Exploitation of Windows WMF on the web

[Daniel Bonekeeper]

*** PAY ATENTION BEFORE CLICK ON ANY LINK ON THAT MESSAGE ***

I don't know if this thing is already known, but I just got this when
I was "navigating" on a certain website. It was a sucession of hidden
<frames> from diferent domains, ending on:

http://69.50.183.34/m.html

It will then call another frame, targeting to:

http://69.50.183.34/xpl.wmf

Which is the exploit itself. This WMF will download the file cj.exe on
the same server (http://69.50.183.34/cj.exe) and run. It worked with
me, and probably will work with a lot of people (hey, I just checked
the windows update site for updates, and seems that I'm fully
patched... even though, the exploit was triggered on me).
After exploitation, cj.exe will try to install some browser helper
objects (probably a spyware or something like that)

Just checked on www.virustotal.com and it seems that both files are
quite unknown.

--
# (perl -e "while (1) { print "\x90"; }") | dd of=3D/dev/evil

[psgw@internode.on.net]

If you have the latest Norton Defintions you will not be ale to save the WMF file to your hard drive. It will be detected as being infected with "Bloodhound.Exploit.56"

http://securityresponse.symantec.com...xploit.56.html