«
Expand/Collapse
1349 items tagged "code"
Related tags:
day [+],
zero [+],
realplayer [+],
wordpress [+],
shockwave [+],
reader [+],
cms [+],
black hat [+],
ajax [+],
vulnerability [+],
webcalendar [+],
vulnerabilities [+],
symantec [+],
php code [+],
php [+],
freepbx [+],
adobe shockwave player [+],
safer use [+],
web [+],
hacks [+],
drupal [+],
apple safari [+],
apple quicktime player [+],
apache [+],
zdi [+],
xss [+],
service [+],
rich lundeen [+],
proficy [+],
pcanywhere [+],
novell [+],
mozilla [+],
minimal architecture [+],
jesse ou [+],
indiana jones 4 [+],
indiana [+],
gadget [+],
framework [+],
firefox [+],
file upload [+],
file [+],
edge cases [+],
cve [+],
cpu architectures [+],
adobe reader [+],
execution [+],
zingiri [+],
zero day [+],
zenphoto [+],
www data [+],
wikkawiki [+],
webkit [+],
vmx [+],
vmware [+],
version 6 [+],
version [+],
vbseo [+],
usa [+],
typo [+],
syntax [+],
symantec pcanywhere [+],
svg [+],
struts [+],
stack buffer [+],
source [+],
slides [+],
samba [+],
root privilege [+],
root code [+],
quest [+],
proof of concept [+],
privilege escalation vulnerability [+],
pre [+],
pmwiki [+],
password disclosure [+],
packet size [+],
packet [+],
owncloud [+],
overflow code [+],
op code [+],
mysqldumper [+],
minicms [+],
microsoft windows media player [+],
microsoft windows media [+],
metasploit [+],
meta files [+],
mathias payer [+],
management [+],
linux platforms [+],
lifestyle management [+],
libavcodec [+],
kernel code [+],
java code execution [+],
intrust [+],
instrumentation [+],
injection [+],
inclusion [+],
impresspages [+],
hostbill [+],
host kernel [+],
freewebshop [+],
format string attacks [+],
format string attack [+],
finder [+],
file deletion [+],
ffmpeg [+],
emc [+],
elastic [+],
editwrx [+],
directory traversal [+],
default extensions [+],
callmenum [+],
bugtraq [+],
buffer overflow vulnerability [+],
browser [+],
autostart [+],
attacker [+],
attack [+],
active x control [+],
abu dhabi [+],
zenworks [+],
x. user [+],
writing secure code [+],
windows multimedia [+],
webstudio [+],
ubuntu [+],
ubercart [+],
trigerring [+],
travis rhodes [+],
system constraints [+],
system [+],
size parameter [+],
sim [+],
shockwave 3d [+],
shellcode [+],
security [+],
search [+],
rex [+],
real time system [+],
ralf philipp [+],
quicktime pict [+],
qr code [+],
player [+],
pict [+],
php files [+],
ofbiz [+],
obfuscated [+],
novell zenworks [+],
nis accounts [+],
nis [+],
network information service [+],
multimedia library [+],
monitoring tool [+],
module versions [+],
midi [+],
merethis [+],
mcafee [+],
manager [+],
linux [+],
java code [+],
integer overflow [+],
indusoft [+],
ida pro [+],
guillaume delugr [+],
gnu c library [+],
gchq [+],
g usb [+],
files search [+],
element code [+],
easy [+],
decompression code [+],
control [+],
chris eagle [+],
centreon [+],
c library [+],
bmp files [+],
based buffer overflow [+],
baseband [+],
auditing [+],
audio [+],
attacking [+],
arbitrary commands [+],
apple webkit [+],
arbitrary code [+],
apple quicktime [+],
x cve [+],
witness systems [+],
win32 code [+],
william kimball [+],
web companion [+],
virus trojan [+],
using open source tools [+],
uses [+],
use [+],
unauthenticated [+],
trun [+],
trojan [+],
toy [+],
thadd [+],
text parameter [+],
stts [+],
stsz [+],
stss [+],
stsc [+],
stream [+],
stephen [+],
station [+],
spooks [+],
space station [+],
source code [+],
shockwave director [+],
server manager [+],
server [+],
secure [+],
script injection [+],
science [+],
russ cox [+],
russ [+],
riff [+],
rgba [+],
rfid [+],
reporter engine [+],
replacement string [+],
rendering [+],
realnetworks realplayer [+],
real networks [+],
real [+],
read [+],
rdp [+],
quicktime player [+],
quicktime media [+],
quicktime apple [+],
qart [+],
puzzle [+],
proftpd [+],
proficy historian [+],
professional source [+],
professional [+],
port 5631 [+],
poc [+],
pnpixpat [+],
physical tokens [+],
php 5 [+],
pat on the back [+],
password properties [+],
open source tools [+],
open [+],
old [+],
office [+],
novell groupwise [+],
night dragon [+],
networks [+],
network [+],
neel mehta [+],
neel [+],
nasa [+],
mp4v [+],
mozilla firefox [+],
mom and dad [+],
module [+],
misc [+],
microsoft office 2007 [+],
microsoft [+],
microcontrollers [+],
micro control [+],
mi6 [+],
method [+],
mehta [+],
media [+],
matrix [+],
mark dowd [+],
manager remote [+],
manager casprocessor [+],
malware [+],
magical qualities [+],
mac os x [+],
logging code [+],
log [+],
line follower [+],
license server [+],
libtiff [+],
leaks [+],
laptop [+],
keeping christmas [+],
jtag [+],
jpeg [+],
java web start [+],
ir emitter [+],
internet explorer [+],
internet [+],
interested parties [+],
integration [+],
icc [+],
holiday [+],
historian [+],
hexbug [+],
header code [+],
hardware platform [+],
groupwise [+],
googler [+],
google [+],
glsa [+],
generic answer [+],
found [+],
flc delta [+],
flc [+],
flashpix [+],
explorer [+],
exploits [+],
exploit [+],
eric detoisien [+],
eric [+],
equality [+],
edgesight [+],
double quotes [+],
dotan [+],
dongle [+],
dom tree [+],
dodgy code [+],
director file [+],
digital [+],
desktop protocol [+],
design flaw [+],
default locations [+],
decompression [+],
davis [+],
darknet [+],
dad [+],
d tiff resource [+],
d pict [+],
d pcx [+],
d iff [+],
d bmp [+],
critical windows [+],
crash [+],
conversion code [+],
contenteditable [+],
concept [+],
companion [+],
collab [+],
coldfusion [+],
code integration [+],
code breaking [+],
code breaker [+],
citrix [+],
christmas [+],
challenges [+],
challenge [+],
cf research [+],
cellphones [+],
buffer overflow [+],
breaker [+],
bmp image [+],
aurora [+],
audio playback [+],
audio codec [+],
atrc [+],
atom [+],
asia [+],
arun lakhotia [+],
application modules [+],
apple mac os x [+],
apple mac os [+],
apple lossless [+],
apple colorsync [+],
android [+],
analysis [+],
alex wheeler [+],
aka ms [+],
adversarial [+],
advanced [+],
Hardware [+],
ExploitsVulnerabilities [+],
code execution [+],
adobe [+],
oracle [+],
arbitrary code execution [+],
realnetworks [+],
cross site scripting [+],
remote [+],
oracle java [+],
chaos communication congress [+],
java [+],
zeus,
zend,
zach hoffmann,
youtube,
xul,
xpdf,
xosoft,
xbox homebrew,
xbox,
x86 linux,
x86,
x32,
x prior,
x internet,
x imageio,
x control,
x compact,
wxf,
wwii,
wrong context,
wrf file,
word value,
word,
windows version,
windows machines,
winamp versions,
winamp,
widgets,
widget online,
widget,
wholetext,
whitepaper,
whitelist,
when performing arithmetic,
wep wpa,
webscan,
webmanager pro,
webmanager,
webex player,
webcore,
webapps,
webadmin,
web worker,
web based,
web application security,
way,
vulnerable version,
vulnerability sun,
vtiger crm,
vtiger,
vmware products,
visual,
viscom,
virtualization,
video file,
video emulation,
video,
victim machine,
viable options,
vhdl,
vgx,
variable length fields,
value pairs,
value,
valid pointer,
vadim okun,
username parameter,
username field,
user,
uri uninitialized,
uploadservlet,
upload image,
update,
unspecified,
unsigned code,
unixasm,
university of liege,
uninitialized pointer,
unhackable,
ufo alien invasion,
ufo,
typer,
tyler,
txt,
tucker taft,
trust issue,
trojan source,
trojan code,
trendmicro,
trend micro internet security,
transmitter,
trainer,
toolbar,
tool,
tomcat server,
today,
tivoli storage manager,
tivoli,
tinymce,
tiny,
timthumb,
tiff image,
thunderbird,
theory,
text segment,
text elements,
text element,
text containers,
tetris game,
tetris,
tetex,
termination code,
temp directory,
ted mielczarek,
technical improvements,
teaming,
tcpdf,
tcp ports,
tcp port,
tcexam,
target system,
target method,
target machine,
target code,
target,
tar gz,
tar,
talk,
tag removal,
tabular data control,
system web,
system privileges,
system compromise,
symantec products,
switch input,
swekey,
super,
sun microsystems,
sun jvm,
sun jre,
sun java runtime environment,
sun java runtime,
sun,
summer,
sum,
suffers,
sudo,
style menu,
style,
study,
structure,
string code,
string,
storage,
stiegg,
stephen a. ridley tags,
stefan esser,
steam,
static code analysis,
static code,
static analysis tool,
static analysis,
static,
startup,
stack overflow,
stack frame,
srcelement,
src parameter,
sql server database,
sql injection,
sql,
spyware,
spoofers,
spoofer,
spoof version,
spin,
spidertrap spider,
spider robot,
speedy,
source code viewer,
source code analyzer,
sound libraries,
sort code,
sorenson video codec,
sorenson,
sophisticated attacker,
soliddb,
solaris x86,
solaris code,
solaris,
software protection,
social engineer,
soap request,
snow leopard,
smtp rcpt,
slaed cms,
slaed,
sized families,
size values,
size parameters,
size,
siz,
sip,
single board,
shopping cart,
shockwave user,
shockwave player,
shell code,
shell,
shelf programs,
setup,
setoutertext,
session,
servos,
service vulnerability,
server mod,
server code,
server client,
server authentication,
sequence description,
sensitive system,
selector,
selection range,
selection,
segment,
security risks,
security professionals,
security notice,
security mechanisms,
security event,
security assessment,
security agent,
secure desktop,
secubt,
sdk,
scroll,
scott harden,
scott,
sate,
sapone,
sap,
sanity checks,
sanity check,
sandbox,
safari,
saas,
s system,
s child,
runtime environments,
run,
ruby,
rtl,
rrule,
rpc protocol,
rpc,
rough version,
rop,
rootkits,
rootkit,
root certificate,
root,
rogue server,
roberto suggi,
rle,
rgboard,
review,
resistors,
request username,
request status,
request code,
reporter. authentication,
reporter agent,
replication manager,
replication,
remote exploit,
reference,
rec,
realplayer user,
realplayer application,
reading,
react,
rcsl,
rational,
rapidshare,
random code,
radio operators,
radio band,
radio,
quot,
quicktime panorama,
questionaire,
query engine,
quality manager,
qr code generator,
puzzle box,
pumping station,
protocol handlers,
protocol format,
prosieben,
proper authentication,
promotic,
project,
progressive mesh,
programmer,
profile sequence,
product catalogue,
processinstruction,
process,
pro versions,
privilege elevation,
presentation,
pragyan,
practical,
powerpoint,
potential security vulnerability,
post mortem,
post,
port 515,
port 143,
polygon objects,
pointless website,
pointer,
plugin version,
plugin api,
plugin,
pls,
please,
player skins,
pinpoint,
pictureheader,
phpscheduleit,
phpmyfaq,
phpmyadmin,
phpldapadmin,
php vulnerability,
php barcode,
photoshop,
peter silberman,
perrotta,
peripherals,
pcvue,
passwords,
password,
party software components,
participant organizations,
parsing,
parent node,
parameter,
paper,
paola perrotta,
panorama,
packet data,
packet count,
packard,
overflow vulnerability,
overflow,
osx,
ordinal,
order,
oracle user,
oracle database 11g,
option element,
operation,
opera web browser,
opera,
openview,
opentext,
openjdk,
openedit,
opendchub,
open source tool,
open source project,
open source,
opcode,
online,
onefilecms,
omnivista,
ogv,
officeartblip,
office excel,
object pointer,
object index,
obfuscation,
nut shell,
numberoftiles,
null pointers,
null pointer,
null character,
null byte,
novell zenworks asset management,
novell netware version,
novell netware 6,
novell netware,
novell iprint,
novell groupwise internet agent,
node,
news,
new,
networker module,
networker,
network node manager,
netware,
netsaro,
netcat,
net,
nbsp nbsp nbsp nbsp nbsp,
nbsp,
naviguer sur internet,
navigator plugins,
natty,
nail clipper,
n webadmin,
mystery,
mycioscn,
myasutil,
musical,
music generation,
music,
multiplication operation,
multiple,
msp,
mp4 files,
moving,
movie,
motion,
morse code trainer,
morse code,
morse,
mops,
modification,
modem string,
mod,
mitigation technologies,
mit kerberos,
millennium series,
midi streams,
midi stream,
midi parser,
midi file,
microsys,
microsoft source code,
microsoft powerpoint,
microsoft office xp,
microsoft office word,
microsoft office powerpoint,
microsoft excel 2002,
microsoft excel,
microsoft corp,
microcontroller,
michael wu,
mic,
metaprogramming,
metagoofil,
meta characters,
meta,
messenger server,
meshcms,
mercury loadrunner,
menu asp,
mencoder,
memory technique,
memory segment,
memory registers,
memory region,
memory corruption,
memory copy,
memory allocation,
memory address,
memory,
megaupload,
media application,
mdvsa,
md5 sum,
maynor,
maximum reliability,
matthew de carteret,
matt conover,
matias,
martijn wargers,
mark,
manual security,
mandriva linux,
mandatory access control,
manager. user,
manager. authentication,
manager. affected,
manager nnmrptconfig,
manager fastback,
manager client,
manager agent,
management code,
malicious website,
malicious script,
malicious attacker,
malaysia,
mail messages,
mail gateway,
magnetproc,
magneto,
madou,
mac os,
mac,
lzw decompression,
lucent,
lst,
love,
lotus domino server,
lotus domino,
lotus,
lost keys,
loop iterations,
loop,
lookup code,
lookup,
logo,
login,
logical screen,
linuxshield,
linux security,
linux loader,
linux kernel tree,
linux box,
link,
lilhttp,
libxslt,
library user,
library code,
library,
libfontparser,
letter style,
legend,
leaked,
layout grid,
layout engine,
layout code,
lavc,
launchpad,
krb5,
korek,
knowledge,
kills,
keyboard,
key,
kernel mode,
kernel drivers,
kernel,
ken,
kdc,
jpeg decoder,
jordi chancel,
joomla,
johnny carlo,
job application,
jesse ruderman,
jeff walden,
jcow,
javascript engine,
javascript array,
javascript,
java virtual machine,
java sandbox,
java runtime environment,
java plugin,
jakcms,
jacob west,
j integra,
iscanner,
ipwraw,
ipswitch,
iprint,
invalid values,
invalid pointer,
invalid parameters,
invalid address,
intrusion prevention system,
intrusion,
internet explorer user,
internet explorer code,
interface code,
interface,
integra 2,
integer,
instance,
insider,
insertion code,
input file,
injection bug,
informix dynamic server,
informix,
inefficient code,
index style,
index code,
incident response,
imap services,
imap server,
imap,
imanager,
imailsrv,
imail,
imageshack,
imagemap code,
imageio,
image processing library,
igor bukanov,
ignition,
idefense security advisory,
idefense,
icq,
ibm,
ian beer,
hxxp,
httpd web server,
html tables,
html element,
html component,
html,
hp openview nnm,
hp openview network node manager,
hp openview,
hp network,
hp mercury,
howtos,
how to follow directions,
how to,
hooking,
hook code,
hips,
henry sivonen,
helpme,
help system,
helix server,
helix,
helena,
heap memory,
heap corruption,
heap allocation,
heap,
header type,
harvester,
handhelds,
hackers,
hacker,
hack in the box,
h 264,
h 263,
gwia,
guide,
gui techniques,
gui,
ground truth,
grimwepa,
graphical user interface,
graham,
good time,
gold version,
gold,
glyphs,
global color table,
gif,
ghostscript,
ghost in the shell,
george,
genl,
generic methods,
generator,
gary kwong,
gadu gadu,
gadu,
functional reference,
function pointers,
function,
freetype,
free reference,
free pointer,
free open source,
frame dimensions,
fpx,
fpga,
fourcc value,
format strings,
format specifiers,
format specifier,
form asp,
forgery,
forensics,
font resources,
font format,
font,
fob,
flv file format,
flv,
flaw,
flag field,
first class client,
first,
file corruption,
fichier host,
feh,
faulty memory,
faulty logic,
faulty code,
fastest,
fastback,
family ties,
extsetowner,
extra step,
exposition,
exploitation,
exe code,
exe,
exception handling,
excel user,
excel spreadsheet,
excel,
evolution,
evilqr,
evasion and escape,
ettercap,
esignal,
error,
english,
engineering,
engine,
enabled,
emulation based,
embrace,
elst,
elevation,
element,
efficiency,
eeprom,
editor php,
editable,
dynamic memory,
dynamic binary translation,
dsa,
driver ghostscript,
driven product,
dport,
doug jackson,
dotnetnuke,
don,
domino server,
domino,
dom prototype,
dom nodes,
dom node,
dom,
dolphin,
document table,
document position,
document,
dll module,
dll file,
dll,
directory service manager,
directory code,
directory,
director riff,
director movie files,
dino dai zovi,
dimensional vector,
didn,
dhclient,
development,
dev boards,
destination buffer,
deslock,
desktop,
denial of service,
default installation,
decompression routines,
decoder,
debutant,
debounce,
ddms,
dcc protocol,
david maynor,
databound,
database code,
database,
data validation,
data protector,
dangling pointer,
daily basis,
d. a,
cyber,
cw keys,
current user,
cs5,
crystal reports,
crystal powered,
crystal,
crm,
critical structures,
crimeware,
cracking the code,
cracking,
cracked,
crack,
coverage data,
coverage,
corruption issues,
corruption,
core,
copy operations,
cool links,
cookies,
cookie values,
cookie value,
conversion issue,
controller,
control replication,
control activex,
context,
content ,
confirms,
configuration interface,
concrete,
computer associates,
commenters,
command logo,
command line arguments,
command line argument,
comma separated values,
com,
color profiles,
codecrawler,
code tools,
code theory,
code puzzle,
code path,
code fragments,
code coverage,
code checks,
code breakers,
code authors,
code attempts,
clock displays,
clock,
client config,
client,
classic,
clamps,
clamav,
cktricky,
cisco webex,
cisco warns,
cisco unified,
cisco security,
cisco secure,
cisco products,
cisco icm,
cisco,
circulated,
cid,
chunk size,
chunk,
christian holler,
chris evans,
chop chop,
chips,
china,
child index,
chewing gum,
charlie miller,
charlie,
cgi,
center tags,
canon powershot,
can bite,
cameras,
camera,
ca xosoft,
ca arcserve,
c. above,
bytecode,
byte value,
byte code,
buzzle,
button,
bug,
buffer overflows,
buffer,
bt4,
broken,
bridge results,
bridge,
brian,
breadboard,
boston,
boris zbarsky,
body element,
bob clary,
board,
bluetooth,
blink,
blackberry,
black ice,
bit,
bind request,
binary translator,
binary,
beta group,
ben nagy,
ben cohen,
bells and whistles,
beeper,
bbs,
bbcode,
based intrusion prevention,
based intrusion detection,
barcode,
backwpup,
background job,
avr isp,
avr,
avira antivir,
avi parsing,
avi file,
avi,
autovue,
automation,
author,
authentication,
audit trail,
audio streams,
attributes,
attribute,
attackers,
asp sql,
asp authentication,
aslr,
array index,
array data,
array,
arp poisoning,
arithmetic operations,
arithmetic operation,
argument,
arduino,
arcserve,
arbitrary objects,
arbitrary,
apps,
application web,
application crash,
application,
applet,
apple security,
apple preview,
apple os x,
apple os,
apple iphone,
apple imageio,
apple clamps,
apple,
app,
apache httpd,
anyone,
and,
analysis platform,
alternative,
alpha tabbed,
alpha,
allocator,
alice,
alguest,
algorithms,
alexander sotirov,
alert management,
alert,
alcatel lucent,
airodump,
aircrack,
aidicms,
agnitio,
agent software,
agent,
advisory,
advanced audio coding,
adrian,
adobe photoshop elements,
adobe flash player,
adobe download manager,
adobe director,
adobe acrobat reader,
admin code,
admin,
address book,
adan,
adam meyers,
adam,
activex version,
activex control,
activex code,
activex,
ace,
access control,
access,
abram,
abraham,
abel,
abdullah,
aac files,
aac file,
Wireless,
Videos,
Tutoriaux,
Tutoriales,
Tools,
Support,
Software,
Programming,
Pentesting,
Newbie,
HackIt,
Guias,
General,
Fixes,
Espace,
Countermeasures,
Community,
Bugs,
BackTrack,
Area,
1b channel
Skip to page:
1
2
3
...
6
-
-
18:37
»
Packet Storm Security Recent Files
This Metasploit module exploits an arbitrary code injection vulnerability in the chat module that is part of Active Collab by abusing a preg_replace() using the /e modifier and its replacement string using double quotes. The vulnerable function can be found in activecollab/application/modules/chat/functions/html_to_text.php.
-
7:58
»
Packet Storm Security Exploits
This Metasploit module abuses the SVG support to execute Java Code in the Squiggle Browser included in the Batik framework 1.7 through a crafted svg file referencing a jar file. In order to gain arbitrary code execution, the browser must meet the following conditions: (1) It must support at least SVG version 1.1 or newer, (2) It must support Java code and (3) The "Enforce secure scripting" check must be disabled. The module has been tested against Windows and Linux platforms.
-
7:58
»
Packet Storm Security Recent Files
This Metasploit module abuses the SVG support to execute Java Code in the Squiggle Browser included in the Batik framework 1.7 through a crafted svg file referencing a jar file. In order to gain arbitrary code execution, the browser must meet the following conditions: (1) It must support at least SVG version 1.1 or newer, (2) It must support Java code and (3) The "Enforce secure scripting" check must be disabled. The module has been tested against Windows and Linux platforms.
-
7:58
»
Packet Storm Security Misc. Files
This Metasploit module abuses the SVG support to execute Java Code in the Squiggle Browser included in the Batik framework 1.7 through a crafted svg file referencing a jar file. In order to gain arbitrary code execution, the browser must meet the following conditions: (1) It must support at least SVG version 1.1 or newer, (2) It must support Java code and (3) The "Enforce secure scripting" check must be disabled. The module has been tested against Windows and Linux platforms.
-
-
21:28
»
SecDocs
Tags:
hacking Event:
Chaos Communication Congress 27th (27C3) 2010 Abstract: We demonstrate that automated, architecture-independent gadget search is possible. Gadgets are code fragments which can be used to build unintended programs from existing code in memory. Our contribution is a framework of algorithms capable of locating a Turing-complete gadget set. Translating machine code into an intermediate language allows our framework to be used for many different CPU architectures with minimal architecture-dependent adjustments. We define the paradigm of free-branch instructions to succinctly capture which gadgets will be found by our framework and investigate side effects of the gadgets produced. Furthermore we discuss architectural idiosyncrasies for several widely spread CPU architectures and how they need to be taken into account by the generic algorithms when locating gadgets.
-
21:28
»
SecDocs
Tags:
hacking Event:
Chaos Communication Congress 27th (27C3) 2010 Abstract: We demonstrate that automated, architecture-independent gadget search is possible. Gadgets are code fragments which can be used to build unintended programs from existing code in memory. Our contribution is a framework of algorithms capable of locating a Turing-complete gadget set. Translating machine code into an intermediate language allows our framework to be used for many different CPU architectures with minimal architecture-dependent adjustments. We define the paradigm of free-branch instructions to succinctly capture which gadgets will be found by our framework and investigate side effects of the gadgets produced. Furthermore we discuss architectural idiosyncrasies for several widely spread CPU architectures and how they need to be taken into account by the generic algorithms when locating gadgets.
-
21:28
»
SecDocs
Tags:
hacking Event:
Chaos Communication Congress 27th (27C3) 2010 Abstract: We demonstrate that automated, architecture-independent gadget search is possible. Gadgets are code fragments which can be used to build unintended programs from existing code in memory. Our contribution is a framework of algorithms capable of locating a Turing-complete gadget set. Translating machine code into an intermediate language allows our framework to be used for many different CPU architectures with minimal architecture-dependent adjustments. We define the paradigm of free-branch instructions to succinctly capture which gadgets will be found by our framework and investigate side effects of the gadgets produced. Furthermore we discuss architectural idiosyncrasies for several widely spread CPU architectures and how they need to be taken into account by the generic algorithms when locating gadgets.
-
-
21:36
»
SecDocs
Tags:
hacking Event:
Chaos Communication Congress 27th (27C3) 2010 Abstract: We demonstrate that automated, architecture-independent gadget search is possible. Gadgets are code fragments which can be used to build unintended programs from existing code in memory. Our contribution is a framework of algorithms capable of locating a Turing-complete gadget set. Translating machine code into an intermediate language allows our framework to be used for many different CPU architectures with minimal architecture-dependent adjustments. We define the paradigm of free-branch instructions to succinctly capture which gadgets will be found by our framework and investigate side effects of the gadgets produced. Furthermore we discuss architectural idiosyncrasies for several widely spread CPU architectures and how they need to be taken into account by the generic algorithms when locating gadgets.
-
18:39
»
Packet Storm Security Exploits
The vulnerability described in this document could hypothetically be exploited by unprivileged code running in a VMware virtual machine (guest) in order to execute code in the host VMX process, thereby breaking out of the virtual machine; however, such exploitation has not been proven. In the event that arbitrary code execution in the VMX process is possible, kernel privileges can be obtained on a Windows host by abusing the VMX process's special access to a VMware driver, meaning the maximum possible impact of this vulnerability is elevation from unprivileged guest code execution to host kernel code execution.
-
18:39
»
Packet Storm Security Recent Files
The vulnerability described in this document could hypothetically be exploited by unprivileged code running in a VMware virtual machine (guest) in order to execute code in the host VMX process, thereby breaking out of the virtual machine; however, such exploitation has not been proven. In the event that arbitrary code execution in the VMX process is possible, kernel privileges can be obtained on a Windows host by abusing the VMX process's special access to a VMware driver, meaning the maximum possible impact of this vulnerability is elevation from unprivileged guest code execution to host kernel code execution.
-
18:39
»
Packet Storm Security Misc. Files
The vulnerability described in this document could hypothetically be exploited by unprivileged code running in a VMware virtual machine (guest) in order to execute code in the host VMX process, thereby breaking out of the virtual machine; however, such exploitation has not been proven. In the event that arbitrary code execution in the VMX process is possible, kernel privileges can be obtained on a Windows host by abusing the VMX process's special access to a VMware driver, meaning the maximum possible impact of this vulnerability is elevation from unprivileged guest code execution to host kernel code execution.
-
-
19:11
»
Packet Storm Security Misc. Files
Symantec pcAnywhere versions 12.5 and below are vulnerable to a remote code execution vulnerability. A flaw exists in the authentication component listening on TCP port 5631 which does not sufficiently validate user-submitted data.
-
6:59
»
Packet Storm Security Exploits
This Metasploit modules exploits a vulnerability found in WebCalendar versions 1.2.4 and below. If not removed, the settings.php script meant for installation can be updated by an attacker with injected code. This allows arbitrary code execution as www-data.
-
6:59
»
Packet Storm Security Recent Files
This Metasploit modules exploits a vulnerability found in WebCalendar versions 1.2.4 and below. If not removed, the settings.php script meant for installation can be updated by an attacker with injected code. This allows arbitrary code execution as www-data.
-
6:59
»
Packet Storm Security Misc. Files
This Metasploit modules exploits a vulnerability found in WebCalendar versions 1.2.4 and below. If not removed, the settings.php script meant for installation can be updated by an attacker with injected code. This allows arbitrary code execution as www-data.
-
-
16:56
»
Packet Storm Security Exploits
MySQLDumper version 1.24.4 suffers from code execution, cross site request forgery, cross site scripting, local file inclusion, and directory traversal vulnerabilities.
-
16:56
»
Packet Storm Security Recent Files
MySQLDumper version 1.24.4 suffers from code execution, cross site request forgery, cross site scripting, local file inclusion, and directory traversal vulnerabilities.
-
16:56
»
Packet Storm Security Misc. Files
MySQLDumper version 1.24.4 suffers from code execution, cross site request forgery, cross site scripting, local file inclusion, and directory traversal vulnerabilities.
-
-
21:51
»
SecDocs
Authors:
Mathias Payer Tags:
exploiting Event:
Chaos Communication Congress 27th (27C3) 2010 Abstract: Unsafe languages and an arms race for new bugs calls for an additional line of defense in software systems. User-space virtualization uses dynamic instrumentation to detect different attack vectors and protects from the execution of malicious code. An additional advantage of these virtualization systems is that they can be used to analyze different exploits step by step and to extract the exploit code from a running program. This talk explains the concept of different attack vectors (stack buffer overflows, format string attacks, return to libc attacks, race attacks / TOCTTOU, integer overflows, heap buffer overflows, and code anomalies). For each of these attack vectors we show possible exploits and explain how the virtualization system is able to detect and prevent the exploit. User-space virtualization uses a binary translation framework to instrument all running code. The instrumentation works like an additional virtualization layer and makes it possible to observe any changes to the runtime datastructures (code and data) of a running program. We use fastBT to instrument and analyze different exploitable programs. The added instrumentation detects changes in runtime layout and stops the program whenever exploit code is about to be executed. This talk presents different classes of exploits that can be observed in a dynamic instrumentation system. The exploits are analyzed and different security strategies are discussed. We then show how the instrumentation framework can implement an online protection mechanism against each class of attack vectors. Observable Attack Vectors Stack Overflow A limited buffer is (over) flown with user-data and over writes data on the stack (e.g., the return instruction pointer). Format String Attack An attack can write to an arbitrary address (e.g., the return instruction pointer or the address of a library function) if unvalidated user input is passed directly to the printf function. Return to libc Attack This attack prepares multiple stack frames that execute code sequences in libraries. The stack frame can be constructed so that (almost) arbitrary code is executed. Race Attacks / TOCTTOU Time-of-check-to-time-of-use race conditions exploit the fact that they can change values on the stack after they are checked but before they are used in the program or kernel. Integer Overflow Overflows can be triggered by using a negative integer value instead of an unsigned value. Heap Overflow A heap buffer overflow is used to overwrite function pointers or data from the memory allocator to trigger execution of arbitrary code. Code Anomalies x86_64 code is backward compatible to ia32 and in modern operating systems x86_64 and ia32 code can be mixed. The mix of different system calls makes it possible to break out of sand boxes that are not aware of all possible combinations of system calls. The exploits are detected generally whenever the program branches to the injected code or to the constructed code fragments. The program is interrupted and a debugger can be attached to analyze the state of the program. TOCTTOU attacks can be detected by observing the threads and using a specific system call architecture. Conclusion Dynamic instrumentation is an important tool to prohibit, detect, and analyze different attack vectors to running programs. Additional instrumentation guards can be used to better understand exploits. The additional layer of virtualization implemented through dynamic instrumentation can be used to detect and log bugs and is an additional line of defense against new exploits. Related Work A detailed discussion of related work is in the paper. These references here are for informational purposes only (to show how this talk was inspired) and not complete.
-
-
21:50
»
SecDocs
Authors:
Mathias Payer Tags:
exploiting Event:
Chaos Communication Congress 27th (27C3) 2010 Abstract: Unsafe languages and an arms race for new bugs calls for an additional line of defense in software systems. User-space virtualization uses dynamic instrumentation to detect different attack vectors and protects from the execution of malicious code. An additional advantage of these virtualization systems is that they can be used to analyze different exploits step by step and to extract the exploit code from a running program. This talk explains the concept of different attack vectors (stack buffer overflows, format string attacks, return to libc attacks, race attacks / TOCTTOU, integer overflows, heap buffer overflows, and code anomalies). For each of these attack vectors we show possible exploits and explain how the virtualization system is able to detect and prevent the exploit. User-space virtualization uses a binary translation framework to instrument all running code. The instrumentation works like an additional virtualization layer and makes it possible to observe any changes to the runtime datastructures (code and data) of a running program. We use fastBT to instrument and analyze different exploitable programs. The added instrumentation detects changes in runtime layout and stops the program whenever exploit code is about to be executed. This talk presents different classes of exploits that can be observed in a dynamic instrumentation system. The exploits are analyzed and different security strategies are discussed. We then show how the instrumentation framework can implement an online protection mechanism against each class of attack vectors. Observable Attack Vectors Stack Overflow A limited buffer is (over) flown with user-data and over writes data on the stack (e.g., the return instruction pointer). Format String Attack An attack can write to an arbitrary address (e.g., the return instruction pointer or the address of a library function) if unvalidated user input is passed directly to the printf function. Return to libc Attack This attack prepares multiple stack frames that execute code sequences in libraries. The stack frame can be constructed so that (almost) arbitrary code is executed. Race Attacks / TOCTTOU Time-of-check-to-time-of-use race conditions exploit the fact that they can change values on the stack after they are checked but before they are used in the program or kernel. Integer Overflow Overflows can be triggered by using a negative integer value instead of an unsigned value. Heap Overflow A heap buffer overflow is used to overwrite function pointers or data from the memory allocator to trigger execution of arbitrary code. Code Anomalies x86_64 code is backward compatible to ia32 and in modern operating systems x86_64 and ia32 code can be mixed. The mix of different system calls makes it possible to break out of sand boxes that are not aware of all possible combinations of system calls. The exploits are detected generally whenever the program branches to the injected code or to the constructed code fragments. The program is interrupted and a debugger can be attached to analyze the state of the program. TOCTTOU attacks can be detected by observing the threads and using a specific system call architecture. Conclusion Dynamic instrumentation is an important tool to prohibit, detect, and analyze different attack vectors to running programs. Additional instrumentation guards can be used to better understand exploits. The additional layer of virtualization implemented through dynamic instrumentation can be used to detect and log bugs and is an additional line of defense against new exploits. Related Work A detailed discussion of related work is in the paper. These references here are for informational purposes only (to show how this talk was inspired) and not complete.
-
21:50
»
SecDocs
Authors:
Mathias Payer Tags:
exploiting Event:
Chaos Communication Congress 27th (27C3) 2010 Abstract: Unsafe languages and an arms race for new bugs calls for an additional line of defense in software systems. User-space virtualization uses dynamic instrumentation to detect different attack vectors and protects from the execution of malicious code. An additional advantage of these virtualization systems is that they can be used to analyze different exploits step by step and to extract the exploit code from a running program. This talk explains the concept of different attack vectors (stack buffer overflows, format string attacks, return to libc attacks, race attacks / TOCTTOU, integer overflows, heap buffer overflows, and code anomalies). For each of these attack vectors we show possible exploits and explain how the virtualization system is able to detect and prevent the exploit. User-space virtualization uses a binary translation framework to instrument all running code. The instrumentation works like an additional virtualization layer and makes it possible to observe any changes to the runtime datastructures (code and data) of a running program. We use fastBT to instrument and analyze different exploitable programs. The added instrumentation detects changes in runtime layout and stops the program whenever exploit code is about to be executed. This talk presents different classes of exploits that can be observed in a dynamic instrumentation system. The exploits are analyzed and different security strategies are discussed. We then show how the instrumentation framework can implement an online protection mechanism against each class of attack vectors. Observable Attack Vectors Stack Overflow A limited buffer is (over) flown with user-data and over writes data on the stack (e.g., the return instruction pointer). Format String Attack An attack can write to an arbitrary address (e.g., the return instruction pointer or the address of a library function) if unvalidated user input is passed directly to the printf function. Return to libc Attack This attack prepares multiple stack frames that execute code sequences in libraries. The stack frame can be constructed so that (almost) arbitrary code is executed. Race Attacks / TOCTTOU Time-of-check-to-time-of-use race conditions exploit the fact that they can change values on the stack after they are checked but before they are used in the program or kernel. Integer Overflow Overflows can be triggered by using a negative integer value instead of an unsigned value. Heap Overflow A heap buffer overflow is used to overwrite function pointers or data from the memory allocator to trigger execution of arbitrary code. Code Anomalies x86_64 code is backward compatible to ia32 and in modern operating systems x86_64 and ia32 code can be mixed. The mix of different system calls makes it possible to break out of sand boxes that are not aware of all possible combinations of system calls. The exploits are detected generally whenever the program branches to the injected code or to the constructed code fragments. The program is interrupted and a debugger can be attached to analyze the state of the program. TOCTTOU attacks can be detected by observing the threads and using a specific system call architecture. Conclusion Dynamic instrumentation is an important tool to prohibit, detect, and analyze different attack vectors to running programs. Additional instrumentation guards can be used to better understand exploits. The additional layer of virtualization implemented through dynamic instrumentation can be used to detect and log bugs and is an additional line of defense against new exploits. Related Work A detailed discussion of related work is in the paper. These references here are for informational purposes only (to show how this talk was inspired) and not complete.
-
-
7:01
»
Hack a Day
[Russ Cox], current Googler and formerly of Bell Labs, posted an awesome guide to putting images in a QR code. Unlike this terrible attempt I wrote last August, [Russ]‘s method does much more than simply paste an image into a QR code and hope the error correction passes. This new method generates a unique URL to [...]
-
-
14:08
»
Hack a Day
What happens if you’re a prolific developer and decide to release all of the source code from your work? Well, you should get a huge pat on the back from all interested parties. And so we say thank you to [Hunter Davis] for releasing the source code for his 70+ Android apps. But just making [...]
-
-
21:29
»
SecDocs
Authors:
Jesse Ou Rich Lundeen Travis Rhodes Tags:
web application XSS Event:
Chaos Communication Congress 28th (28C3) 2011 Abstract: Writing secure code is hard. Even when people do it basically right there are sometimes edge cases that can be exploited. Most the time writing code that works isn’t even the hard part, it’s keeping up with the changing attack techniques while still keeping an eye on all the old issues that can come back to bite you, straddling the ancient world of the 90’s RFCs and 2010’s HTML5 compatible browsers. A lot like how Indiana Jones bridges the ancient and the modern... Except for Indiana Jones 4. Let’s never talk about that again. Ever. Take Facebook, Office 365, Wordpress, Exchange, and Live. These are applications that had decent mitigations to standard threats, but they all had edge cases. Using a mix of old and new ingredients, we’ll provide a sampler plate of clickjacking protection bypasses, CSRF mitigation bypasses, "non-exploitable" XSS attacks that are suddenly exploitable and XML attacks where you can actually get a shell; and we'll talk about how to defend against these attacks. The best description is probably via the slides linked below. We've put a lot of effort into these, and they have video clips making the slide deck pretty big (why we're linking to it and not attaching it).
-
21:29
»
SecDocs
Authors:
Jesse Ou Rich Lundeen Travis Rhodes Tags:
web application XSS Event:
Chaos Communication Congress 28th (28C3) 2011 Abstract: Writing secure code is hard. Even when people do it basically right there are sometimes edge cases that can be exploited. Most the time writing code that works isn’t even the hard part, it’s keeping up with the changing attack techniques while still keeping an eye on all the old issues that can come back to bite you, straddling the ancient world of the 90’s RFCs and 2010’s HTML5 compatible browsers. A lot like how Indiana Jones bridges the ancient and the modern... Except for Indiana Jones 4. Let’s never talk about that again. Ever. Take Facebook, Office 365, Wordpress, Exchange, and Live. These are applications that had decent mitigations to standard threats, but they all had edge cases. Using a mix of old and new ingredients, we’ll provide a sampler plate of clickjacking protection bypasses, CSRF mitigation bypasses, "non-exploitable" XSS attacks that are suddenly exploitable and XML attacks where you can actually get a shell; and we'll talk about how to defend against these attacks. The best description is probably via the slides linked below. We've put a lot of effort into these, and they have video clips making the slide deck pretty big (why we're linking to it and not attaching it).
-
-
21:00
»
Packet Storm Security Exploits
Quest InTrust version 10.4.x with Annotation Objects active-x control ANNOTATEX.DLL suffers from a remote code execution vulnerability. Proof of concept code included.
-
21:00
»
Packet Storm Security Recent Files
Quest InTrust version 10.4.x with Annotation Objects active-x control ANNOTATEX.DLL suffers from a remote code execution vulnerability. Proof of concept code included.
-
21:00
»
Packet Storm Security Misc. Files
Quest InTrust version 10.4.x with Annotation Objects active-x control ANNOTATEX.DLL suffers from a remote code execution vulnerability. Proof of concept code included.
-
-
13:36
»
Packet Storm Security Exploits
This Metasploit module exploits FreePBX version 2.10.0,2.9.0 and possibly older. Due to the way callme_page.php handles the 'callmenum' parameter, it is possible to inject code to the '$channel' variable in function callme_startcall in order to gain remote code execution. Please note in order to use this module properly, you must know the extension number, which can be enumerated or bruteforced, or you may try some of the default extensions such as 0 or 200. Also, the call has to be answered (or go to voice). Tested on both Elastix and FreePBX ISO image installs.
-
13:36
»
Packet Storm Security Recent Files
This Metasploit module exploits FreePBX version 2.10.0,2.9.0 and possibly older. Due to the way callme_page.php handles the 'callmenum' parameter, it is possible to inject code to the '$channel' variable in function callme_startcall in order to gain remote code execution. Please note in order to use this module properly, you must know the extension number, which can be enumerated or bruteforced, or you may try some of the default extensions such as 0 or 200. Also, the call has to be answered (or go to voice). Tested on both Elastix and FreePBX ISO image installs.
-
13:36
»
Packet Storm Security Misc. Files
This Metasploit module exploits FreePBX version 2.10.0,2.9.0 and possibly older. Due to the way callme_page.php handles the 'callmenum' parameter, it is possible to inject code to the '$channel' variable in function callme_startcall in order to gain remote code execution. Please note in order to use this module properly, you must know the extension number, which can be enumerated or bruteforced, or you may try some of the default extensions such as 0 or 200. Also, the call has to be answered (or go to voice). Tested on both Elastix and FreePBX ISO image installs.
-
-
12:55
»
SecDocs
Authors:
Guillaume Delugré Tags:
phone Event:
Chaos Communication Congress 28th (28C3) 2011 Abstract: Despite their wide presence in our lives, baseband chips are still nowadays poorly known and understood from a system point of view. Some presentations have hilighted vulnerabilities in GSM stacks across various models of basebands (cf. 27c3: All your baseband are belong to us by R-P. Weinmann). However none of them actually focused on the details of how a baseband operating system really works. This is the focus of our presentation. From the study of a simple 3G USB stick equipped with a Qualcomm baseband, we will discuss how to dump the volatile memory, reverse-engineer the proprietary RTOS, and ultimately execute and debug code while trying to preserve the real-time system constraints. Introduction The following work has resulted from a straightforward observation: security in the baseband world is something hard to reach. Anyone trying to get into it is confronted with two obstacles. At the network level, one has to apprehend the extremely massive 3GPP specifications. At the system level, basebands are just undocumented and closed-source pieces of code running in embedded chips. Consequently, a baseband is mostly seen as a blackbox running code for a terrifyingly complex network stack. Given the complexity of the involved network protocols, and the fact that telephony stacks are historically old pieces of code, it is fairly acceptable to think that vulnerabilities can be found inside basebands. Ralf-Philipp Weinmann has already demonstrated this claim during the 27C3 event in 2010. Finding and triggering vulnerabilities in basebands sound very appealing, but we have to remember that these are only preliminary steps before the final exploitation. And for any exploitation to succeed, one has to know the environment into which the code is currently running. What is the architecture? What is the operating system? What does the memory look like? How is structured the heap? Can I safely return to some point and resume the execution? For those reasons and out of curiosity, I started exploring the core of a Qualcomm baseband. The targeted device is the Icon 225 3G USB stick. It embeds a MSM6280 Qualcomm baseband based on the ARMv5TEJ architecture, plus two proprietary DSPs. No application processor is present on those USB sticks. Qualcomm basebands are also notably present on HTC phones. Dumping the device memory The first step for understanding the baseband code is to manage to get a look at it. Plugging the USB stick fires up three serial ports over the USB link. The first one is used to handle Hayes commands to control the modem. The two other ones are unknown at first glance. However I remarked that a little tool for SIM-unlocking a device made use of one of those serial ports. After dumping the USB packets, it appeared this serial link actually handles diagnostic commands for Qualcomm. The protocol used is very simple and allows at least writing and executing code into a small region of the memory. Injecting a custom payload allowed me to quickly dump the entire contents of the memory (32MB). On the ARM architecture, the first piece of code to be executed is a ROM located at 0xffff0000. Reverse-engineering this primary bootloader (PBL) gives us the entry point to the secondary bootloader (SBL). Then disassembling the RAM dump from this address clearly indicates we have one-to-one physical to virtual memory mapping. Reverse engineering the RTOS The embedded code inside the baseband is a proprietary operating system from Qualcomm. The real-time microkernel seems to be called REX, while the operating system itself is named AMSS. I have reverse-engineered most part of the microkernel primitives including: the scheduler the inter-tasks communication mechanism the asynchronous/deferred procedure calls mechanism the timers the heap memory structure and allocation routines The kernel implements lightweight processes called tasks. All tasks share the same virtual address space. MMU is set up at boot time with a virtual to physical mapping and the first 12MB of memory are marked read-only. NX is not enabled (thus everything is executable). Three tasks are created automatically at boot time: the idle task the DPC task, responsible for dispatching deferred procedure calls the main task, responsible for running all the other tasks When fully started, AMSS is made up of approximatively 70 running tasks. They are dedicated to hardware management (DSP, USB, USIM, Vocoder, ...), network stacks management for each layer (GSM L1/L2/L3, SMS, RRC, LLC, and so on), and miscellaneous features (in particular the diagnostic task). Although the USB stick is only intended to be used for data over 3G, the operating system is a full-blown baseband supporting all kinds of telephony stacks and features. The tasks communicate with each other by the mean of signals and buffer queues. A command buffer is pushed on a FIFO queue and a signal is sent to the task for processing. Regarding the memory allocation management, the operating system mainly uses two kinds of heaps. The first heap has a classical free blocks-tracking structure where tasks can allocate arbitrary memory blocks using the malloc/free functions. Another kind of heap is also used on top of the former to represent the memory as a contiguous stream of data that tasks can produce and consume (suited for network data flow). Code execution and debugging Static analysis of the whole operating system is possible, but the code is pretty massive and a lot of interactions between different tasks are involved at run-time. Since code execution is possible on the device, I investigated how to dynamically debug system code. I present here the architecture of the debugger I am currently writing (this is still a work in progress). The main point is to be able to debug the operating system with the fewest possible side-effects. In a nutshell, the debugger has to be real-time compliant as much as possible. For the communication with the debugger, I decided to reuse the diagnostic task channel over USB by implementing custom command handlers. The debugger then relies on the GDB server protocol implemented over the diagnostic channel protocol, itself being over USB. We have access to the interrupt vectors, and we can put BKPT instructions anywhere as well (everything is running in ARM supervisor mode and we can disable the MMU if necessary). If the exception address is a watchpoint, we dump the state of registers and stack, and set up a DPC to acknowledge the debugger of the event. Then execution is immediately resumed. If the exception address is a breakpoint, then we set up a DPC for the debugger and put the task into a wait state allowing other tasks to be immediately scheduled. The execution for the waiting task can be resumed by the debugger by sending it a special signal. The debugger is making use of its own separated heap and queue at a high address, not to interfere with other operating system tasks while processing debug events. Of course some tasks will need to process code at timely events, especially those at the lowest layers, so specific care has to be taken not to put breakpoints that would possibly break the RF processing. ARMv5 has no native support for single-stepping the code. Single-step is implemented by predicting the next PC address and putting a breakpoint at it. Notes and further thoughts Information about the code execution environment on basebands is clearly lacking in the literature. On the contrary of previous presentations on the same topic, this presentation focuses on the details of a proprietary baseband operating system, in this case Qualcomm's. I intend to do a demonstration of the debugger for the presentation, and to release the source code later on. Future areas of work may include a study of the proprietary DSPs and the possibility to locally fuzz the baseband without using a base station.
-
12:55
»
SecDocs
Authors:
Guillaume Delugré Tags:
phone Event:
Chaos Communication Congress 28th (28C3) 2011 Abstract: Despite their wide presence in our lives, baseband chips are still nowadays poorly known and understood from a system point of view. Some presentations have hilighted vulnerabilities in GSM stacks across various models of basebands (cf. 27c3: All your baseband are belong to us by R-P. Weinmann). However none of them actually focused on the details of how a baseband operating system really works. This is the focus of our presentation. From the study of a simple 3G USB stick equipped with a Qualcomm baseband, we will discuss how to dump the volatile memory, reverse-engineer the proprietary RTOS, and ultimately execute and debug code while trying to preserve the real-time system constraints. Introduction The following work has resulted from a straightforward observation: security in the baseband world is something hard to reach. Anyone trying to get into it is confronted with two obstacles. At the network level, one has to apprehend the extremely massive 3GPP specifications. At the system level, basebands are just undocumented and closed-source pieces of code running in embedded chips. Consequently, a baseband is mostly seen as a blackbox running code for a terrifyingly complex network stack. Given the complexity of the involved network protocols, and the fact that telephony stacks are historically old pieces of code, it is fairly acceptable to think that vulnerabilities can be found inside basebands. Ralf-Philipp Weinmann has already demonstrated this claim during the 27C3 event in 2010. Finding and triggering vulnerabilities in basebands sound very appealing, but we have to remember that these are only preliminary steps before the final exploitation. And for any exploitation to succeed, one has to know the environment into which the code is currently running. What is the architecture? What is the operating system? What does the memory look like? How is structured the heap? Can I safely return to some point and resume the execution? For those reasons and out of curiosity, I started exploring the core of a Qualcomm baseband. The targeted device is the Icon 225 3G USB stick. It embeds a MSM6280 Qualcomm baseband based on the ARMv5TEJ architecture, plus two proprietary DSPs. No application processor is present on those USB sticks. Qualcomm basebands are also notably present on HTC phones. Dumping the device memory The first step for understanding the baseband code is to manage to get a look at it. Plugging the USB stick fires up three serial ports over the USB link. The first one is used to handle Hayes commands to control the modem. The two other ones are unknown at first glance. However I remarked that a little tool for SIM-unlocking a device made use of one of those serial ports. After dumping the USB packets, it appeared this serial link actually handles diagnostic commands for Qualcomm. The protocol used is very simple and allows at least writing and executing code into a small region of the memory. Injecting a custom payload allowed me to quickly dump the entire contents of the memory (32MB). On the ARM architecture, the first piece of code to be executed is a ROM located at 0xffff0000. Reverse-engineering this primary bootloader (PBL) gives us the entry point to the secondary bootloader (SBL). Then disassembling the RAM dump from this address clearly indicates we have one-to-one physical to virtual memory mapping. Reverse engineering the RTOS The embedded code inside the baseband is a proprietary operating system from Qualcomm. The real-time microkernel seems to be called REX, while the operating system itself is named AMSS. I have reverse-engineered most part of the microkernel primitives including: the scheduler the inter-tasks communication mechanism the asynchronous/deferred procedure calls mechanism the timers the heap memory structure and allocation routines The kernel implements lightweight processes called tasks. All tasks share the same virtual address space. MMU is set up at boot time with a virtual to physical mapping and the first 12MB of memory are marked read-only. NX is not enabled (thus everything is executable). Three tasks are created automatically at boot time: the idle task the DPC task, responsible for dispatching deferred procedure calls the main task, responsible for running all the other tasks When fully started, AMSS is made up of approximatively 70 running tasks. They are dedicated to hardware management (DSP, USB, USIM, Vocoder, ...), network stacks management for each layer (GSM L1/L2/L3, SMS, RRC, LLC, and so on), and miscellaneous features (in particular the diagnostic task). Although the USB stick is only intended to be used for data over 3G, the operating system is a full-blown baseband supporting all kinds of telephony stacks and features. The tasks communicate with each other by the mean of signals and buffer queues. A command buffer is pushed on a FIFO queue and a signal is sent to the task for processing. Regarding the memory allocation management, the operating system mainly uses two kinds of heaps. The first heap has a classical free blocks-tracking structure where tasks can allocate arbitrary memory blocks using the malloc/free functions. Another kind of heap is also used on top of the former to represent the memory as a contiguous stream of data that tasks can produce and consume (suited for network data flow). Code execution and debugging Static analysis of the whole operating system is possible, but the code is pretty massive and a lot of interactions between different tasks are involved at run-time. Since code execution is possible on the device, I investigated how to dynamically debug system code. I present here the architecture of the debugger I am currently writing (this is still a work in progress). The main point is to be able to debug the operating system with the fewest possible side-effects. In a nutshell, the debugger has to be real-time compliant as much as possible. For the communication with the debugger, I decided to reuse the diagnostic task channel over USB by implementing custom command handlers. The debugger then relies on the GDB server protocol implemented over the diagnostic channel protocol, itself being over USB. We have access to the interrupt vectors, and we can put BKPT instructions anywhere as well (everything is running in ARM supervisor mode and we can disable the MMU if necessary). If the exception address is a watchpoint, we dump the state of registers and stack, and set up a DPC to acknowledge the debugger of the event. Then execution is immediately resumed. If the exception address is a breakpoint, then we set up a DPC for the debugger and put the task into a wait state allowing other tasks to be immediately scheduled. The execution for the waiting task can be resumed by the debugger by sending it a special signal. The debugger is making use of its own separated heap and queue at a high address, not to interfere with other operating system tasks while processing debug events. Of course some tasks will need to process code at timely events, especially those at the lowest layers, so specific care has to be taken not to put breakpoints that would possibly break the RF processing. ARMv5 has no native support for single-stepping the code. Single-step is implemented by predicting the next PC address and putting a breakpoint at it. Notes and further thoughts Information about the code execution environment on basebands is clearly lacking in the literature. On the contrary of previous presentations on the same topic, this presentation focuses on the details of a proprietary baseband operating system, in this case Qualcomm's. I intend to do a demonstration of the debugger for the presentation, and to release the source code later on. Future areas of work may include a study of the proprietary DSPs and the possibility to locally fuzz the baseband without using a base station.
-
-
10:01
»
Hack a Day
Here’s another audio playback hack that uses physical tokens to choose what you’re listening to. It uses Touchatag RFID hardware to control iTunes. The concept is very similar to the standalone Arduino jukebox we saw on Wednesday except this one interfaces with your computer and the tags select entire albums instead of just one song. [...]
-
-
19:33
»
Packet Storm Security Recent Files
Ubuntu Security Notice 1396-1 - It was discovered that the GNU C Library did not properly handle integer overflows in the timezone handling code. An attacker could use this to possibly execute arbitrary code by convincing an application to load a maliciously constructed tzfile. It was discovered that the GNU C Library did not properly handle passwd.adjunct.byname map entries in the Network Information Service (NIS) code in the name service caching daemon (nscd). An attacker could use this to obtain the encrypted passwords of NIS accounts. This issue only affected Ubuntu 8.04 LTS. Various other issues were also addressed.
-
19:33
»
Packet Storm Security Misc. Files
Ubuntu Security Notice 1396-1 - It was discovered that the GNU C Library did not properly handle integer overflows in the timezone handling code. An attacker could use this to possibly execute arbitrary code by convincing an application to load a maliciously constructed tzfile. It was discovered that the GNU C Library did not properly handle passwd.adjunct.byname map entries in the Network Information Service (NIS) code in the name service caching daemon (nscd). An attacker could use this to obtain the encrypted passwords of NIS accounts. This issue only affected Ubuntu 8.04 LTS. Various other issues were also addressed.
-
-
21:06
»
Packet Storm Security Advisories
Zero Day Initiative Advisory 12-034 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Windows Media Player. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ASX meta files. When the code within wmp.dll attempts to process the version string within a meta file, it copies it to a fixed-length buffer on the stack without checking that the destination can contain the input data. This can be abused remotely by attackers to execute arbitrary code under the context of the user running the media application.
-
21:06
»
Packet Storm Security Recent Files
Zero Day Initiative Advisory 12-034 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Windows Media Player. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ASX meta files. When the code within wmp.dll attempts to process the version string within a meta file, it copies it to a fixed-length buffer on the stack without checking that the destination can contain the input data. This can be abused remotely by attackers to execute arbitrary code under the context of the user running the media application.
-
21:06
»
Packet Storm Security Misc. Files
Zero Day Initiative Advisory 12-034 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Windows Media Player. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ASX meta files. When the code within wmp.dll attempts to process the version string within a meta file, it copies it to a fixed-length buffer on the stack without checking that the destination can contain the input data. This can be abused remotely by attackers to execute arbitrary code under the context of the user running the media application.
-
-
13:02
»
Hack a Day
You know you’ve got a good hardware platform if you can easily repurpose it with a code rewrite. And that’s what [Eric] continues to do with these little Hexbugs. This time around he’s bent the IR emitter and receiver downward to use as a reflectance sensor. This gives it the ability to follow a dark [...]
-
9:01
»
Hack a Day
This gnarly beast has near-magical qualities. [Sprite_TM] patched it together as a dongle which attaches to a JTAG header (we’re fairly certain this is not a standard footprint for that interface though). He uses it to push code to an FPGA after that device boots. Why? Well, there’s several reason, but the most generic answer [...]
-
13:36
»
Packet Storm Security Advisories
Zero Day Initiative Advisory 12-021 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Reader X. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within 2d.x3d, which is Adobe Reader's code responsible for processing BMP files. When passing a negative size parameter in the 'colors' field, a series of signed comparisons will be averted, and the overly large size parameter is passed to a memcpy(). This will cause a heap-based buffer overflow, allowing an attacker to execute code under the context of the user.
-
13:36
»
Packet Storm Security Recent Files
Zero Day Initiative Advisory 12-021 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Reader X. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within 2d.x3d, which is Adobe Reader's code responsible for processing BMP files. When passing a negative size parameter in the 'colors' field, a series of signed comparisons will be averted, and the overly large size parameter is passed to a memcpy(). This will cause a heap-based buffer overflow, allowing an attacker to execute code under the context of the user.
-
8:09
»
SecDocs
Authors:
Jesse Ou Rich Lundeen Tags:
web application cookie vulnerability XSS Event:
Black Hat Abu Dhabi 2011 Abstract: Writing secure code is hard. Even when people do it basically right there are sometimes edge cases that can be exploited. Most the time writing code that works isn't even the hard part, it's keeping up with the changing attack techniques while still keeping an eye on all the old issues that can come back to bite you, straddling the ancient world of the 90's RFCs and 2010's HTML5 compatible browsers. A lot like how Indiana Jones bridges the ancient and the modern... Except for Indiana Jones 4. Let's never talk about that again. Ever. Take Facebook, Office 365, MSN, and Wordpress. These are applications that had decent mitigations to standard threats, but they all had edge cases. Using a mix of old and new ingredients, we'll provide a sampler plate of clickjacking protection bypasses, CSRF mitigation bypasses, "non-exploitable" XSS attacks that are suddenly exploitable and XML attacks where you can actually get a shell; and we'll talk about how to defend against these attacks.
-
8:09
»
SecDocs
Authors:
Jesse Ou Rich Lundeen Tags:
web application cookie vulnerability XSS Event:
Black Hat Abu Dhabi 2011 Abstract: Writing secure code is hard. Even when people do it basically right there are sometimes edge cases that can be exploited. Most the time writing code that works isn't even the hard part, it's keeping up with the changing attack techniques while still keeping an eye on all the old issues that can come back to bite you, straddling the ancient world of the 90's RFCs and 2010's HTML5 compatible browsers. A lot like how Indiana Jones bridges the ancient and the modern... Except for Indiana Jones 4. Let's never talk about that again. Ever. Take Facebook, Office 365, MSN, and Wordpress. These are applications that had decent mitigations to standard threats, but they all had edge cases. Using a mix of old and new ingredients, we'll provide a sampler plate of clickjacking protection bypasses, CSRF mitigation bypasses, "non-exploitable" XSS attacks that are suddenly exploitable and XML attacks where you can actually get a shell; and we'll talk about how to defend against these attacks.
-
-
16:31
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of RealNetworks Real Player.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
16:31
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of RealNetworks Real Player.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
16:31
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of RealNetworks Real Player.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
16:25
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of RealNetworks Real Player.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
-
21:41
»
SecDocs
Authors:
Christiaan Beek Tags:
malware intelligence malware analysis Event:
Black Hat Abu Dhabi 2011 Abstract: Over years the use of malware has dramatically changed. Ranging from programmers exploring the malicious possibilities of their programming code, copycats trying to combine code snippets, to organized crime and governments using custom made malware for their purposes. Where financial gratification is the main drive for cybercrime, it seems that the hunger for secrets and intellectual property is taking over. Some examples of cases are: Operation Aurora, Night-Dragon and recently Shady-RAT. These are examples of investigations that started with the detection of unknown customized malware, hiding on corporate networks and ended in large investigations regarding Data Loss. So how is it possible that this malware was undetected? How can you detect hidden malware on your network using open-source tools, what patterns to look for? What countermeasures can you take? How to build a layered malware defense to keep unknown malware out of your network. In my talk I will give some demo's how you can use Wireshark to investigate networkdata for traces of malware, how to filter for suspicious connections.
-
-
16:29
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of RealNetworks RealPlayer.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
16:29
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of RealNetworks RealPlayer.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
16:24
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of RealNetworks Realplayer.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
15:34
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Indusoft WebStudio.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
15:34
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Indusoft WebStudio.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
15:29
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the ProFTPd server.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
-
20:29
»
Packet Storm Security Exploits
This Metasploit module exploits a vulnerability in the 'proc_deutf()' function defined in /includes/functions_vbseocp_abstract.php in vBSEO versions 3.6.0 and below. User input passed through 'char_repl' POST parameter is not properly sanitized before being used in a call to preg_replace() function which uses the 'e' modifier. This can be exploited to inject and execute arbitrary code leveraging the PHP's complex curly syntax.
-
20:29
»
Packet Storm Security Recent Files
This Metasploit module exploits a vulnerability in the 'proc_deutf()' function defined in /includes/functions_vbseocp_abstract.php in vBSEO versions 3.6.0 and below. User input passed through 'char_repl' POST parameter is not properly sanitized before being used in a call to preg_replace() function which uses the 'e' modifier. This can be exploited to inject and execute arbitrary code leveraging the PHP's complex curly syntax.
-
20:29
»
Packet Storm Security Misc. Files
This Metasploit module exploits a vulnerability in the 'proc_deutf()' function defined in /includes/functions_vbseocp_abstract.php in vBSEO versions 3.6.0 and below. User input passed through 'char_repl' POST parameter is not properly sanitized before being used in a call to preg_replace() function which uses the 'e' modifier. This can be exploited to inject and execute arbitrary code leveraging the PHP's complex curly syntax.
-
-
16:59
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of GE Proficy Historian.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
16:08
»
Packet Storm Security Exploits
WordPress versions 3.3.1 and below suffer from MySQL username/password disclosure, PHP code execution and cross site scripting vulnerabilities.
-
16:08
»
Packet Storm Security Misc. Files
WordPress versions 3.3.1 and below suffer from MySQL username/password disclosure, PHP code execution and cross site scripting vulnerabilities.
-
-
17:59
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell ZENWorks.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
17:54
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell ZENWorks.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
-
10:59
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple Quicktime.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
10:59
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple Quicktime.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
10:59
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple Quicktime.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
10:54
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple's QuickTime Player.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
18:44
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Reader.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
17:07
»
Packet Storm Security Recent Files
This shellcode writes down your code in the end of found files. Your code will be added only .html and .php files. Search for files is carried out recursively.
-
17:07
»
Packet Storm Security Misc. Files
This shellcode writes down your code in the end of found files. Your code will be added only .html and .php files. Search for files is carried out recursively.
-
17:54
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Reader.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
-
16:24
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple Quicktime.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
16:24
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Symantec IM Manager.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
-
17:44
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Reader.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
17:44
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Reader.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
17:44
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
-
16:49
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Reader.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
16:49
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell GroupWise.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
16:44
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Reader X.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
-
19:14
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Reader.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
19:14
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Office 2007.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
19:09
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple QuickTime Player.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
19:09
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple Quicktime.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
11:39
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Witness Systems eQuality Suite.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
11:34
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple Quicktime.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
11:34
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple Quicktime.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
11:34
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Java.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
-
14:14
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Java.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
-
20:19
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple's QuickTime Player.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
20:19
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple Quicktime.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
20:19
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple QuickTime Player.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
20:14
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple Quicktime.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
-
16:14
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple Quicktime.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
16:09
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple Quicktime.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
-
15:39
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Webkit as utilized by either Apple Safari, or Google's Chrome browser.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
-
11:31
»
Packet Storm Security Advisories
Zero Day Initiative Advisory 11-351 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Wellintek KingView. Authentication is not required to exploit this vulnerability. The specific flaw exists within the protocol parsing code inside nettransdll.dll. The parent service is called HistoryServer.exe and listens on port 777. When a packet with op-code 3 is received, the service allocates memory from the heap based on the 10th and 11th bytes of the packet (element count). Packet data is then copied into the allocated buffer based on the first two bytes of the packet (packet size). These values can be manipulated to create a heap overflow and and attacker can exploit this to remotely execute arbitrary code in the context of the service (Local System).
-
11:31
»
Packet Storm Security Recent Files
Zero Day Initiative Advisory 11-351 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Wellintek KingView. Authentication is not required to exploit this vulnerability. The specific flaw exists within the protocol parsing code inside nettransdll.dll. The parent service is called HistoryServer.exe and listens on port 777. When a packet with op-code 3 is received, the service allocates memory from the heap based on the 10th and 11th bytes of the packet (element count). Packet data is then copied into the allocated buffer based on the first two bytes of the packet (packet size). These values can be manipulated to create a heap overflow and and attacker can exploit this to remotely execute arbitrary code in the context of the service (Local System).
-
11:31
»
Packet Storm Security Misc. Files
Zero Day Initiative Advisory 11-351 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Wellintek KingView. Authentication is not required to exploit this vulnerability. The specific flaw exists within the protocol parsing code inside nettransdll.dll. The parent service is called HistoryServer.exe and listens on port 777. When a packet with op-code 3 is received, the service allocates memory from the heap based on the 10th and 11th bytes of the packet (element count). Packet data is then copied into the allocated buffer based on the first two bytes of the packet (packet size). These values can be manipulated to create a heap overflow and and attacker can exploit this to remotely execute arbitrary code in the context of the service (Local System).
-
10:01
»
Hack a Day
[Thadd Brooks] is a geeky dad of the highest degree. His kids are constantly trying to figure out what mom and dad bought them for Christmas, while he continues to think up ways to stymie their progress. He certainly could have put a few prank presents under the tree, but he opted to go a [...]
-
-
14:09
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple Safari's Webkit.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
14:09
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the Webkit Library.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
14:04
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple Safari's Webkit.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
14:04
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple Safari Webkit.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
14:04
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple QuickTime Player.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
-
15:34
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Secure Backup.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
-
11:34
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Trend Micro Control Manager.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
-
12:19
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple QuickTime.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
-
4:20
»
Carnal0wnage
Stephen,
@averagesecguy, wrote a
post on owning a ColdFusion server. its pretty good and he wrote some code to help things along.
Code: https://github.com/averagesecurityguy/scripts
I thought I'd add to the conversation with some stuff I found doing CF research. The code he wrote and the metasploit module works great if things are in their default locations. Of course, this will never be the case when you are on a PT and need to break into that mofro.
Anyway, there is a misconfiguration that, when its present, can greatly help you exploit that locale traversal attack. Alot of time you can get the sha1.js and verify that the patch is not applied.

Anyway, more than once I've gotten that far but the host was Linux and locating the password.properties file failed. You're essentially guessing blind. So what i discovered is that sometimes the componentlist.cfm [Site/CFIDE/componentutils/componentlist.cfm] file is available. It looks like this:

Click on one of the components and you get full path to the installed component:

Not the best example, because stuff is where we would expect it to be. This one is better:

Now you know where to direct that directory traversal to get the proper file.
Other reading:
http://www.gnucitizen.org/blog/coldfusion-directory-traversal-faq-cve-2010-2861/
-
-
10:29
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple Safari on Windows and multiple applications on OSX.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
10:29
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell File Reporter Engine.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
10:24
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Citrix EdgeSight.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
10:24
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of RealNetworks RealPlayer.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
-
11:34
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Mozilla Firefox.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
11:34
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of RealNetworks Realplayer.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
11:29
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of RealNetworks Real Player.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
-
17:44
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Mozilla Firefox.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
17:44
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the Adobe Shockwave Player.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
17:44
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of RealNetworks RealPlayer.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
17:39
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of RealNetworks RealPlayer.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
-
12:34
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the Adobe Shockwave Player.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
12:29
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Mozilla Firefox.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
12:29
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Shockwave.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
12:19
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Mozilla Firefox.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
-
13:19
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of McAfee Security-as-a-Service.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
13:14
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of EMC AutoStart High Availability.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
13:14
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of McAfee Security-as-a-Service.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
-
11:39
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the Adobe Shockwave Player.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
11:34
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the Adobe Shockwave Player.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
11:34
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of EMC AutoStart.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
11:29
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of EMC AutoStart.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
7:39
»
Packet Storm Security Exploits
WikkaWiki versions 1.3.2 and below suffers from remote SQL injection, unrestricted file upload, arbitrary file download, arbitrary file deletion, remote code execution and cross site request forgery vulnerabilities.
-
7:39
»
Packet Storm Security Recent Files
WikkaWiki versions 1.3.2 and below suffers from remote SQL injection, unrestricted file upload, arbitrary file download, arbitrary file deletion, remote code execution and cross site request forgery vulnerabilities.
-
7:39
»
Packet Storm Security Misc. Files
WikkaWiki versions 1.3.2 and below suffers from remote SQL injection, unrestricted file upload, arbitrary file download, arbitrary file deletion, remote code execution and cross site request forgery vulnerabilities.
-
-
18:44
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the Adobe Shockwave Player.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
18:39
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple Quicktime.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
13:34
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the Oracle Java Runtime.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
13:34
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the Adobe Shockwave Player.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
13:29
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple Quicktime.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
-
11:29
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple QuickTime Player.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
11:24
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple Quicktime.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
-
19:04
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Java Runtime.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
18:59
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the Oracle Java Runtime running on OSX or Linux.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
18:54
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Java.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
-
7:29
»
Packet Storm Security Advisories
Zero Day Initiative Advisory 11-320 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of GE Proficy iFix HMI/SCADA. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ihDataArchiver.exe process which listens by default on TCP port 14000. The code within this module trusts a value supplied over the network and uses it as a length when copying user-supplied data to a stack buffer. By providing a large enough value, this buffer can be overflowed leading to arbitrary code execution under the context of the user running the service.
-
7:29
»
Packet Storm Security Recent Files
Zero Day Initiative Advisory 11-320 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of GE Proficy iFix HMI/SCADA. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ihDataArchiver.exe process which listens by default on TCP port 14000. The code within this module trusts a value supplied over the network and uses it as a length when copying user-supplied data to a stack buffer. By providing a large enough value, this buffer can be overflowed leading to arbitrary code execution under the context of the user running the service.
-
7:29
»
Packet Storm Security Misc. Files
Zero Day Initiative Advisory 11-320 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of GE Proficy iFix HMI/SCADA. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ihDataArchiver.exe process which listens by default on TCP port 14000. The code within this module trusts a value supplied over the network and uses it as a length when copying user-supplied data to a stack buffer. By providing a large enough value, this buffer can be overflowed leading to arbitrary code execution under the context of the user running the service.
-
-
17:49
»
Packet Storm Security Recent Files
The Centreon supervision and monitoring tool provided by Merethis permits remote code execution from the command help web page allowing an attacker to execute arbitrary commands in the context of the webserver hosting the application. The system also uses a one-way hash without a salt. Versions 2.3.1 and below are affected.
-
17:49
»
Packet Storm Security Misc. Files
The Centreon supervision and monitoring tool provided by Merethis permits remote code execution from the command help web page allowing an attacker to execute arbitrary commands in the context of the webserver hosting the application. The system also uses a one-way hash without a salt. Versions 2.3.1 and below are affected.
-
13:44
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the Oracle Java Runtime.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
13:34
»
SecuriTeam
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the Oracle Java Runtime.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
Skip to page:
1
2
3
...
6