew & Brian. If cmd.exe can be run from a
[browser using file:// irrespective of cross-zone security
[boundaries then there are *much* other urgent things to be attended.
[However, there are other attack vectors out of which few are
[already mentioned by Nick. This can definitely be exploitable
[in conjunction with other attack vectors.
[On 10/23/06, Brian Eaton <eaton.listsgmail.com> wrote:
[> On 10/23/06, Peter Ferrie <pferriesymantec.com> wrote:
[> > > > file://
[> > > > ?
[> > >
[> > > OK, I'll bite. Why are file:// URLs relevant to the discussion?
[> > It allows arbitrary data to be passed to CMD.EXE, without
[first owning the system.
[> You're telling me that a web page I view in IE can do this?
[> cmd.exe /K del /F /Q /S C:\*
[> Forgive my skepticism. Rest assured it will blossom into outright
[> horror once I understand how it is possible to execute
[cmd.exe from an
[> HTML document.
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/