Valdis.Kletnieksvt.edu
Date: Thu Nov 26 2009 - 08:50:27 CST

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

On Wed, 25 Nov 2009 03:10:04 +0530, Tyler Durten said:

> I guess this is an email list. This guy -* Day Jay, has put up this
> vulnerability up on seclist, stating that it relates to microsoft iis 6.0,
> when it actually deletes the user's home folder. This is total shit, and if
> you (Day Jay), think that this is ultral33t, know that you suck, and you're
> pretty good at that.

Some lessons to learn:

1) Backups are important. If nothing else, buy a 500G USB SATA disk drive and
dump your machine to it once or twice a week.

2) Always mount a scratch monkey. (Bonus points for the silverbacks who get the
reference). A crash-n-bun test system, or at least a throwaway VMware with a
'revert' button.

3) If something is doing nothing but a 'system()' call on a string of hex constants, you
probably want to do the following first:

a) See what 'printf("%s", hexconstant)": produces
b) Understand why you don't want to just do "printf(hexconstant);'

4) You should have read the whole thread, not just snarfed up the exploit.
Often, first posts of new exploits are buggy and the rest of the thread has
useful bugfixes. In this case, the thread almost certainly had several
indignant posts just like yours. ;)

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Exmh version 2.5 07/13/2001

iD8DBQFLDpWzcC3lWbTT17ARAuv3AKD9x04ChzP0AoolozpAw26qwtcZqgCeJIXr
DKgrjCOk1KhFq5XAlvqOds0=
=DyTl
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]