RE: [Full-Disclosure] Microsoft hides certain types of files from your eyes + some filename parsing bug

[Stuart Fox \(DSL AK\)]

The CLSID one doesn't work at all under XP SP2 Beta RC2.  The CLSID is registered on my machine as an HTA.  File extension is show regardless of whether you have view file extensions turned on or off.

 

Cheers

 

Stu

---

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Good One
Sent: Thursday, 8 July 2004 11:37 a.m.
To: [EMAIL PROTECTED]
Subject: [Full-Disclosure] Microsoft hides certain types of files from your eyes + some filename parsing bug

Microsoft HIDES certain types of files from your eyes:

 

This one is old unpatched "behaviour" ...

 

If you will create in windows explorer file :

 

test.txt 

with content :

 

<script>
a=new ActiveXObject("WSCript.Shell");
a.run("CMD.EXE");
alert("Hello, I'm Silly Billy !");
</script>

 

It will be executed if you will add CLSID to it's name and user double clicks it :

 

test.txt.{3050F4D8-98B5-11CF-BB82-00AA00BDCE0B}

 

Note:

CLSID will remain hidden (explorer will not show it up in any means)

File name for user will remain : test.txt

 

This adds numerous possibilities for viruses to fool end user into safe content.

 

 

another filename parsing bug (system even cannot access it) :

By some technics windows still allows to write file on harddisk with funny name like :

 

test [good one :] .avi

 

End user will expierence certain difficulties to remove it afterwards from system.

 

It's name will change to "test [good one", it will have no extension, will show up 0 bytes etc, etc...

 

 

Of course .url and .lnk are hidden as well, being "shortcuts" in m$ way. The contents of those files are up to you ... :-)

 

For example : file "test.url" with this content will open your browser with alert.

 

[DEFAULT]
BASEURL=_javascript_:alert('hello mama !')
[InternetShortcut]
URL="" mama !')
Modified=00027F010505010100

 

 

m$ is good for gaming, not for serious work..

 

 

- SomeMan.

 

---

ALL-NEW Yahoo! Messenger - sooooo many all-new ways to express yourself