Tuesday, November 27, 2012

Tuesday, August 28, 2012

Java 0-Day Vulnerability Exploit Demo (CVE-2012-4681)

This is a demo of the Java 0-Day Vulnerability made public on 08-26-2012 (now CVE-2012-4681): http://youtu.be/HO4yO7_5sEc?hd=1 (watch in HD)

This vulnerability was found being exploited in the wild and discovered by Michael Schierl.

This exploit was written based on the PoC published by @jduck1337 at http://pastie.org/pastes/4594319/text

Tested on Windows 7 with Internet Explorer, Firefox and Chrome (keep in mind this affects Java on all platforms)

The exploit is extremely easy to implement, not much needs to be changed from the public PoC besides adding code to drop a payload.

References:

http://blog.fireeye.com/research/2012/08/zero-day-season-is-not-over-yet.html
http://www.deependresearch.org/2012/08/java-7-0-day-vulnerability-information.html
http://immunityproducts.blogspot.com.ar/2012/08/java-0day-analysis-cve-2012-4681.html

Wednesday, June 13, 2012

Exploiting MySQL Authentication Bypass Vulnerability (CVE-2012-2122)

via @ampliasecurity: This week in videos: Exploiting MySQL Authentication Bypass Vulnerability (CVE-2012-2122) http://youtu.be/Mg5iUjOpusE?hd=1

Exploitation of this critical vulnerability is trivial and requires only to perform several authentication attempts with any password and a valid username until the MySQL server grants access.

After successful exploitation this exploit dumps information from the target MySQL server such as: version, available databases, password hashes of MySQL users to be cracked later, dumps some system files, in this example, /etc/password, etc. Depending on the configuration of the target MySQL server and privileges of the user selected other actions can be performed.

More information:
http://seclists.org/oss-sec/2012/q2/493
http://bugs.mysql.com/bug.php?id=64884
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2122

Friday, June 01, 2012

Exploiting Apache Struts ExceptionDelegator Vulnerability (CVE-2012-0391)

via @ampliasecurity: This week in videos: Exploiting Apache Struts ExceptionDelegator Vulnerability (CVE-2012-0391) http://youtu.be/YGCSJEZ7kPk?hd=1

Wednesday, March 14, 2012

WCE v1.3beta 64bit released

WCE v1.3beta 64bit released. You can download it here. The same functionality recently added to the 32bit version was added to the 64bit version.

Thursday, March 08, 2012

WCE v1.3beta 32bit released

WCE v1.3beta 32bit released. You can download it here.

Changelog for Windows Credentials Editor (WCE) 32-bit version

version 1.3beta:
March 8, 2012
  • Bug fixes
  • Extended support to obtain NTLM hashes without code injection
  • Added feature to dump login cleartext passwords stored by the Digest Authentication package


    Example:

    * Dump cleartext passwords stored by the Digest Authentication package

    C:\>wce -w
    WCE v1.3beta (Windows Credentials Editor) - (c) 2010,2011,2012 Amplia Security -
    by Hernan Ochoa (hernan@ampliasecurity.com)
    Use -h for help.


    test\MYDOMAIN:mypass1234
    NETWORK SERVICE\WORKGROUP:test


    The cleartext passwords dumped include passwords used to login to the Windows box interactively.

    What is WCE?

    Windows Credentials Editor (WCE) v1.3beta allows you to

    NTLM authentication:

    * List logon sessions and add, change, list and delete associated credentials (e.g.: LM/NT hashes)
    * Perform pass-the-hash on Windows natively
    * Obtain NT/LM hashes from memory (from interactive logons, services, remote desktop connections, etc.) which can be
    used to authenticate to other systems. WCE can perform this task without injecting code, just by reading and decrypting information stored in Windows internal memory structures. It also has the capability to automatically switch to code injection when the aforementioned method cannot be performed

    Kerberos authentication:

    * Dump Kerberos tickets (including the TGT) stored in Windows machines
    * Reuse/Load those tickets on another Windows machines, to authenticate to other systems and services
    * Reuse/Load those tickets on *Unix machines, to authenticate to other systems and services

    Digest Authentication:

    * Obtain cleartext passwords entered by the user when logging into a Windows system, and stored by the Windows Digest Authentication security package


    Supported Platforms
    Windows Credentials Editor supports Windows XP, 2003, Vista, 7 and 2008.

    Video (watch in 720p):
  • Tuesday, February 28, 2012

    WCE v1.21 64-bit version released

    I just released WCE v1.21 64bit. This is a minor release, only for the x64 version of WCE.
    It fixes some minor issues with the tool when run on Windows Server 2008.

    You can download it here.

    If you have any questions, please don't hesitate to contact me at hernan[[at]]ampliasecurity.com.

    For any issues you may have, please send me an email instead of leaving your issues as comments; I can't answer your questions properly if you do, and you'll most likely not get your problem solved. Email me and I'll solve your issue.