More WMF exploit testing on Windows 98



I’ve spent some more effort on trying to infect Windows 98 SE in a virtual machine with some of the exploit samples I can find. The first attempt was at a website with the .wmf download. No luck infecting the system there. Then, I’ve loaded up the image and visited kyeu dot info/WMF/ and tried each of the files there. I don’t have a zip handler in my Windows 98 SE image so that didn’t get tested, but I’m getting nowhere here. Gif opens with Explorer and gives a red x to indicate a broken image, the text file opens as a binary file viewed in a text editor, the htm file does the same only in explorer (I see what I’d usually see if I tried to open a binary file in a web browser…) The avi opens with Media Player and complains about it being an incompatible format.


All of these have been scanned by clamav and show up as Exploit.WMF.A – so I’m dealing with the first generation of the exploit (there is detection for Exploit.WMF.B but I’m not sure how effective it is with all the .B variants.)

I can’t seem to find any good examples of a “B” exploit. I guess I could try to load metasploit and see how to generate one? I may give that a try, but this is shaping up to be quite a challenge to actually prove that Windows 98 is vulnerable to what’s going around.

So far, I would say that it’s likely that there is a vulnerability in Windows 98′s gdi32.dll, it may be that there aren’t as many easy avenues to exploit (no shimgvw.dll to work with.) There is a thumbvw.dll, but… the long and short of it is, I’m trying to get Windows 98 SE to fall for the exploit and it’s not happening on my test image.

Related Posts

Blog Traffic Exchange Related Posts
  • OpenOffice.org security update Version 2.0.3 of OpenOffice.org has been released. It includes quite a few bugfixes, including three security related fixes. The security vulnerabilities were apparently found in an internal audit. One of the improvements in 2.0.3 is an integrated update check, to be able to check for available updates directly from within......
  • Linux Permissions Headache Yikes, what an evening..... it started innocently enough in the afternoon. I have an old Mandrake 10.0 server that I was upgrading clamav on (recent security update). While I was at it, I was reviewing the anti-spam setup to see if I could get any better success with filtering junk......
  • Update on the Internet Explorer VML vulnerability Just catching up on the days VML vulnerability news from today.... It looks as though... the exploit is now MUCH more widespread this blog has some video of an infection, what's notable is that the first take was VERY UNEVENTFUL, it was used to stealthily install a keylogger. (So that......
Blog Traffic Exchange Related Websites
  • How to Install Window Boxes Window boxes add charm to any home and they are so easy to install that anyone can do it. You're going to need to get a few things together before you get started. Your tools will include: window box brackets a level that is longer than the window box you......
  • Slow-Motion Effect for Windows Vista Animations For Windows Vista users with Aero Theme, you'll notice a fade-in/fade-out animation when you minimize/maximize a window or when you open/close a window. Since the animation happened so fast and most of the time we just ignore it, there is a trick to slow down that animation whenever you want......
  • Download the Google Chrome OS Virtual Machine Last week, Techcrunch reported rumors of the release of the Google Chrome OS. They stated that the info came from a reliable source, and indeed that source was reliable. Google had an event at their headquarters, and indeed provided new details and a demo of the Chrome OS. The......
www.pdf24.org    Send article as PDF   

Similar Posts


See what happened this day in history from either BBC Wikipedia
Search:
Keywords:
Amazon Logo

2 Responses to “More WMF exploit testing on Windows 98”

  1. The PC Doctor Says:


    Much more on the WMF exploit

    A lot has happened since last night so let me try to bring you up to speed on things.
    First, Ilfak Guilfanov  (the researcher who came up with the unofficial patch) has come out with a WMF vulnerability checker to allow you to test your systems …

  2. The PC Doctor » Blog Archive » WMF exploit - Quick Guide Says:


    [...] Further research seems to show that Windows 98, Windows 98 SE and Windows ME might be harder to infect  than later versions , although they still contain the exploit and may be targeted with greater ferocity soon. [...]


Switch to our mobile site