REGUSTERFLY To The White Courtesy Phone Please? (Was: Re: [Full-disclosure] Virus on web site)

2005-08-01 Thread J.A. Terranson
On Tue, 2 Aug 2005, Peter B. Harvey (Information Security) wrote: > Hi all, > > This virus at the time of my posting this is only detedted by > Kasperski and I cannot find any detail on the virus. Came in the > email as given below. > > URL for the virus http://www.alias-search.com/images/msits.e

Re: [Full-disclosure] Undisclosed Sudo Vulnerability ?

2005-08-01 Thread Ben Hawkes
On Mon, Aug 01, 2005 at 09:57:51PM -0500, Ron wrote: > Haha nice, I was just getting ready to run it on my sacrificial VMWare > box, but you saved me the trouble of hitting "undo" :-) > > Kurt Seifried wrote: > > This is a trojan that will nuke all the files owned by the user running it. > > > >

[Full-disclosure] Virus on web site

2005-08-01 Thread Peter B. Harvey \(Information Security\)
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi all, This virus at the time of my posting this is only detedted by Kasperski and I cannot find any detail on the virus. Came in the email as given below. URL for the virus http://www.alias-search.com/images/msits.exe Also found was the following

Re: [Full-disclosure] Cisco IOS Shellcode Presentation

2005-08-01 Thread Valdis . Kletnieks
On Mon, 01 Aug 2005 13:37:34 -1000, Jason Coombs said: > Technica Forensis wrote: > >>CAUTION: > >>Internet and e-mail communications are Kohl's property and Kohl's reserves > >>the > >>right to retrieve and read any message created, sent and received. The crucial word ---^^^ > > Kohl

Re: [Full-disclosure] Undisclosed Sudo Vulnerability ?

2005-08-01 Thread Ron
Haha nice, I was just getting ready to run it on my sacrificial VMWare box, but you saved me the trouble of hitting "undo" :-) Kurt Seifried wrote: > This is a trojan that will nuke all the files owned by the user running it. > > -Kurt > > - Original Message - From: "Esler, Joel - Contra

Re: [Full-disclosure] Cisco IOS Shellcode Presentation

2005-08-01 Thread J.A. Terranson
> > can someone send me the famous Cisco IOS Shellcode Presentation ?? > > please.. > > my mail is [EMAIL PROTECTED] WTF? Just what kind of lazy, stupid, IGNORANT motherfucker are you? Go spend 15 seconds of YOUR OWN FUCKING TIME, and FETCH IT YOURSELF. -- Yours, J.A. Terranson [

Re: [Full-disclosure] Cisco IOS Shellcode Presentation

2005-08-01 Thread Ivan C
you can find it here http://www.cryptome.org/ On 8/1/05, [EMAIL PROTECTED] <[EMAIL PROTECTED]> wrote: > hi to all > > can someone send me the famous Cisco IOS Shellcode Presentation ?? > please.. > my mail is [EMAIL PROTECTED] > > > > __

Re: [Full-disclosure] Cisco IOS Shellcode Presentation

2005-08-01 Thread Jason Coombs
Technica Forensis wrote: CAUTION: Internet and e-mail communications are Kohl's property and Kohl's reserves the right to retrieve and read any message created, sent and received. Kohl's owns the Internet? Kohl's reserves the right to read my email I send my mom just because it's on the

Re: [Full-disclosure] Cisco IOS Shellcode Presentation

2005-08-01 Thread Technica Forensis
> CAUTION: > Internet and e-mail communications are Kohl's property and Kohl's reserves > the > right to retrieve and read any message created, sent and received. Kohl's owns the Internet? Kohl's reserves the right to read my email I send my mom just because it's on the Internet? maybe you

[Full-disclosure] [gentoo-announce] [ GLSA 200508-02 ] ProFTPD: Format string vulnerabilities

2005-08-01 Thread Sune Kloppenborg Jeppesen
This message contains a digitally signed email which can be read by opening the attachment.   The information contained in this e-mail may be confidential and is intended solely for the use of the named addressee. Access, copying or re-use of the e-mail or any information contained therein by an

[Full-disclosure] [ GLSA 200508-02 ] ProFTPD: Format string vulnerabilities

2005-08-01 Thread Sune Kloppenborg Jeppesen
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200508-02 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - -

Re: [Full-disclosure] RE: Getting a clue at Cisco

2005-08-01 Thread Sam Evans
Just curious -- if the April patch fixed the vulnerability discussed, then that would mean (according to Cisco) that the vulnerability affected IPV6 and not IPV4, correct?     On 8/1/05, byte_jump <[EMAIL PROTECTED]> wrote: In my opinion, probably the grossest error made by Cisco in all ofthis was

Re: [Full-disclosure] RE: Getting a clue at Cisco

2005-08-01 Thread byte_jump
In my opinion, probably the grossest error made by Cisco in all of this was silently patching their IOS back in April. Anyone who's ever used Cisco's software knows that you can never run the latest release, unless you want things to break, and break badly. As a result, how many organizations were

Re: [Full-disclosure] Cisco IOS Shellcode Presentation

2005-08-01 Thread Andre Ludwig
anyone got the new cindy_nip_slip.rar with that blurry nip slip? OMFG d00d itz 2lm0st lik3 sh3 1z da [EMAIL PROTECTED] anyone getting a K:D ratio of 75%?? Damn my new razer mouse is p0wning with an awp... Anyone got links to the l33t chinese h4x0rz websites? D to da motha fuckin r to da 3 be

Re: [Full-disclosure] RE: Getting a clue at Cisco

2005-08-01 Thread Frank Knobbe
On Mon, 2005-08-01 at 11:59 -0700, Daniel Sichel wrote: > There are still a few people there who have their heads screwed on > right. Of course finding them can be a challenge Mike Schiffman being one of them. I wonder what his take is on this. Curious, Frank -- Blackhatgate: Shame on C

[Full-disclosure] RE: Getting a clue at Cisco

2005-08-01 Thread Daniel Sichel
> Or perhaps Cisco > has already finished its transformation to the modern kind of bussines and > got rid of anyone with a clue? There are still a few people there who have their heads screwed on right. Of course finding them can be a challenge Hurrah for the global economy, the largest expo

Re: [Full-disclosure] Cisco IOS Shellcode Presentation

2005-08-01 Thread Jason Coombs
[EMAIL PROTECTED] wrote: It occurs to me that your solution is flawed as well. What assurance do we have that your "protected storage" is future-proof (i.e. unbreachable by an means whatsoever)? It doesn't have to be unbreachable by any means whatsoever, it has to be unbreachable from a remo

Re: [Full-disclosure] Best way to crack NT passwds

2005-08-01 Thread David Chastain
If you have physical access - Try BartPE On Saturday, July 30, 2005, at 06:37AM, Paul Farrow <[EMAIL PROTECTED]> wrote: >Yup after I posted that I read your post, have to admit, searching a >table full of hashes would be a hell of alot quicker than cracking it >manually :] >But then again, I ra

RE: [Full-disclosure] Weird URL

2005-08-01 Thread Nuno Cruz
Just search http and https on google, that will tell you the answer :) -- Regards, Nuno Cruz -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bug Traq Sent: segunda-feira, 1 de Agosto de 2005 16:26 To: full-disclosure@lists.grok.org.uk Subject: [Full-di

Re: [Full-disclosure] Cisco IOS Shellcode Presentation

2005-08-01 Thread John Kinsella
Hate having to explain a joke, but... It's a usenet joke referring to "me too!" lamers. Search Google Groups. John On Mon, Aug 01, 2005 at 10:45:04AM -0500, milw0rm Inc. wrote: > You must actually be on the Cindy Crawford mailing list then? lmfao. > > /str0ke > > On 8/1/05, John Kinsella <[E

Re: [Full-disclosure] Weird URL

2005-08-01 Thread Micheal Espinola Jr
Ahh, good call! On 8/1/05, Steve Friedl <[EMAIL PROTECTED]> wrote: > On Mon, Aug 01, 2005 at 11:26:27AM -0400, Bug Traq wrote: > > Paste this URL in a firefox browser address bar and see what happens. > > http://https/;//gmail.google.com > > > > Anyone know why? > > You get the same thing when yo

Re: [Full-disclosure] Weird URL

2005-08-01 Thread Vincent van Scherpenseel
On Monday 01 August 2005 17:42, Bug Traq wrote: > Doesn't work in IE though No, but you were talking about Firefox in your original posting. And besides: more and more Average Joes are starting to use Firefox. Now the amount of Firefox users is growing, more and more exploits will surface target

Re: [Full-disclosure] Cisco IOS Shellcode Presentation

2005-08-01 Thread milw0rm Inc.
You must actually be on the Cindy Crawford mailing list then? lmfao. /str0ke On 8/1/05, John Kinsella <[EMAIL PROTECTED]> wrote: > This is getting like the Cindy Crawford mailing list... > > On Mon, Aug 01, 2005 at 03:55:02PM +0300, [EMAIL PROTECTED] wrote: > > hi to all > > > > can someone sen

Re: [Full-disclosure] Weird URL

2005-08-01 Thread Bug Traq
Doesn't work in IE though On 8/1/05, Vincent van Scherpenseel <[EMAIL PROTECTED]> wrote: > On Monday 01 August 2005 17:26, Bug Traq wrote: > > Paste this URL in a firefox browser address bar and see what happens. > > http://https/;//gmail.google.com > > > > Anyone know why? > > Yes, Firefox uses

Re: [Full-disclosure] Weird URL

2005-08-01 Thread Vincent van Scherpenseel
On Monday 01 August 2005 17:26, Bug Traq wrote: > Paste this URL in a firefox browser address bar and see what happens. > http://https/;//gmail.google.com > > Anyone know why? Yes, Firefox uses Google's "I'm feeling lucky" feature to redirect users who enter a word in the address bar which does n

Re: [Full-disclosure] Weird URL

2005-08-01 Thread admin
> Paste this URL in a firefox browser address bar and see what happens. > http://https/;//gmail.google.com > > Anyone know why? > ___ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and spons

Re: [Full-disclosure] Weird URL

2005-08-01 Thread Steve Friedl
On Mon, Aug 01, 2005 at 11:26:27AM -0400, Bug Traq wrote: > Paste this URL in a firefox browser address bar and see what happens. > http://https/;//gmail.google.com > > Anyone know why? You get the same thing when you enter just https and it's because www.paypal.com is the first Google

[Full-disclosure] Weird URL

2005-08-01 Thread Bug Traq
Paste this URL in a firefox browser address bar and see what happens. http://https/;//gmail.google.com Anyone know why? ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia

Re: [Full-disclosure] Cisco IOS Shellcode Presentation

2005-08-01 Thread Bart . Lansing
[EMAIL PROTECTED] wrote on 07/29/2005 09:28:31 PM: > [EMAIL PROTECTED] wrote: > > On Fri, 29 Jul 2005 15:02:51 -1000, Jason Coombs said: > >>redesign, fundamentally, the turing machine so that before each > >>operation is performed a verification step is employed to ensure that > > > > Ahem. N

Re: [Full-disclosure] Cisco IOS Shellcode Presentation

2005-08-01 Thread John Kinsella
This is getting like the Cindy Crawford mailing list... On Mon, Aug 01, 2005 at 03:55:02PM +0300, [EMAIL PROTECTED] wrote: > hi to all > > can someone send me the famous Cisco IOS Shellcode Presentation ?? > please.. > my mail is [EMAIL PROTECTED] > > > > __

[Full-disclosure] HACK IN THE BOX SECURITY CONFERENCE 2005

2005-08-01 Thread alphademon
Hack In The Box is pleased to inform you that *HACK IN THE BOX SECURITY CONFERENCE* is back for the 5th time in our series! After our first ever security conference in the Middle East we cordially invite you to sign up for the biggest conference in our series yet! *HITBSecConf2005 - Malaysia* will

Re: [Full-disclosure] Cisco IOS Shellcode Presentation

2005-08-01 Thread milw0rm Inc.
http://www.milw0rm.com/sploits/lynn-cisco.pdf /str0ke On 8/1/05, [EMAIL PROTECTED] <[EMAIL PROTECTED]> wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > you didn't search a lot , do you know of google ? because I'm not > sure fd is owning the searching market :> > > http://www.google

Re: [Full-disclosure] Cisco IOS Shellcode Presentation

2005-08-01 Thread [EMAIL PROTECTED]
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 you didn't search a lot , do you know of google ? because I'm not sure fd is owning the searching market :> http://www.google.com/search?hl=en&lr=&q=lynn+cisco+pdf At 14:55 01/08/05, [EMAIL PROTECTED] wrote: hi to all can someone send me the fa

[Full-disclosure] Cisco IOS Shellcode Presentation

2005-08-01 Thread moshe
hi to all can someone send me the famous Cisco IOS Shellcode Presentation ?? please.. my mail is [EMAIL PROTECTED] ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored

[Full-disclosure] Re: [VulnWatch] The Java applet sandbox and stateful firewalls

2005-08-01 Thread Florian Weimer
* Dinis Cruz: > Is the Java Sandbox able to create outgoing connections on ports like 445? > > Also, even if it is possible, if a service like MS-SQL is already binded > to 1433, then wouldn't an error be thrown saying something like 'Port > already in use'. This doesn't matter because in the P

[Full-disclosure] courious blind sql topic..

2005-08-01 Thread none neither
I was just learning about sql injection and it's blind recall, and I have some questions: With the sentence " and MID($$$FIELD$$$,1,1) like CHAR(37) " and some bruteforce I went through php's special chars protection and was able to get thinks like: http://www.phrack.org/author.php?a=290

[Full-disclosure] [USN-159-1] unzip vulnerability

2005-08-01 Thread Martin Pitt
=== Ubuntu Security Notice USN-159-1August 01, 2005 unzip vulnerability CAN-2005-0602 === A security issue affects the following Ubuntu releases: Ubuntu 4.10 (Warty Warthog)

[Full-disclosure] [USN-158-1] gzip utility vulnerability

2005-08-01 Thread Martin Pitt
=== Ubuntu Security Notice USN-158-1August 01, 2005 gzip vulnerability CAN-2005-0758 === A security issue affects the following Ubuntu releases: Ubuntu 4.10 (Warty Warthog)

Re: [Full-disclosure] Mike Lynn's controversial CiscoSecurity Presentation

2005-08-01 Thread Christoph Gruber
Am Samstag, 30. Juli 2005 17:19 schrieb DAN MORRILL: > Protection right now, the Joy of being a student) the creator of the data > has the direct right under Title 17 and the DMCA to determine how the data > will be used (hence expiring CDR's and DRM). > > If data is sent in error that does not li

[Full-disclosure] [SECURITY] [DSA 771-1] New pdns packages fix denial of service

2005-08-01 Thread Martin Schulze
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- Debian Security Advisory DSA 771-1 [EMAIL PROTECTED] http://www.debian.org/security/ Martin Schulze August 1st, 2005

[Full-disclosure] [USN-157-1] Mozilla Thunderbird vulnerabilities

2005-08-01 Thread Martin Pitt
== Ubuntu Security Notice USN-157-1 August 01, 2005 mozilla-thunderbird vulnerabilities CAN-2005-0989, CAN-2005-1159, CAN-2005-1160, CAN-2005-1532, CAN-2005-2261, CAN-2005-2265, CAN-2005-2269, CAN-2005-2270, CAN-2005-2353 ===

[Full-disclosure] Re: [VulnWatch] The Java applet sandbox and stateful firewalls

2005-08-01 Thread Dinis Cruz
Is the Java Sandbox able to create outgoing connections on ports like 445? Also, even if it is possible, if a service like MS-SQL is already binded to 1433, then wouldn't an error be thrown saying something like 'Port already in use'. That said, this is a very interesting concept, and a real

Re: [Full-disclosure] Did you miss us yet?

2005-08-01 Thread Dinis Cruz
Surely this is a hoax? Dinis Cruz .Net Security Consultant Phrack Staff wrote: [-]=[-] +++ =: P H R A C K - R E B O R N :=

[Full-disclosure] Buffer overflow in BusinessMail email server system 4.60.00

2005-08-01 Thread Reed Arvin
Summary: Buffer overflow in BusinessMail email server system 4.60.00 (http://www.netcplus.com/) Details: Input to the SMTP HELO and MAIL FROM: commands is not properly checked and/or filtered. Issuing a long argument to the HELO and MAIL FROM: commands will cause the corresponding process to die.