Also who said the message was not spoofed? -KF
raza wrote:
So have we identified the sender of the list and banned him from the Mailing List.?
Raza
-----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Vincent Archer Sent: 04 November 2004 14:31 To: Ferdinand Klinzer Cc: [EMAIL PROTECTED] Subject: Re: [Full-Disclosure] New REmote Windows Exploit (MS04-029)
On Thu, Nov 04, 2004 at 02:32:33PM +0100, Ferdinand Klinzer wrote:
Itīs a simple perl script...
and i donīt think you can call it an remote exploit?
It's more subtle than you think.
The "exploit" is supposed to try to open a cmd tool on 31337 (eleet) on a target Windows. It fails; the window system is secure... but meanwhile, there's a perl IRC bot running in the background of *your* system.
It's not a remote exploit, it's a trojan targeting the readers of this list.
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
