A forum for reverse engineering, OS internals and malware analysis
gjf wrote:Some additional link from other source :) And of course don't forget about the pioneers.Ran the sample attached to the above post, winsta.exe then ran the Stuxnet Removal tool and grabbed the flagged droppers.
And dropper is attached. BTW exploit is already published. So will wait for more than just an industrial espionage.
Originally Posted by AlexOut of the 4 vulnerabilities it attempted to use, these 2 are sort of hush hush right now - Win32k.sys Vulnerability and the Task Scheduler vulnerability. But someone on here must know, i would have thought ;)
"I just would like to know something more about the 0-day vulnerability of win32k used by Stuxnet"
(When the process does not have Adminstrator rights on the system it will try to attain these privileges by using one of two zero-day escalation of privilege attacks. The attack vector used is based on the operating system of the compromised computer. If the operating system is Windows Vista, Windows 7, or Windows Server 2008 R2 the currently undisclosed Task Scheduler Escalation of Privilege vulnerability is exploited. If the operating system is Windows XP the currently undisclosed win32k.sys escalation of privilege vulnerability is exploited.
If exploited, both of these vulnerabilities result in the main .dll file running as a new process, either within the csrss.exe process in the case of the win32k.sys vulnerability or as a new task with Adminstrator rights in the case of the Task Scheduler vulnerability.
The code to exploit the win32k.sys vulnerability is stored in resource 250. Details of the Win32k.sys Vulnerability and the Task Scheduler vulnerability currently are not released as patches are not yet available.)
http://www.symantec.com/content/en/us/e ... ossier.pdf
Originally Posted by shaheenA couple of things to note !
"I want my USB to be infected"
