Hi!
In the course of a recent penetration test, we came across an Image validation vulnerability in Django when using the Python-Imaging-Library (PIL) which we want to explain in this post.
Everybody who doesn’t know what Django and/or
the PIL is:
Django is a framework to create web applications with Python (comparable to
Rails or Zend). The PIL is a powerful standard python library which provides a
toolset to modify, display and verify images of many different formats.
On Saturday, April 26 Microsoft announced that Internet Explorer version 6 until version 11 is under potential risk against drive-by attacks from malicious websites, regardless of the underlying Microsoft operating system and the associated memory protection features integrated with the operating system. Microsoft has assigned CVE-2014-1776 to this unknown use-after-free vulnerability, which in the worst case could allow remote code execution if a user views a specially crafted website. If an attacker successfully exploits this vulnerability, s/he will gain the same rights and privileges as the current user (once again, activated User Account Control [UAC] helps keeping privileges of the user low).
Continue reading Continue readingHi there,
a few weeks ago I held a talk at UnFUCK, a small University con from students for students. I had decided to give a short talk on “Owning Stuff via USB” aka how to use our TR14 Badge! During the preparations and while building my demos, I tested my new USB RubberDucky. One rather “trivial” demo was actually to use it as a keyboard on an Android phone.
Android has been able to use the
USB OTG features for
quite a while now, where most people enjoy being able to connect a USB stick to
a phone, some others might have already used a keyboard on a tablet. OTG enables
a USB device to play master and hence connect two USB devices to each other. For
this the fifth PIN on a micro USB cable is used (it’s simply pulled down to
ground). To be able to use USB OTG you both need a special cable (micro USB to
female USB A) and a master device with all the necessary drivers. Depending on
the Android device and the client (USB stick/HDD, keyboard) you want to connect
you might need a rooted phone.When trying the RubberDucky on Android for the
first time, I had a S3, a Nexus 4, a Nexus 5 and an SE Xperia Z1. All of these
devices detected the Ducky as a keyboard and I was able to write stuff on the
phone. But I hadn’t aimed at “just typing text”, I wanted to type numbers or
rather PINs –> One can use the external keyboard while unlocking the device.
The Ducky’s user guide contains an example script for bruteforcing PINs on
Android. But how?
Just type!
The below post was originally written on February 9th as a little educational exercise & follow-up to my BinDiff post. (This research was actually triggered by a relative asking about that strange Fritz!Box vulnerability he heard about on the radio). Once we realized the full potential of the bug we decided against publishing the post and contacted several parties instead. Amongst others this contributed to the German BSI press release. Given the cat is out of the bag now anyway, we see no reason to hold it back. We will further take this as an opportunity to lay out our basic vulnerability disclosure principles in a future post. This topic will also be discussed in the panel “Ethics of Security Work & Research” at Troopers
Continue reading Continue readingI recently got in contact with
Intel AMT
for the first time. Surely I had heard about it, knew it was “dangerous”, it was
kind of exploitable and had to be deactivated. But I hadn’t actually seen it
myself. Well, now I have, and I simply love it and you will probably, too (and
don’t forget: love and hate are very very close to each other 😉 )
The following blogpost will be a set of features and instructions on how to own
a device with an unconfigured copy of Intel AMT without using any complicated
hacks or the famous magic!
Hi,
my name is Antonios and I am an independent IT Security Researcher from Greece. One of my latest “hobbies” is IPv6 and its potential insecurities so, please let me talk to you about my latest experience on this.
This week, I had the opportunity to work together with the ERNW guys at their premises. They had built an IPv6 lab that included several commercial IPv6 security devices (firewalls, IDS/IPS and some high-end switches) and they kindly offered their lab to me to play with (thank you guys 🙂 – I always liked …expensive toys). The goal of this co-operation was two-fold: First, to test my new (not yet released) IPv6 pen-testing tool and secondly, to try to find out any IPv6-related security or operational issues on these devices (after all, they all claim that they are “IPv6-Ready”, right?).
Continue reading Continue readingWithin the last months I had some time to work on my code and today I’m releasing some of that: a new version of dizzy as well as two new loki modules.
Download version 0.8.2 here.
Dizzy is able to use neighbor travis’ facedancer to emulate a client device. Two fuzzing modes are available for USB descriptor fuzzing and USB endpoint fuzzing.
Here is an example cmd to start usb configuration descriptor fuzzing:
Continue reading Continue readingThis is a guest post from Jose Miguel Esparza (@EternalTodo)
There are already some good blog posts talking about this exploit, but I think this is a really good example to show how peepdf works and what you can learn if you attend the workshop “Squeezing Exploit Kits and PDF Exploits” at Troopers14. The mentioned exploit was using the Adobe Reader ToolButton Use-After-Free vulnerability to execute code in the victim’s machine and then the Windows privilege escalation 0day to bypass the Adobe sandbox and execute a new payload without restrictions.
Continue reading Continue readingWe just got credits for a flaw we found in SAP Netweaver. The issue is a reflected Cross-Site Scripting (XSS). It can be triggered in the administrative interface for the Internet Communication Manager (ICM) and Web Dispatcher. This means that the targets for this XSS will definitely be users with administrative privileges. This makes it especially juicy for an attacker.
SAP rated the vulnerability with CVSS and a Base Score of 4.3 having a Base
Vector of AV:N/AC:M/AU:N/C:N/I:P/A:N. Which again opens the discussion on how
to rate the impact of XSS by using CVSS. CVSS
states that XSS
“should be scored with no impact to confidentiality or availability, and
partial impact to integrity“, which is clearly arguable. Especially when
thinking of the impact on confidentiality. As you might know by now, we tried to
tackle the problem of rating vulnerabilities ourselves with the
ERNW Rapid Rating System
(ERRS) and it was not an easy task. 😉 However, SAP states that this is a
correction with high priority, so you should apply the patches as soon as
possible.
In the course of our virtualization research, we came across a certain technical issue we couldn’t find an easy solution on knowledge bases and the like. However, as we found the question several times on the web, the following post gives just a short hint on a technical detail.
If you want to connect two virtual machines in VMware Fusion using a serial port (e.g. for debugging purposes), Fusion doesn’t provide you an GUI option to configure that. However, if you just add the following config to the debugger system’s VMX file:
Continue reading Continue reading