Exploiting Apache Struts ExceptionDelegator Vulnerability (CVE-2012-0391)

June 1, 2012, 11:49 am

≫ Next: Exploiting MySQL Authentication Bypass Vulnerability (CVE-2012-2122)

via @ampliasecurity: This week in videos: Exploiting Apache Struts ExceptionDelegator Vulnerability (CVE-2012-0391) http://youtu.be/YGCSJEZ7kPk?hd=1

↧

Exploiting MySQL Authentication Bypass Vulnerability (CVE-2012-2122)

June 13, 2012, 11:08 am

≫ Next: Java 0-Day Vulnerability Exploit Demo (CVE-2012-4681)

≪ Previous: Exploiting Apache Struts ExceptionDelegator Vulnerability (CVE-2012-0391)

via @ampliasecurity: This week in videos: Exploiting MySQL Authentication Bypass Vulnerability (CVE-2012-2122) http://youtu.be/Mg5iUjOpusE?hd=1

Exploitation of this critical vulnerability is trivial and requires only to perform several authentication attempts with any password and a valid username until the MySQL server grants access.

After successful exploitation this exploit dumps information from the target MySQL server such as: version, available databases, password hashes of MySQL users to be cracked later, dumps some system files, in this example, /etc/password, etc. Depending on the configuration of the target MySQL server and privileges of the user selected other actions can be performed.

More information:
http://seclists.org/oss-sec/2012/q2/493
http://bugs.mysql.com/bug.php?id=64884
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2122

↧

Java 0-Day Vulnerability Exploit Demo (CVE-2012-4681)

August 28, 2012, 5:27 pm

≫ Next: New addition to the WCE FAQ: "How can I prevent WCE dumping my logon password in cleartext?"

≪ Previous: Exploiting MySQL Authentication Bypass Vulnerability (CVE-2012-2122)

This is a demo of the Java 0-Day Vulnerability made public on 08-26-2012 (now CVE-2012-4681): http://youtu.be/HO4yO7_5sEc?hd=1 (watch in HD)

This vulnerability was found being exploited in the wild and discovered by Michael Schierl.

This exploit was written based on the PoC published by @jduck1337 at http://pastie.org/pastes/4594319/text

Tested on Windows 7 with Internet Explorer, Firefox and Chrome (keep in mind this affects Java on all platforms)

The exploit is extremely easy to implement, not much needs to be changed from the public PoC besides adding code to drop a payload.

References:

http://blog.fireeye.com/research/2012/08/zero-day-season-is-not-over-yet.html
http://www.deependresearch.org/2012/08/java-7-0-day-vulnerability-information.html
http://immunityproducts.blogspot.com.ar/2012/08/java-0day-analysis-cve-2012-4681.html

↧

New addition to the WCE FAQ: "How can I prevent WCE dumping my logon password in cleartext?"

November 27, 2012, 4:51 pm

≫ Next: Java 7 Update 10 0-Day RCE Exploit Demo (CVE-2013-0422)

≪ Previous: Java 0-Day Vulnerability Exploit Demo (CVE-2012-4681)

New addition to the WCE FAQ: "How can I prevent WCE dumping my logon password in cleartext?"

http://www.ampliasecurity.com/research/wcefaq.html#preventcleartextpwddump

↧

Java 7 Update 10 0-Day RCE Exploit Demo (CVE-2013-0422)

January 10, 2013, 3:19 pm

≫ Next: WCE v1.4beta released

≪ Previous: New addition to the WCE FAQ: "How can I prevent WCE dumping my logon password in cleartext?"

This is a demo of the Java 7 Update 10 0-Day Vulnerability made public on 01-10-2013 (CVE-2013-0422). Java 7 Update 10 0-Day RCE Exploit Demo (CVE-2013-0422)

Exploit made public by http://www.twitter.com/Kafeine
Exploit code released publicly by Gdark - DamageLabs

References:
http://malware.dontneedcoffee.com/2013/01/0-day-17u10-spotted-in-while-disable.html
http://pastebin.com/raw.php?i=cUG2ayjh
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0422

↧

WCE v1.4beta released

May 30, 2013, 6:56 pm

≫ Next: WCE v1.41beta released (minor release)

≪ Previous: Java 7 Update 10 0-Day RCE Exploit Demo (CVE-2013-0422)

WCE v1.4beta released. Includes several bug fixes and support for Windows 8.

32bit version available at http://www.ampliasecurity.com/research/wce_v1_4beta_x32.zip
64bit version available at http://www.ampliasecurity.com/research/wce_v1_4beta_x64.zip
"Universal Binary" (works both on x32 and x64) available at http://www.ampliasecurity.com/research/wce_v1_4beta_universal.zip

↧

WCE v1.41beta released (minor release)

July 18, 2013, 7:52 am

≫ Next: WCE v1.42beta released (32bit)

≪ Previous: WCE v1.4beta released

WCE 1.41beta released. This is a minor release.

Universal binary: http://www.ampliasecurity.com/research/wce_v1_41beta_universal.zip
32bit: http://www.ampliasecurity.com/research/wce_v1_41beta_x32.zip
64bit: http://www.ampliasecurity.com/research/wce_v1_41beta_x64.zip

↧

WCE v1.42beta released (32bit)

November 14, 2013, 7:03 pm

≫ Next: WCE v1.42beta released (64bit)

≪ Previous: WCE v1.41beta released (minor release)

WCE v1.42beta released (32bit). This is a minor release.
New in this version: bug fixes and improved support for unicode cleartext passwords.
http://www.ampliasecurity.com/research/wce_v1_42beta_x32.zip

↧

WCE v1.42beta released (64bit)

November 14, 2013, 7:04 pm

≫ Next: CVE-2014-6271: Exploiting Bash Remote Code Execution Vulnerability

≪ Previous: WCE v1.42beta released (32bit)

WCE v1.42beta released (64bit)
New in this version: improved support for unicode passwords, improved "safe mode" no code injection.
http://www.ampliasecurity.com/research/wce_v1_42beta_x64.zip

↧

CVE-2014-6271: Exploiting Bash Remote Code Execution Vulnerability

September 25, 2014, 9:47 am

≫ Next: (CVE-2014-8826) OS X Gatekeeper Bypass Vulnerability

≪ Previous: WCE v1.42beta released (64bit)

Checkout ampliasecurity's exploit for the CVE-2014-6271 Bash Remote Code Execution Vulnerability against a simple #!/bin/bash CGI script running on Apache.

(CVE-2014-6271) Exploiting Bash Remote Code Execution Vulnerability

You can also read: Exploiting BASH Remote Code Execution Vulnerability (CVE-2014-6271)

↧