well recently i was enlightened by a dfacer of a vulnerability that exists in nt4(ws/srv), some nt5(srv-pro), winme? xp? all sp's. though nt5 with proper acl's could prevent alot. its already caused me some headaches and has just added to my hared for m$ products. i've tested it on my 100+ open user lab and found nothing but headaches. if your in charge of say a school or a productive workplace with alot of end user sec. concerns then this pertains to you. i am running nt4 workstations on whats basically entirely wintranet other than a couple nix fileservers. all workstations are used by various users throughout the day with little to no supervision. so you might understand the dilemma when i read '5 easy steps' off their defacement at all www.alldas.de of jokester.com. well anyway curiously enough i decided to test it out and found it worked. on everything. it was pathetic. the 5 steps where as follows. from the internet explorer window with it open and active (which is the only browser allowed on our stations with access restrictions, so if they type say 'http://www.blah.com' they just get a vio.) 1. type ctrl + f1 *up opens up internet explorer help window, characterized by the friendly tone that plays an the lil dancing squares. 2. right click on the drag bar of the internet explorer help menu. 3. choose the 'jump to url...' command. *up pops a dialog box. 4. enter any dir you would like to enter, example %systemroot%\winnt\system32\ to open up the cmd.exe for a cmd prompt and explorer.exe for a simplistc dir traversal. or a:\ to use toys. 5. hit enter and enjoy., because its all gui and simply says micros**t. unfortunately with this i was able to bypass many restrictions allowing everything necessary to attack other machines internally easily. webpages which are supposedly restricted are viewable, also allowing the attack of intranet webservers (eg: win.tra.net/s.ida) etc. well thats about it, i'd was just lookin to know more about it. its already effected me once today. though an 'obzerve' of fux0r inc. thinks it quite humorous. except i suppose it kind of is lol. durnit windose... anyway any info appreciated. gary Free, encrypted, secure Web-based email at www.hushmail.com
This archive was generated by hypermail 2b30 : Thu May 17 2001 - 10:03:46 PDT