[8368] in bugtraq
Re: Printer Sharing and M1CR0S0FT Windows98
daemon@ATHENA.MIT.EDU (Ryan Russell)
Tue Nov 3 16:23:43 1998
Date: Fri, 30 Oct 1998 12:22:10 -0800
Reply-To: Ryan Russell <ryanr@SYBASE.COM>
From: Ryan Russell <ryanr@SYBASE.COM>
X-To: "Caskey L. Dickson" <caskey@TECHNOCAGE.COM>
To: BUGTRAQ@NETSPACE.ORG
>This share does not share everything per se. Rather it appears to be
>somehow selective. For example, the password lists (username.pwl) are not
>shared, neither are many of the directories under there. The
>sub-directories that were shared on my system were:
That doesn't match my experience. On my Win95A, Win95B, and Win98
machines, the entire \windows\system directory is shared out
(read-only) hidden files, subdirectories and all. You don't see .pwl
files because they live in c:\windows, not c:\windows\system.
>Simply placing a file in that directory named x.dll isn't sufficient to
>enable it's appearance in the list. The entry must be elsewhere, perhaps
>the registry.
Every one of my files is there.
>Easy way to make a difficult-to-detect trojan, add more files to the share
>list under PRINTER$ then quitely take the files when nobody is looking.
This would be a great place to drop your collected information, if
printer sharing was already on.
BTW, on a this thread, I had a couple of notes back and forth with Paul
Leach,
and he says MS does not consider this a problem, and they won't be changing
it.
They were CC'd to the list.. I don't know why Aleph1 didn't forward them.
I certainly
thought them pertinant.
Ryan
