Mailing-List: contact vuln-dev-help@securityfocus.com; run by ezmlm
Precedence: bulk
Date: Wed, 8 Aug 2001 14:17:40 -0700
Message-Id: <200108082117.OAA12787@mail8.bigmailbox.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
Mime-Version: 1.0
From: "Red Pantz" <redpantz@crackdealer.com>
To: vuln-dev@securityfocus.com
Subject: Winnt/Win2k Vuln ?

Hello all, 

I have found that if you name a file (can be any data file) a certain URL, on your desktop, and then g0 to IE and type that url, the web site will not come up, only the program that was named the certain.confusing? 

i.e.

- copy autoexec.bat to ..\desktop
- rename autoexec.bat to www.google.com (can be any url)
- then go to IE and type "www.google.com"
- your batch file is then ran

a few issues i have w/ this is:

- the prog will only run if it is on your desktop
- if you type "http://www.google.com", for example
  it will not run(unless u name your file the same thing)
- it has only been tested on Win2k SP1, Winnt 4.0 SP6a w/ IE 5.5
- it doesn't seem to have any privelage escalation (all progs are run as the current user logged on)

Just want a few others to try it and see wut they think

thanx alot
redpantz

------------------------------------------------------------
[- Get your own free e-mail @ http://www.crackdealer.com -]